Commit 04943e21 authored by chealer's avatar chealer

[SEC] move persistent login cookies from tiki_preferences to new table tiki_user_login_cookies

Intertiki changes untested
userslib: remove unused functions get_user_hash() and get_user_by_hash()
parent cc76268d
......@@ -1278,6 +1278,7 @@ installer/schema/20100211_tiki_sheet_add_parseValues_tiki.sql -text
installer/schema/20100212_rss_automation_tiki.sql -text
installer/schema/20100213_group_inclusion_key_tiki.sql -text
installer/schema/20100214_workspaces_remove_menu_items_tiki.sql -text
installer/schema/20100215_create_tiki_user_login_cookies_tiki.sql -text
installer/schema/20100215_rating_permissions_tiki.sql -text
installer/schema/20100216_attributes_tiki.sql -text
installer/schema/20100216_kil_moz_screencast_tiki.sql -text
......
......@@ -2323,6 +2323,14 @@ CREATE TABLE `tiki_user_bookmarks_urls` (
PRIMARY KEY (`urlId`)
) ENGINE=MyISAM AUTO_INCREMENT=1 ;
DROP TABLE IF EXISTS `tiki_user_login_cookies`;
CREATE TABLE `tiki_user_login_cookies` (
`userId` INT NOT NULL,
`secret` TEXT NOT NULL,
`expiration` TIMESTAMP NOT NULL,
PRIMARY KEY (`userId`, `secret`)
) ENGINE=MyISAM AUTO_INCREMENT=1 ;
DROP TABLE IF EXISTS `tiki_user_mail_accounts`;
CREATE TABLE `tiki_user_mail_accounts` (
`accountId` int(12) NOT NULL auto_increment,
......
CREATE TABLE `tiki_user_login_cookies` (
`userId` INT NOT NULL,
`secret` TEXT NOT NULL,
`expiration` TIMESTAMP NOT NULL,
PRIMARY KEY (`userId`)
) ENGINE=MyISAM AUTO_INCREMENT=1 ;
......@@ -223,7 +223,8 @@ class UsersLib extends TikiLib
$logslib->add_log('login', 'logged out');
$this->delete_user_cookie($user);
$userInfo = $this->get_user_info($user);
$this->delete_user_cookie($userInfo['userId']);
if ($remote && $prefs['feature_intertiki'] == 'y' and $prefs['feature_intertiki_sharedcookie'] == 'y' and !empty($prefs['feature_intertiki_mymaster'])) {
include_once('XML/RPC.php');
......@@ -2535,50 +2536,34 @@ class UsersLib extends TikiLib
}
}
function get_user_hash($user) {
$query = "select `hash` from `users_users` where binary `login` = ?";
$pass = $this->getOne($query, array($user));
return $pass;
}
function get_user_by_hash($hash) {
$query = "select `login` from `users_users` where `hash`=?";
$pass = $this->getOne($query, array($hash));
return $pass;
}
function create_user_cookie($user,$hash=false) {
function create_user_cookie($user, $secret=false) {
global $prefs;
if (!$hash) {
$hash = $this->get_cookie_check() . ".". ($this->now + $prefs['remembertime']);
if (!$secret) {
$secret = $this->get_cookie_check();
}
$this->delete_user_cookie($user);
$this->set_user_preference($user,'cookie',$hash);
return $hash;
$query = "insert into `tiki_user_login_cookies`(`userId`, `secret`, `expiration`) values(?, ?, FROM_UNIXTIME(?))";
$result = $this->query($query, array($user, $secret, $this->now + $prefs['remembertime']));
return $secret;
}
function delete_user_cookie($user) {
$query = 'delete from `tiki_user_preferences` where `prefName`=? and `user`=?';
$this->query($query, array('cookie',$user));
$query = 'delete from `tiki_user_login_cookies` where `userId`=?';
$this->query($query, array($user));
}
function get_cookie_check() {
return md5(session_id() . uniqid(mt_rand(), true));
}
function get_user_by_cookie($hash) {
function get_user_by_cookie($cookie) {
global $prefs;
list($check,$expire,$userCookie) = explode('.',$hash, 3);
$query = "select `user` from `tiki_user_preferences` where `prefName`='cookie' and `value` like ? and `user`=?";
list($secret, $userId) = explode('.', $cookie, 2);
$query = "select `userId` from `tiki_user_login_cookies` where `secret`=? and `userId`=? and `expiration` > NOW()";
if ($this->getOne($query, array("$check.%",$userCookie))) {
if ($expire < $this->now) {
$query = 'delete from `tiki_user_preferences` where `prefName`=? and `value`=?';
$this->query($query, array('cookie',$hash));
return false;
} else {
return $userCookie;
}
if ($userId === $this->getOne($query, array($secret, $userId))) {
return $userId;
}
return false;
}
......
