Changeset 541 for trunk/lib/Auth_SQL.inc.php

Timestamp:

Aug 12, 2015 12:22:54 AM (9 years ago)

Author:

anonymous

Message:

v2.2.0-3: Fixed auth password hashing verification issues. Updated hyperlinkTxt() with option. Updated tests.

File:

• trunk/lib/Auth_SQL.inc.php (modified) (6 diffs)

trunk/lib/Auth_SQL.inc.php

@@ -627 +627 @@
             && !empty($_SESSION['_auth_sql'][$this->_ns]['username'])
             && isset($_SESSION['_auth_sql'][$this->_ns]['login_datetime'])
-            && strtotime($_SESSION['_auth_sql'][$this->_ns]['login_datetime']) > time() - $this->_params['login_timeout']
+            && strtotime($_SESSION['_auth_sql'][$this->_ns]['login_datetime']) > (time() - $this->_params['login_timeout'])
             && isset($_SESSION['_auth_sql'][$this->_ns]['last_access_datetime'])
-            && strtotime($_SESSION['_auth_sql'][$this->_ns]['last_access_datetime']) > time() - $this->_params['idle_timeout']
+            && strtotime($_SESSION['_auth_sql'][$this->_ns]['last_access_datetime']) > (time() - $this->_params['idle_timeout'])
             && $remote_ip_is_matched
         ) {
@@ -650 +650 @@
         } else if (isset($_SESSION['_auth_sql'][$this->_ns]['authenticated']) && true === $_SESSION['_auth_sql'][$this->_ns]['authenticated']) {
             // User is authenticated, but login has expired.
-            if (strtotime($_SESSION['_auth_sql'][$this->_ns]['last_access_datetime']) > time() - 43200) {
+            if (strtotime($_SESSION['_auth_sql'][$this->_ns]['last_access_datetime']) > (time() - 43200)) {
                 // Only raise message if last session is less than 12 hours old.
                 $app->raiseMsg(_("Your session has expired. You need to log-in again."), MSG_NOTICE, __FILE__, __LINE__);
@@ -657 +657 @@
             // Log the reason for login expiration.
             $expire_reasons = array();
-            if (empty($_SESSION['_auth_sql'][$this->_ns]['username'])) {
+            if (!isset($_SESSION['_auth_sql'][$this->_ns]['username']) || empty($_SESSION['_auth_sql'][$this->_ns]['username'])) {
                 $expire_reasons[] = 'username not found';
             }
-            if (strtotime($_SESSION['_auth_sql'][$this->_ns]['login_datetime']) <= time() - $this->_params['login_timeout']) {
+            if (!isset($_SESSION['_auth_sql'][$this->_ns]['login_datetime']) || strtotime($_SESSION['_auth_sql'][$this->_ns]['login_datetime']) <= (time() - $this->_params['login_timeout'])) {
                 $expire_reasons[] = sprintf('login_timeout expired (%s older than %s seconds ago)', $_SESSION['_auth_sql'][$this->_ns]['login_datetime'], $this->_params['login_timeout']);
             }
-            if (strtotime($_SESSION['_auth_sql'][$this->_ns]['last_access_datetime']) <= time() - $this->_params['idle_timeout']) {
+            if (!isset($_SESSION['_auth_sql'][$this->_ns]['last_access_datetime']) || strtotime($_SESSION['_auth_sql'][$this->_ns]['last_access_datetime']) <= (time() - $this->_params['idle_timeout'])) {
                 $expire_reasons[] = sprintf('idle_timeout expired (%s older than %s seconds ago)', $_SESSION['_auth_sql'][$this->_ns]['last_access_datetime'], $this->_params['idle_timeout']);
             }
-            if ($_SESSION['_auth_sql'][$this->_ns]['remote_ip'] != getRemoteAddr()) {
+            if (!isset($_SESSION['_auth_sql'][$this->_ns]['remote_ip']) || $_SESSION['_auth_sql'][$this->_ns]['remote_ip'] != getRemoteAddr()) {
                 if ($this->getParam('match_remote_ip') && !$this->get('match_remote_ip_exempt') && !$user_in_trusted_network) {
                     // There are three cases when a remote IP match will be the cause of a session termination:
@@ -679 +679 @@
             $app->logMsg(sprintf('User_id %s (%s) session expired: %s', $this->get('user_id'), $this->get('username'), join(', ', $expire_reasons)), LOG_INFO, __FILE__, __LINE__);
         } else {
-            $app->logMsg('No authenticated token in _SESSION', LOG_DEBUG, __FILE__, __LINE__);
+            $app->logMsg('Session is not authenticated', LOG_DEBUG, __FILE__, __LINE__);
         }
 
@@ -943 +943 @@
         switch ($hash_type) {
         case self::ENCRYPT_CRYPT :
-            return $this->encryptPassword($password, $encrypted_password) == $encrypted_password;
+            return $this->encryptPassword($password, $encrypted_password, $hash_type) == $encrypted_password;
 
         case self::ENCRYPT_PLAINTEXT :
@@ -950 +950 @@
         case self::ENCRYPT_SHA1 :
         case self::ENCRYPT_SHA1_HARDENED :
-        default :
-            return $this->encryptPassword($password) == $encrypted_password;
+            return $this->encryptPassword($password, $encrypted_password, $hash_type) == $encrypted_password;
 
         case self::ENCRYPT_PASSWORD_BCRYPT :
         case self::ENCRYPT_PASSWORD_DEFAULT :
             return password_verify($password, $encrypted_password);
-        }
-
-        $app->logMsg(sprintf('Unknown hash type: %s', $hash_type), LOG_WARNING, __FILE__, __LINE__);
-        return false;
+
+        default :
+            $app->logMsg(sprintf('Unknown hash type: %s', $hash_type), LOG_WARNING, __FILE__, __LINE__);
+            return false;
+        }
+
     }