MrPetovan/friendica
2
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

Switch to User::authenticate

Browse source 
- Removed hash('whirlpool') to check password
This commit is contained in:
Hypolite Petovan 2017-11-26 14:46:08 -05:00
parent 483603e77c
commit ec6f5193e2
5 changed files with 46 additions and 62 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

15
include/api.php
View file

@ -12,6 +12,7 @@ use Friendica\Core\Config;
use Friendica\Core\NotificationsManager; use Friendica\Core\NotificationsManager;
use Friendica\Core\Worker; use Friendica\Core\Worker;
use Friendica\Database\DBM; use Friendica\Database\DBM;
use Friendica\Model\User;
use Friendica\Network\HTTPException; use Friendica\Network\HTTPException;
use Friendica\Network\HTTPException\BadRequestException; use Friendica\Network\HTTPException\BadRequestException;
use Friendica\Network\HTTPException\ForbiddenException; use Friendica\Network\HTTPException\ForbiddenException;
@ -190,7 +191,6 @@ function api_login(App $a)
$user = $_SERVER['PHP_AUTH_USER']; $user = $_SERVER['PHP_AUTH_USER'];
$password = $_SERVER['PHP_AUTH_PW']; $password = $_SERVER['PHP_AUTH_PW'];
$encrypted = hash('whirlpool', trim($password));
// allow "user@server" login (but ignore 'server' part) // allow "user@server" login (but ignore 'server' part)
$at = strstr($user, "@", true); $at = strstr($user, "@", true);
@ -218,16 +218,9 @@ function api_login(App $a)
if (($addon_auth['authenticated']) && (count($addon_auth['user_record']))) { if (($addon_auth['authenticated']) && (count($addon_auth['user_record']))) {
$record = $addon_auth['user_record']; $record = $addon_auth['user_record'];
} else { } else {
// process normal login request $user_id = User::authenticate(trim($user), trim($password));
$r = q( if ($user_id) {
"SELECT * FROM `user` WHERE (`email` = '%s' OR `nickname` = '%s') $record = dba::select('user', [], ['uid' => $user_id], ['limit' => 1]);
AND `password` = '%s' AND NOT `blocked` AND NOT `account_expired` AND NOT `account_removed` AND `verified` LIMIT 1",
dbesc(trim($user)),
dbesc(trim($user)),
dbesc($encrypted)
);
if (DBM::is_result($r)) {
$record = $r[0];
} }
} }

75
include/auth.php
View file

@ -4,6 +4,7 @@ use Friendica\App;
use Friendica\Core\System; use Friendica\Core\System;
use Friendica\Core\Config; use Friendica\Core\Config;
use Friendica\Database\DBM; use Friendica\Database\DBM;
use Friendica\Model\User;
require_once 'include/security.php'; require_once 'include/security.php';
require_once 'include/datetime.php'; require_once 'include/datetime.php';
@ -98,41 +99,44 @@ if (isset($_SESSION) && x($_SESSION, 'authenticated') && (!x($_POST, 'auth-param
} }
} else { } else {
session_unset(); session_unset();
if (x($_POST, 'password') && strlen($_POST['password'])) { if (
$encrypted = hash('whirlpool', trim($_POST['password'])); !(x($_POST, 'password') && strlen($_POST['password']))
} else { && (
if ((x($_POST, 'openid_url')) && strlen($_POST['openid_url']) || x($_POST, 'openid_url') && strlen($_POST['openid_url'])
(x($_POST, 'username')) && strlen($_POST['username'])) { || x($_POST, 'username') && strlen($_POST['username'])
)
) {
$noid = Config::get('system', 'no_openid');
$noid = Config::get('system', 'no_openid'); $openid_url = trim(strlen($_POST['openid_url']) ? $_POST['openid_url'] : $_POST['username']);
$openid_url = trim((strlen($_POST['openid_url']) ? $_POST['openid_url'] : $_POST['username'])); // validate_url alters the calling parameter
// validate_url alters the calling parameter $temp_string = $openid_url;
$temp_string = $openid_url;
// if it's an email address or doesn't resolve to a URL, fail. // if it's an email address or doesn't resolve to a URL, fail.
if ($noid || strpos($temp_string, '@') || !validate_url($temp_string)) {
$a = get_app();
notice(t('Login failed.') . EOL);
goaway(System::baseUrl());
// NOTREACHED
}
// Otherwise it's probably an openid. if ($noid || strpos($temp_string, '@') || !validate_url($temp_string)) {
try { $a = get_app();
require_once('library/openid.php'); notice(t('Login failed.') . EOL);
$openid = new LightOpenID; goaway(System::baseUrl());
$openid->identity = $openid_url;
$_SESSION['openid'] = $openid_url;
$_SESSION['remember'] = $_POST['remember'];
$openid->returnUrl = System::baseUrl(true) . '/openid';
goaway($openid->authUrl());
} catch (Exception $e) {
notice(t('We encountered a problem while logging in with the OpenID you provided. Please check the correct spelling of the ID.') . '<br /><br >' . t('The error message was:') . ' ' . $e->getMessage());
}
// NOTREACHED // NOTREACHED
} }
// Otherwise it's probably an openid.
try {
require_once('library/openid.php');
$openid = new LightOpenID;
$openid->identity = $openid_url;
$_SESSION['openid'] = $openid_url;
$_SESSION['remember'] = $_POST['remember'];
$openid->returnUrl = System::baseUrl(true) . '/openid';
goaway($openid->authUrl());
} catch (Exception $e) {
notice(t('We encountered a problem while logging in with the OpenID you provided. Please check the correct spelling of the ID.') . '<br /><br >' . t('The error message was:') . ' ' . $e->getMessage());
}
// NOTREACHED
} }
if (x($_POST, 'auth-params') && $_POST['auth-params'] === 'login') { if (x($_POST, 'auth-params') && $_POST['auth-params'] === 'login') {
@ -157,18 +161,9 @@ if (isset($_SESSION) && x($_SESSION, 'authenticated') && (!x($_POST, 'auth-param
if ($addon_auth['authenticated'] && count($addon_auth['user_record'])) { if ($addon_auth['authenticated'] && count($addon_auth['user_record'])) {
$record = $addon_auth['user_record']; $record = $addon_auth['user_record'];
} else { } else {
$user_id = User::authenticate(trim($_POST['username']), trim($_POST['password']));
// process normal login request if ($user_id) {
$record = dba::select('user', [], ['uid' => $user_id], ['limit' => 1]);
$r = q("SELECT `user`.*, `user`.`pubkey` as `upubkey`, `user`.`prvkey` as `uprvkey`
FROM `user` WHERE (`email` = '%s' OR `nickname` = '%s')
AND `password` = '%s' AND NOT `blocked` AND NOT `account_expired` AND NOT `account_removed` AND `verified` LIMIT 1",
dbesc(trim($_POST['username'])),
dbesc(trim($_POST['username'])),
dbesc($encrypted)
);
if (DBM::is_result($r)) {
$record = $r[0];
} }
} }

