3 * Check for valid user. Returns true or an error message
6 function yourls_is_valid_user() {
12 $unfiltered_valid = false;
15 if( isset( $_GET['action'] ) && $_GET['action'] == 'logout' ) {
16 yourls_do_action( 'logout' );
17 yourls_store_cookie( null );
18 return yourls__( 'Logged out successfully' );
21 // Check cookies or login request. Login form has precedence.
22 global $yourls_user_passwords;
24 yourls_do_action( 'pre_login' );
26 // Determine auth method and check credentials
28 // API only: Secure (no login or pwd) and time limited token
29 // ?timestamp=12345678&signature=md5(totoblah12345678)
31 isset( $_REQUEST['timestamp'] ) && !empty($_REQUEST['timestamp'] ) &&
32 isset( $_REQUEST['signature'] ) && !empty($_REQUEST['signature'] )
35 yourls_do_action( 'pre_login_signature_timestamp' );
36 $unfiltered_valid = yourls_check_signature_timestamp();
40 // API only: Secure (no login or pwd)
41 // ?signature=md5(totoblah)
43 !isset( $_REQUEST['timestamp'] ) &&
44 isset( $_REQUEST['signature'] ) && !empty( $_REQUEST['signature'] )
47 yourls_do_action( 'pre_login_signature' );
48 $unfiltered_valid = yourls_check_signature();
52 // API or normal: login with username & pwd
53 ( isset( $_REQUEST['username'] ) && isset( $_REQUEST['password'] )
54 && !empty( $_REQUEST['username'] ) && !empty( $_REQUEST['password'] ) )
56 yourls_do_action( 'pre_login_username_password' );
57 $unfiltered_valid = yourls_check_username_password();
61 // Normal only: cookies
63 isset( $_COOKIE['yourls_username'] ) && isset( $_COOKIE['yourls_password'] ) )
65 yourls_do_action( 'pre_login_cookie' );
66 $unfiltered_valid = yourls_check_auth_cookie();
69 $valid = yourls_apply_filter( 'is_valid_user', $unfiltered_valid );
73 yourls_do_action( 'login' );
74 // (Re)store encrypted cookie if needed and tell it's ok
75 if ( !yourls_is_API() && $unfiltered_valid )
76 yourls_store_cookie( YOURLS_USER );
81 yourls_do_action( 'login_failed' );
83 if ( isset( $_REQUEST['username'] ) || isset( $_REQUEST['password'] ) ) {
84 return yourls__( 'Invalid username or password' );
86 return yourls__( 'Please log in' );
91 * Check auth against list of login=>pwd. Sets user if applicable, returns bool
94 function yourls_check_username_password() {
95 global $yourls_user_passwords;
96 if( isset( $yourls_user_passwords[ $_REQUEST['username'] ] ) && yourls_check_password_hash( $yourls_user_passwords[ $_REQUEST['username'] ], $_REQUEST['password'] ) ) {
97 yourls_set_user( $_REQUEST['username'] );
104 * Check a REQUEST password sent in plain text against stored password which can be a salted hash
107 function yourls_check_password_hash( $stored, $plaintext ) {
108 if ( substr( $stored, 0, 4 ) == 'md5:' and strlen( $stored ) == 42 ) {
109 // Stored password is a salted hash: "md5:<$r = rand(10000,99999)>:<md5($r.'thepassword')>"
110 // And 42. Of course. http://www.google.com/search?q=the+answer+to+life+the+universe+and+everything
111 list( $temp, $salt, $md5 ) = explode( ':', $stored );
112 return( $stored == 'md5:'.$salt.':'.md5( $salt.$plaintext ) );
114 // Password was sent in clear
116 $message .= yourls__( '<strong>Notice</strong>: your password is stored as clear text in your <tt>config.php</tt>' );
117 $message .= yourls__( 'Did you know you can easily improve the security of your YOURLS install by <strong>encrypting</strong> your password?' );
118 $message .= yourls__( 'See <a href="http://yourls.org/userpassword">UsernamePassword</a> for details' );
119 yourls_add_notice( $message, 'notice' );
120 return( $stored == $plaintext );
126 * Check auth against encrypted COOKIE data. Sets user if applicable, returns bool
129 function yourls_check_auth_cookie() {
130 global $yourls_user_passwords;
131 foreach( $yourls_user_passwords as $valid_user => $valid_password ) {
133 yourls_salt( $valid_user ) == $_COOKIE['yourls_username']
134 && yourls_salt( $valid_password ) == $_COOKIE['yourls_password']
136 yourls_set_user( $valid_user );
144 * Check auth against signature and timestamp. Sets user if applicable, returns bool
147 function yourls_check_signature_timestamp() {
148 // Timestamp in PHP : time()
149 // Timestamp in JS: parseInt(new Date().getTime() / 1000)
150 global $yourls_user_passwords;
151 foreach( $yourls_user_passwords as $valid_user => $valid_password ) {
154 md5( $_REQUEST['timestamp'].yourls_auth_signature( $valid_user ) ) == $_REQUEST['signature']
156 md5( yourls_auth_signature( $valid_user ).$_REQUEST['timestamp'] ) == $_REQUEST['signature']
159 yourls_check_timestamp( $_REQUEST['timestamp'] )
161 yourls_set_user( $valid_user );
169 * Check auth against signature. Sets user if applicable, returns bool
172 function yourls_check_signature() {
173 global $yourls_user_passwords;
174 foreach( $yourls_user_passwords as $valid_user => $valid_password ) {
175 if ( yourls_auth_signature( $valid_user ) == $_REQUEST['signature'] ) {
176 yourls_set_user( $valid_user );
184 * Generate secret signature hash
187 function yourls_auth_signature( $username = false ) {
188 if( !$username && defined('YOURLS_USER') ) {
189 $username = YOURLS_USER;
191 return ( $username ? substr( yourls_salt( $username ), 0, 10 ) : 'Cannot generate auth signature: no username' );
195 * Check if timestamp is not too old
198 function yourls_check_timestamp( $time ) {
200 // Allow timestamp to be a little in the future or the past -- see Issue 766
201 return yourls_apply_filter( 'check_timestamp', abs( $now - $time ) < YOURLS_NONCE_LIFE, $time );
205 * Store new cookie. No $user will delete the cookie.
208 function yourls_store_cookie( $user = null ) {
211 $time = time() - 3600;
213 global $yourls_user_passwords;
214 if( isset($yourls_user_passwords[$user]) ) {
215 $pass = $yourls_user_passwords[$user];
217 die( 'Stealing cookies?' ); // This should never happen
219 $time = time() + YOURLS_COOKIE_LIFE;
222 $domain = yourls_apply_filter( 'setcookie_domain', parse_url( YOURLS_SITE, 1 ) );
223 $secure = yourls_apply_filter( 'setcookie_secure', yourls_is_ssl() );
224 $httponly = yourls_apply_filter( 'setcookie_httponly', true );
226 if ( !headers_sent() ) {
227 // Set httponly if the php version is >= 5.2.0
228 if( version_compare( phpversion(), '5.2.0', 'ge' ) ) {
229 setcookie('yourls_username', yourls_salt( $user ), $time, '/', $domain, $secure, $httponly );
230 setcookie('yourls_password', yourls_salt( $pass ), $time, '/', $domain, $secure, $httponly );
232 setcookie('yourls_username', yourls_salt( $user ), $time, '/', $domain, $secure );
233 setcookie('yourls_password', yourls_salt( $pass ), $time, '/', $domain, $secure );
242 function yourls_set_user( $user ) {
243 if( !defined( 'YOURLS_USER' ) )
244 define( 'YOURLS_USER', $user );