Changeset 421

Timestamp:

Jul 8, 2013 4:31:19 PM (11 years ago)

Author:

anonymous

Message:

Added switch for login_form_allow_autocomplete

Location:

trunk

Files:

• lib/Auth_SQL.inc.php (modified) (2 diffs)
• lib/PEdit.inc.php (modified) (2 diffs)
• services/templates/login_form.ihtml (modified) (2 diffs)

trunk/lib/Auth_SQL.inc.php

@@ -116 +116 @@
         // Use a db_login_table to detect excessive logins. This requires blocking to be enabled.
         'abuse_detection' => false,
+
+        // Allow users to save login form passwords in their browser? Setting to 'true' may pose a potential security risk.
+        'login_form_allow_autocomplete' => false,
     );
 
@@ -303 +306 @@
             ");
         }
-        $_SESSION['_auth_sql'][$this->_ns] = array('authenticated' => false);
+        $_SESSION['_auth_sql'][$this->_ns] = array(
+            'authenticated'         => false,
+            'user_id'               => null,
+            'username'              => null,
+            'login_datetime'        => null,
+            'last_access_datetime'  => null,
+            'remote_ip'             => getRemoteAddr(),
+            'login_abuse_exempt'    => null,
+            'match_remote_ip_exempt'=> null,
+            'user_data'             => null,
+        );
     }
 

trunk/lib/PEdit.inc.php

@@ -103 +103 @@
         // Setup PEAR XML libraries.
         require_once 'XML/Serializer.php';
-        $this->xml_serializer =& new XML_Serializer(array(
+        $this->xml_serializer = new XML_Serializer(array(
             XML_SERIALIZER_OPTION_INDENT => '',
             XML_SERIALIZER_OPTION_LINEBREAKS => '',
@@ -110 +110 @@
         ));
         require_once 'XML/Unserializer.php';
-        $this->xml_unserializer =& new XML_Unserializer(array(
+        $this->xml_unserializer = new XML_Unserializer(array(
             XML_UNSERIALIZER_OPTION_COMPLEXTYPE => 'array',
         ));

trunk/services/templates/login_form.ihtml

@@ -1 @@
-<form method="post" action="<?php echo oTxt($_SERVER['PHP_SELF']); ?>" class="sc-form" autocomplete="off">
+<?php
+$autocomplete = $auth->getParam('login_form_allow_autocomplete') ? '' : ' autocomplete="off"';
+?>
+<form method="post" action="<?php echo oTxt($_SERVER['PHP_SELF']); ?>" class="sc-form"<?php echo $autocomplete; ?>>
 <?php $app->printHiddenSession() ?>
 <table>
@@ -11 +14 @@
         <td class="sc-right"><label for="password"><?php echo _("Password"); ?></label></td>
         <td>
-            <input type="password" class="sc-small" size="20" name="password" value="" autocomplete="off" />
+            <input type="password" class="sc-small" size="20" name="password" value=""<?php echo $autocomplete; ?> />
         </td>
     </tr>