4
mod/removeme.php
View file

@ -26,9 +26,7 @@ function removeme_post(App $a)
return; return;
} }
$encrypted = hash('whirlpool',trim($_POST['qxz_password'])); if (User::authenticate($a->user['uid'], trim($_POST['qxz_password']))) {
if ((strlen($a->user['password'])) && ($encrypted === $a->user['password'])) {
User::remove($a->user['uid']); User::remove($a->user['uid']);
// NOTREACHED // NOTREACHED
} }

9
mod/settings.php
View file

@ -9,6 +9,7 @@ use Friendica\Core\Config;
use Friendica\Core\PConfig; use Friendica\Core\PConfig;
use Friendica\Database\DBM; use Friendica\Database\DBM;
use Friendica\Model\GlobalContact; use Friendica\Model\GlobalContact;
use Friendica\Model\User;
require_once 'include/group.php'; require_once 'include/group.php';
@ -371,7 +372,6 @@ function settings_post(App $a) {
$newpass = $_POST['password']; $newpass = $_POST['password'];
$confirm = $_POST['confirm']; $confirm = $_POST['confirm'];
$oldpass = hash('whirlpool', $_POST['opassword']);
$err = false; $err = false;
if ($newpass != $confirm) { if ($newpass != $confirm) {
@ -386,8 +386,7 @@ function settings_post(App $a) {
// check if the old password was supplied correctly before // check if the old password was supplied correctly before
// changing it to the new value // changing it to the new value
$r = q("SELECT `password` FROM `user`WHERE `uid` = %d LIMIT 1", intval(local_user())); if (User::authenticate(intval(local_user()), $_POST['opassword'])) {
if ($oldpass != $r[0]['password']) {
notice(t('Wrong password.') . EOL); notice(t('Wrong password.') . EOL);
$err = true; $err = true;
} }
@ -501,9 +500,7 @@ function settings_post(App $a) {
if ($email != $a->user['email']) { if ($email != $a->user['email']) {
$email_changed = true; $email_changed = true;
// check for the correct password // check for the correct password
$r = q("SELECT `password` FROM `user`WHERE `uid` = %d LIMIT 1", intval(local_user())); if (!User::authenticate(intval(local_user()), $_POST['mpassword'])) {
$password = hash('whirlpool', $_POST['mpassword']);
if ($password != $r[0]['password']) {
$err .= t('Wrong Password') . EOL; $err .= t('Wrong Password') . EOL;
$email = $a->user['email']; $email = $a->user['email'];
} }

5
src/Util/ExAuth.php
View file

@ -37,6 +37,7 @@ namespace Friendica\Util;
use Friendica\Core\Config; use Friendica\Core\Config;
use Friendica\Core\PConfig; use Friendica\Core\PConfig;
use Friendica\Database\DBM; use Friendica\Database\DBM;
use Friendica\Model\User;
use dba; use dba;
require_once 'include/dba.php'; require_once 'include/dba.php';
@ -217,8 +218,8 @@ class ExAuth
$aUser = dba::select('user', ['uid', 'password'], ['nickname' => $sUser], ['limit' => 1]); $aUser = dba::select('user', ['uid', 'password'], ['nickname' => $sUser], ['limit' => 1]);
if (DBM::is_result($aUser)) { if (DBM::is_result($aUser)) {
$uid = $aUser['uid']; $uid = User::authenticate($aUser, $aCommand[3]);
$Error = $aUser['password'] != hash('whirlpool', $aCommand[3]); $Error = $uid === false;
} else { } else {
$this->writeLog(LOG_WARNING, 'user not found: ' . $sUser); $this->writeLog(LOG_WARNING, 'user not found: ' . $sUser);
$Error = true; $Error = true;