From 445b32a0f5c9f3d8f583a2c3f1f793d5e1f0c960 Mon Sep 17 00:00:00 2001 From: ozh Date: Tue, 7 May 2013 18:15:12 +0200 Subject: [PATCH] Handle custom notice upon login --- includes/auth.php | 5 ++++ includes/functions-auth.php | 52 ++++++++++++++++++++++++++++--------- includes/functions-html.php | 20 ++++++++++++++ 3 files changed, 65 insertions(+), 12 deletions(-) diff --git a/includes/auth.php b/includes/auth.php index eddcc89..ca7d947 100644 --- a/includes/auth.php +++ b/includes/auth.php @@ -26,3 +26,8 @@ } yourls_do_action( 'auth_successful' ); + +// Deal with query string message added upon login +if( isset( $_GET['login_msg'] ) ) + yourls_display_login_message(); + diff --git a/includes/functions-auth.php b/includes/functions-auth.php index 333df57..2b2ec99 100644 --- a/includes/functions-auth.php +++ b/includes/functions-auth.php @@ -27,8 +27,7 @@ function yourls_is_valid_user() { } // Check cookies or login request. Login form has precedence. - global $yourls_user_passwords; - + yourls_do_action( 'pre_login' ); // Determine auth method and check credentials @@ -80,12 +79,19 @@ function yourls_is_valid_user() { // Login for the win! if ( $valid ) { yourls_do_action( 'login' ); + // (Re)store encrypted cookie if needed if ( !yourls_is_API() ) { yourls_store_cookie( YOURLS_USER ); + // Login form : redirect to requested URL to avoid re-submitting the login form on page reload if( isset( $_REQUEST['username'] ) && isset( $_REQUEST['password'] ) ) { - yourls_redirect( $_SERVER['REQUEST_URI'] ); + $url = $_SERVER['REQUEST_URI']; + // If password stored unencrypted, append query string. TODO: deprecate this when there's proper user management + if( !yourls_has_hashed_password( $_REQUEST['username'] ) ) { + $url = yourls_add_query_arg( array( 'login_msg' => 'pwdclear' ) ); + } + yourls_redirect( $url ); } } @@ -109,7 +115,7 @@ function yourls_is_valid_user() { */ function yourls_check_username_password() { global $yourls_user_passwords; - if( isset( $yourls_user_passwords[ $_REQUEST['username'] ] ) && yourls_check_password_hash( $yourls_user_passwords[ $_REQUEST['username'] ], $_REQUEST['password'] ) ) { + if( isset( $yourls_user_passwords[ $_REQUEST['username'] ] ) && yourls_check_password_hash( $_REQUEST['username'], $_REQUEST['password'] ) ) { yourls_set_user( $_REQUEST['username'] ); return true; } @@ -117,21 +123,42 @@ function yourls_check_username_password() { } /** - * Check a REQUEST password sent in plain text against stored password which can be a salted hash + * Check a submitted password sent in plain text against stored password which can be a salted hash * */ -function yourls_check_password_hash( $stored, $plaintext ) { - if ( substr( $stored, 0, 4 ) == 'md5:' and strlen( $stored ) == 42 ) { +function yourls_check_password_hash( $user, $submitted_password ) { + global $yourls_user_passwords; + + if( !isset( $yourls_user_passwords[ $user ] ) ) + return false; + + if( yourls_has_hashed_password( $user ) ) { // Stored password is a salted hash: "md5:<$r = rand(10000,99999)>:" - // And 42. Of course. http://www.google.com/search?q=the+answer+to+life+the+universe+and+everything - list( $temp, $salt, $md5 ) = explode( ':', $stored ); - return( $stored == 'md5:'.$salt.':'.md5( $salt.$plaintext ) ); + list( , $salt, ) = explode( ':', $yourls_user_passwords[ $user ] ); + return( $yourls_user_passwords[ $user ] == 'md5:'.$salt.':'.md5( $salt . $submitted_password ) ); } else { - // Password was sent in clear - return( $stored == $plaintext ); + // Password stored in clear text + return( $yourls_user_passwords[ $user ] == $submitted_password ); } } +/** + * Check if a user has a hashed password + * + * Check if a user password is 'md5:[38 chars]'. TODO: deprecate this when/if we have proper user management with + * password hashes stored in the DB + * + * @since 1.7 + * @param string $user user login + * @return bool true if password hashed, false otherwise + */ +function yourls_has_hashed_password( $user ) { + global $yourls_user_passwords; + return( isset( $yourls_user_passwords[ $user ] ) + && substr( $yourls_user_passwords[ $user ], 0, 4 ) == 'md5:' + && strlen( $yourls_user_passwords[ $user ] ) == 42 // http://www.google.com/search?q=the+answer+to+life+the+universe+and+everything + ); +} /** * Check auth against encrypted COOKIE data. Sets user if applicable, returns bool @@ -257,3 +284,4 @@ function yourls_set_user( $user ) { if( !defined( 'YOURLS_USER' ) ) define( 'YOURLS_USER', $user ); } + diff --git a/includes/functions-html.php b/includes/functions-html.php index fdeb229..b3b2102 100644 --- a/includes/functions-html.php +++ b/includes/functions-html.php @@ -845,3 +845,23 @@ function yourls_l10n_calendar_strings() { yourls__( 'Today' ); yourls__( 'Close' ); } + +/** + * Display custom message based on query string parameter 'login_msg' + * + * @since 1.7 + */ +function yourls_display_login_message() { + if( !isset( $_GET['login_msg'] ) ) + return; + + switch( $_GET['login_msg'] ) { + case 'pwdclear': + $message = ''; + $message .= yourls__( 'Notice: your password is stored as clear text in your config.php' ); + $message .= yourls__( 'Did you know you can easily improve the security of your YOURLS install by encrypting your password?' ); + $message .= yourls__( 'See UsernamePassword for details' ); + yourls_add_notice( $message, 'notice' ); + break; + } +} \ No newline at end of file -- 2.45.0