diff options
author | Angus Gratton <gus@projectgus.com> | 2014-07-01 08:35:07 +1000 |
---|---|---|
committer | Angus Gratton <gus@projectgus.com> | 2014-07-01 18:01:58 +1000 |
commit | f95ecbbf8b1de8bc1270d3cf91dfdf055ea5c78c (patch) | |
tree | d44b0ce78a22e4f064996395490fed029c488ae1 /lib/plugins/authplain/auth.php | |
parent | b5202e29ef62a5345f7a337a76bfff91b9bff344 (diff) | |
download | rpg-f95ecbbf8b1de8bc1270d3cf91dfdf055ea5c78c.tar.gz rpg-f95ecbbf8b1de8bc1270d3cf91dfdf055ea5c78c.tar.bz2 |
authplain: Escape ':' in any data field as '\:'
':' is the field delimiter in the authplain flat text
conf/users.auth.php file, but it's also used as an internal delimiter
for the 'mediawiki' password hash format. Currently using this hash
format corrupts the file
This change escapes ':' as '\:' in any field in the users.auth.php
file, and any '\' as '\\'.
Also adds test cases for escaping modes.
Diffstat (limited to 'lib/plugins/authplain/auth.php')
-rw-r--r-- | lib/plugins/authplain/auth.php | 33 |
1 files changed, 28 insertions, 5 deletions
diff --git a/lib/plugins/authplain/auth.php b/lib/plugins/authplain/auth.php index 8c4ce0dd9..e53f56667 100644 --- a/lib/plugins/authplain/auth.php +++ b/lib/plugins/authplain/auth.php @@ -84,6 +84,27 @@ class auth_plugin_authplain extends DokuWiki_Auth_Plugin { } /** + * Creates a string suitable for saving as a line + * in the file database + * (delimiters escaped, etc.) + * + * @param string $user + * @param string $pass + * @param string $name + * @param string $mail + * @param array $grps list of groups the user is in + * @return string + */ + protected function _createUserLine($user, $pass, $name, $mail, $grps) { + $groups = join(',', $grps); + $userline = array($user, $pass, $name, $mail, $groups); + $userline = str_replace('\\', '\\\\', $userline); // escape \ as \\ + $userline = str_replace(':', '\\:', $userline); // escape : as \: + $userline = join(':', $userline)."\n"; + return $userline; + } + + /** * Create a new User * * Returns false if the user already exists, null when an error @@ -115,8 +136,7 @@ class auth_plugin_authplain extends DokuWiki_Auth_Plugin { if(!is_array($grps)) $grps = array($conf['defaultgroup']); // prepare user line - $groups = join(',', $grps); - $userline = join(':', array($user, $pass, $name, $mail, $groups))."\n"; + $userline = $this->_createUserLine($user, $pass, $name, $mail, $grps); if(io_saveFile($config_cascade['plainauth.users']['default'], $userline, true)) { $this->users[$user] = compact('pass', 'name', 'mail', 'grps'); @@ -157,8 +177,7 @@ class auth_plugin_authplain extends DokuWiki_Auth_Plugin { $userinfo[$field] = $value; } - $groups = join(',', $userinfo['grps']); - $userline = join(':', array($newuser, $userinfo['pass'], $userinfo['name'], $userinfo['mail'], $groups))."\n"; + $userline = $this->_createUserLine($newuser, $userinfo['pass'], $userinfo['name'], $userinfo['mail'], $userinfo['grps']); if(!$this->deleteUsers(array($user))) { msg('Unable to modify user data. Please inform the Wiki-Admin', -1); @@ -308,7 +327,11 @@ class auth_plugin_authplain extends DokuWiki_Auth_Plugin { $line = trim($line); if(empty($line)) continue; - $row = explode(":", $line, 5); + /* NB: preg_split can be deprecated/replaced with str_getcsv once dokuwiki is min php 5.3 */ + $row = preg_split('/(?<![^\\\\]\\\\)\:/', $line, 5); // allow for : escaped as \: + $row = str_replace('\\:', ':', $row); + $row = str_replace('\\\\', '\\', $row); + $groups = array_values(array_filter(explode(",", $row[4]))); $this->users[$row[0]]['pass'] = $row[1]; |