summaryrefslogtreecommitdiff
path: root/inc/auth.php
Commit message (Collapse)AuthorAge
* do not use Accept-Encoding in browser UIDAndreas Gohr2014-10-06
| | | | | | | | | Since Chrome 37, they send differen accept encodings for POST and GET requests which will break BrowserUID checks as reported in cosmocode/dokuwiki-plugin-oauth/issues/3 See https://code.google.com/p/chromium/issues/detail?id=410559 for official bug report at Google
* Merge pull request #868 from splitbrain/authcleanAndreas Gohr2014-09-27
|\ | | | | clean user credentials from control chars
| * do not allow empty passwordsAndreas Gohr2014-09-26
| | | | | | | | | | When a username but no password is submitted, the login is denied right away instead of relying on the backend to refuse the login.
| * clean user credentials from control charsAndreas Gohr2014-09-23
| | | | | | | | | | | | This is to prevent zero byte attacks on external auth systems as described in http://www.freelists.org/post/dokuwiki/Fwd-Dokuwiki-maybe-security-issue-Null-byte-poisoning-in-LDAP-authentication
* | Merge remote-tracking branch 'origin/auth_getUserData_improvements'Andreas Gohr2014-09-26
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * origin/auth_getUserData_improvements: KISS - remove class constants for REQUIRE_GROUPS & IGNORE_GROUPS and replace with boolean values use $requireGroups constants in auth classes; comments; code improvements fix comment errors, sp. & grammar code styling - add missing braces Allow user info to be retrieved without groups Restore correct public interface of getUserData() for authldap plugin Conflicts: inc/common.php
| * | KISS - remove class constants for REQUIRE_GROUPS & IGNORE_GROUPS and replace ↵Christopher Smith2014-05-04
| | | | | | | | | | | | with boolean values
| * | Allow user info to be retrieved without groupsChristopher Smith2014-03-12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Some parts of dokuwiki (e.g. recent changes, old revisions) can requests lots of user info (to provide editor names) without requiring any group information. This change also implements caching of user info by authmysql & authpgsql plugins to avoid repeated querying of the DB to retrieve the same user information.
* | | Added @ALL handeling in auth_isMemberJurgen Hart2014-07-30
| |/ |/|
* | fix AUTH_USER_CHANGE event in profile updatesAndreas Gohr2014-07-26
|/ | | | | the triggered event did not allow event handlers to change the passed data
* amend $_SERVER to $INPUT->serverChristopher Smith2014-03-06
|
* use isset() + ?: or error suppression where value may not be setChristopher Smith2014-03-05
|
* removed pre PHP 5.2 code wrt setcookie and session settingGerrit Uitslag2014-03-04
| | | | - moved cookiedir determination in the if-statement
* PHPDocs auth.phpGerrit Uitslag2014-02-20
|
* AUTH_ACL_CHECK event around ACL checkingAndreas Gohr2014-01-05
| | | | | allows to modify ACL results in the AFTER event or to implement a completely different ACL mechanism in the BEFORE event.
* replace \s, \S with [ \t], [^ \t] in regexs used with aclsChristopher Smith2013-10-21
|
* replace boolean conditional checks on possibly uninitialized vars with ↵Christopher Smith2013-10-16
| | | | \!empty/empty/isset as appropriate
* update for deprecated '/e' flag in preg_replace (php 5.5)Christopher Smith2013-10-16
|
* Fix CodeSniffer whitespace violoationsMatt Perry2013-09-10
| | | | | Removed extraneous whitespace to eliminate errors reported by the Squiz.WhiteSpace.SuperfluousWhitespace sniff.
* Fix CodeSniffer violationsMatt Perry2013-08-22
| | | | Change indentation to ensure code confirms to CodeSniffer rules.
* Fix CodeSniffer violationsMatt Perry2013-08-20
| | | | | Remove whitespace from end of lines to reduce the number of CodeSniffer violations.
* Fix a couple of bugs in ACL substitution mechanismChristopher Smith2013-08-03
| | | | | | | | | - %GROUP% & %USER% can now both be used in the same rule, e.g. %GROUP%:%USER% 2 - rules with tokens will be skipped when the user is not logged in previously %USER% was attempted
* Merge branch 'FS#2751' of git://github.com/splitbrain/dokuwiki into ↵Andreas Gohr2013-08-02
|\ | | | | | | | | | | | | | | | | | | pull-request-245 * 'FS#2751' of git://github.com/splitbrain/dokuwiki: coding corrections. correct type hint, remove unused variable assignment de/de-informal: localization updates (delete user function) unit tests for self deleting of user accounts FS#2751 - self deletion of user account
| * coding corrections. correct type hint, remove unused variable assignmentChristopher Smith2013-08-02
| |
| * FS#2751 - self deletion of user accountChristopher Smith2013-07-31
| |
* | Merge pull request #246 from splitbrain/profileform_improvementsAndreas Gohr2013-07-31
|\ \ | | | | | | HTML5isation of some forms
| * | Change error message shown for incorrect current password on update profile ↵Christopher Smith2013-07-31
| |/ | | | | | | | | | | | | | | form. The current message confusingly mentions bad 'username' when username is not involved. The new message is the same as that introduced for an incorrect current password on the self delete profile form (FS#2751)
* | auth_en/decrypt: Add explanation and more efficient decryptionMichael Hamann2013-07-31
| | | | | | | | | | | | | | Added an explanation that what we do is like normal CBC but that we additionally encrypt the IV which is actually suggested by the NIST for non-random (but unique) IVs. In the decryption process it's not necessary to decrypt the IV, this should save some time.