......@@ -75,7 +75,8 @@ function validate($params) {
}
}
if ($prefs['intertiki_logfile']) logit($prefs['intertiki_logfile'],"logged",$login,INTERTIKI_OK,$prefs['known_hosts'][$key]['name']);
$userlib->create_user_cookie($login,$hashkey);
$userInfo = $userlib->get_user_info($login);
$userlib->create_user_cookie($userInfo['userId'], $hashkey);
if ($slave) {
$logslib->add_log('intertiki','auth granted from '.$prefs['known_hosts'][$key]['name'],$login);
......@@ -120,7 +121,8 @@ function logout($params) {
return new XML_RPC_Response(0, 101, $msg);
}
$userlib->user_logout($login, true);
$userlib->delete_user_cookie($login);
$userInfo = $this->get_user_info($login);
$userlib->delete_user_cookie($userInfo['userId']);
if ($prefs['intertiki_logfile']) logit($prefs['intertiki_logfile'],"logout",$login,INTERTIKI_OK,$prefs['known_hosts'][$key]['name']);
$logslib->add_log('intertiki','auth revoked from '.$prefs['known_hosts'][$key]['name'],$login);
return new XML_RPC_Response(new XML_RPC_Value(1, "boolean"));
......
......@@ -292,13 +292,12 @@ if ($isvalid) {
// This happens if the user has just registered and it's first login
if ($url == '' || ereg('(tiki-register|tiki-login_validate|tiki-login_scr)\.php', $url)) $url = $prefs['tikiIndex'];
// Now if the remember me feature is on and the user checked the rememberme checkbox then ...
if ($prefs['rememberme'] != 'disabled') {
if (isset($_REQUEST['rme']) && $_REQUEST['rme'] == 'on') {
$hash = $userlib->create_user_cookie($_REQUEST['user']);
$time = substr($hash, strpos($hash, '.') + 1);
setcookie($user_cookie_site, $hash . '.' . $user, $time, $prefs['cookie_path'], $prefs['cookie_domain']);
if ($prefs['rememberme'] != 'disabled' && isset($_REQUEST['rme']) && $_REQUEST['rme'] == 'on') {
$userInfo = $userlib->get_user_info($user);
$userId = $userInfo['userId'];
$secret = $userlib->create_user_cookie($userId);
setcookie($user_cookie_site, $secret . '.' . $userId, $tikilib->now + $prefs['remembertime'], $prefs['cookie_path'], $prefs['cookie_domain']);
$logslib->add_log('login', 'got a cookie for ' . $prefs['remembertime'] . ' seconds');
}
}
}
}
......
......@@ -323,9 +323,12 @@ if (($prefs['rememberme'] != 'disabled') and (isset($_COOKIE["$user_cookie_site"
}
}
} else {
$user = $userlib->get_user_by_cookie($_COOKIE["$user_cookie_site"]);
if ($userId = $userlib->get_user_by_cookie($_COOKIE["$user_cookie_site"])) {
$userInfo = $userlib->get_userid_info($userId);
$user = $userInfo['login'];
}
}
if ($user) {
if (isset($user) && $user) {
$_SESSION["$user_cookie_site"] = $user;
}
}
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment