friendica/friendica-addons
8
3
Fork 14
Code Issues 3 Pull requests 1 Releases 16 Wiki Activity

Use User::authenticate in addons

Browse source 
- dav
- jappixmini
- windowsphonepush
This commit is contained in:
Hypolite Petovan 2017-12-01 23:03:49 -05:00
parent 46e09b0544
commit eadf7066e0
3 changed files with 9 additions and 27 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
dav/friendica/dav_friendica_auth.inc.php
View file

@ -67,7 +67,7 @@ class Sabre_DAV_Auth_Backend_Std extends Sabre_DAV_Auth_Backend_AbstractBasic
} }
// Authenticates the user // Authenticates the user
if (!$this->validateUserPass($userpass[0],$userpass[1])) { if (!$this->validateUserPass($userpass[0], $userpass[1])) {
$auth->requireLogin(); $auth->requireLogin();
throw new Sabre_DAV_Exception_NotAuthenticated('Username or password does not match'); throw new Sabre_DAV_Exception_NotAuthenticated('Username or password does not match');
} }
@ -80,13 +80,8 @@ class Sabre_DAV_Auth_Backend_Std extends Sabre_DAV_Auth_Backend_AbstractBasic
* @param string $password * @param string $password
* @return bool * @return bool
*/ */
protected function validateUserPass($username, $password) { protected function validateUserPass($username, $password)
$encrypted = hash('whirlpool',trim($password)); {
$r = q("SELECT COUNT(*) anz FROM `user` WHERE `nickname` = '%s' AND `password` = '%s' AND `blocked` = 0 AND `account_expired` = 0 AND `verified` = 1 LIMIT 1", return User::authenticate($username, $password);
dbesc(trim($username)),
dbesc($encrypted)
);
return ($r[0]["anz"] == 1);
} }
} }

6
jappixmini/jappixmini.php
View file

@ -429,11 +429,7 @@ function jappixmini_settings_post(App $a, &$b)
if ($encrypt) { if ($encrypt) {
// check that Jabber password was encrypted with correct Friendica password // check that Jabber password was encrypted with correct Friendica password
$friendica_password = trim($b['jappixmini-friendica-password']); $friendica_password = trim($b['jappixmini-friendica-password']);
$encrypted = hash('whirlpool',$friendica_password); if (!User::authenticate((int) $uid, $friendica_password)) {
$r = q("SELECT * FROM `user` WHERE `uid`=$uid AND `password`='%s'",
dbesc($encrypted)
);
if (!count($r)) {
info("Wrong friendica password!"); info("Wrong friendica password!");
return; return;
} }

15
windowsphonepush/windowsphonepush.php
View file

@ -455,19 +455,10 @@ function windowsphonepush_login(App $a)
die('This api requires login'); die('This api requires login');
} }
$user = $_SERVER['PHP_AUTH_USER']; $user_id = User::authenticate($_SERVER['PHP_AUTH_USER'], trim($_SERVER['PHP_AUTH_PW']));
$encrypted = hash('whirlpool',trim($_SERVER['PHP_AUTH_PW']));
// check if user specified by app is available in the user table if ($user_id) {
$r = q("SELECT * FROM `user` WHERE ( `email` = '%s' OR `nickname` = '%s' ) $record = dba::select('user', [], ['uid' => $user_id], ['limit' => 1]);
AND `password` = '%s' AND `blocked` = 0 AND `account_expired` = 0 AND `account_removed` = 0 AND `verified` = 1 LIMIT 1",
dbesc(trim($user)),
dbesc(trim($user)),
dbesc($encrypted)
);
if(count($r)){
$record = $r[0];
} else { } else {
logger('API_login failure: ' . print_r($_SERVER, true), LOGGER_DEBUG); logger('API_login failure: ' . print_r($_SERVER, true), LOGGER_DEBUG);
header('WWW-Authenticate: Basic realm="Friendica"'); header('WWW-Authenticate: Basic realm="Friendica"');