* | auth_random: remove exception comment as there is no exceptionMichael Hamann2013-07-31
| |
* | Add AES from phpseclib and use it for cookie encryptionMichael Hamann2013-07-30
| | | | | | | | | | This replaces the deprecated and broken Blowfish implementation that has previously been used and should provide a lot more security.
* | Use a new, truly random secret for cookie encryptionMichael Hamann2013-07-30
| |
* | Add truly random numbers and use them in places where randomness mattersMichael Hamann2013-07-30
|/
* Fix and add type declarations for the auth systemMichael Hamann2013-07-30
|
* removed tabsAndreas Gohr2013-06-16
|
* Increased strength of auto generated passwords a bitAndreas Gohr2013-06-14
| | | | | If you want better random initialization and more control over the password strength install the passpolicy plugin.
* fixed syntax fuckupAndreas Gohr2013-06-09
|
* AUTH_PASSWORD_GENERATE event addedAndreas Gohr2013-06-09
| | | | | This is needed to replace the password generator by a plugin implementation. Related to PR #166 and FS#2147
* make password reset token completely randomAndreas Gohr2013-05-31
| | | | | | No need for HMAC here because there's no length attack vector here. We only care for the existance of the file and each reset request is completely (random) independent from each other.
* use HMAC in password reset token FS#2794Andreas Gohr2013-05-31
|
* fixed wrong use of quotes in authtype warning messageAnika Henke2013-05-27
|
* Fix wrong config key in deprecated auth messageKlap-in2013-05-15
|
* restrict 'authtype deprecated' alert to superusers onlyChristopher Smith2013-04-01
|
* backward compatibility for old authtype settingsGuy Brand2013-03-17
|
* Fix remaining missing $INPUT uses FS#2577Michael Hamann2013-02-20
| | | | | | This adds $INPUT in all places where it was still missing and available. $INPUT is now also used in places where using $_REQUEST/... was okay in order to make the code consistent.
* Fix handling of failed authentication loadingMichael Hamann2013-02-20
| | | | | | | | | In the case of a failed authentication initialization, the authentication setup was simply continued with an unset $auth object. This restores the previous behavior (before merging #141) of simply returning after unsetting $auth. Furthermore this re-introduces the check if $auth is set before checking $auth and removes a useless check if $auth is true (could never be false).
* fixed auth_browseruid on IE9Dominik Eckelmann2013-02-20
| | | | IE9 send different HTTP_ACCEPT_LANGUAGE header on ajax request. This causes different results from auth_browseruid. This patch removes the HTTP_ACCEPT_LANGUAGE from the browser id calculation.
* introduced http_status() for sending HTTP status code FS#1698Andreas Gohr2013-02-16
| | | | | | | It seems, some servers require a special Status: header for sending the HTTP status code from PHP (F)CGI to the server. This patch introduces a new function (adopted from CodeIgniter) for simplifying the status handling.
* Merge branch 'master' into futureAndreas Gohr2013-02-03
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * master: (162 commits) fixed revision JS for images upgraded SimplePie to 1.3.1 FS#2708 removed obsolete browser plugin (migrate does it) adjust spacing to match standard 1.4em grid added comment on use of whitelist vs blacklist Updated idfilter() function for IIS use var and remove suggestions when needed Use variable for maximum number of suggestions for quicksearch. And hide suggestions when search field is emptied, or when no suggestion are found. added 'home' class to first link in hierarchical breadcrumbs reduced required max width to go into tablet mode re-added linear gradients for firefox added missing styling for disabled form elements (FS#2705) fixed acronyms in italics (FS#2684) improved print styles (includes fixes for FS#2645 and FS#2707) basic styles improvements Greek language update Use list in acl help text, for more structure Galician language update touch the config on save, even if no changes were made unwind the width narrowing commit put some whitespace between form submit button and fieldset bottom border ... Conflicts: lib/plugins/config/admin.php lib/plugins/config/settings/config.class.php
| * Merge branch 'subscription' Pull Request #125Andreas Gohr2013-01-26
| |\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * subscription: (25 commits) link directly to subscription management in mails only use mailfromnobody for bulk mails added missing context for list mails readded mailfromnobody to subscription sending correctly escape diffs in HTML mails fixed lists in HTML mails simplified subscription->add() code a bit comment adjusted removed unused vars removed data parameter in subscription_handle_post() fixed tests some reformatting added compatibility function moved registration notification to subscription class fixed merge error in inc/auth.php consolidate more notification code in subscription class minor cleanup initialize new subscriptions with current time fixed subscription management correctly check if subscriptions are enabled ...
| | * moved registration notification to subscription classAndreas Gohr2012-11-30
| | |
| | * fixed merge error in inc/auth.phpAndreas Gohr2012-11-30
| | | | | | | | | | | | merged the wrong change here
generated by cgit v1.2.3 (git 2.25.1) at 2025-06-08 06:47:37 +0000