summaryrefslogtreecommitdiff
path: root/inc/auth.php
Commit message (Collapse)AuthorAge
* correctly handle usergroups arraySascha Klopp2015-07-18
|
* Fix scrutinizer issues with authPatrick Brown2015-05-07
|
* Report more meaningful errors when an auth backend fails. closes #1093Patrick Brown2015-05-06
|
* Remove error supression for file_exists()Andreas Gohr2015-01-07
| | | | | | | In an older version of PHP a file_exists() call would issue a warning when the file did not exist. This was fixed in later PHP releases. Since we require PHP 5.3 now, there's no need to supress any error here anymore. This might even give a minor performance boost.
* Merge remote-tracking branch 'origin/master' into scrutinizerissuesGerrit Uitslag2014-12-09
|\ | | | | | | | | | | | | | | | | Conflicts: inc/media.php inc/plugin.php inc/template.php lib/plugins/authplain/_test/escaping.test.php lib/plugins/syntax.php
| * do not use Accept-Encoding in browser UIDAndreas Gohr2014-10-06
| | | | | | | | | | | | | | | | | | Since Chrome 37, they send differen accept encodings for POST and GET requests which will break BrowserUID checks as reported in cosmocode/dokuwiki-plugin-oauth/issues/3 See https://code.google.com/p/chromium/issues/detail?id=410559 for official bug report at Google
* | PHPDocs and some improvementsGerrit Uitslag2014-10-02
| |
* | Many PHPDocs, some unused and dyn declared varsGerrit Uitslag2014-10-01
| | | | | | | | | | | | many PHPDocs some unused variables some dynamically declared variables declared
* | more scrutinizer issue improvementsGerrit Uitslag2014-09-29
|/
* Merge pull request #868 from splitbrain/authcleanAndreas Gohr2014-09-27
|\ | | | | clean user credentials from control chars
| * do not allow empty passwordsAndreas Gohr2014-09-26
| | | | | | | | | | When a username but no password is submitted, the login is denied right away instead of relying on the backend to refuse the login.
| * clean user credentials from control charsAndreas Gohr2014-09-23
| | | | | | | | | | | | This is to prevent zero byte attacks on external auth systems as described in http://www.freelists.org/post/dokuwiki/Fwd-Dokuwiki-maybe-security-issue-Null-byte-poisoning-in-LDAP-authentication
* | Merge remote-tracking branch 'origin/auth_getUserData_improvements'Andreas Gohr2014-09-26
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * origin/auth_getUserData_improvements: KISS - remove class constants for REQUIRE_GROUPS & IGNORE_GROUPS and replace with boolean values use $requireGroups constants in auth classes; comments; code improvements fix comment errors, sp. & grammar code styling - add missing braces Allow user info to be retrieved without groups Restore correct public interface of getUserData() for authldap plugin Conflicts: inc/common.php
| * | KISS - remove class constants for REQUIRE_GROUPS & IGNORE_GROUPS and replace ↵Christopher Smith2014-05-04
| | | | | | | | | | | | with boolean values
| * | Allow user info to be retrieved without groupsChristopher Smith2014-03-12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Some parts of dokuwiki (e.g. recent changes, old revisions) can requests lots of user info (to provide editor names) without requiring any group information. This change also implements caching of user info by authmysql & authpgsql plugins to avoid repeated querying of the DB to retrieve the same user information.
* | | Added @ALL handeling in auth_isMemberJurgen Hart2014-07-30
| |/ |/|
* | fix AUTH_USER_CHANGE event in profile updatesAndreas Gohr2014-07-26
|/ | | | | the triggered event did not allow event handlers to change the passed data
* amend $_SERVER to $INPUT->serverChristopher Smith2014-03-06
|
* use isset() + ?: or error suppression where value may not be setChristopher Smith2014-03-05
|
* removed pre PHP 5.2 code wrt setcookie and session settingGerrit Uitslag2014-03-04
| | | | - moved cookiedir determination in the if-statement
* PHPDocs auth.phpGerrit Uitslag2014-02-20
|
* AUTH_ACL_CHECK event around ACL checkingAndreas Gohr2014-01-05
| | | | | allows to modify ACL results in the AFTER event or to implement a completely different ACL mechanism in the BEFORE event.
* replace \s, \S with [ \t], [^ \t] in regexs used with aclsChristopher Smith2013-10-21
|
* replace boolean conditional checks on possibly uninitialized vars with ↵Christopher Smith2013-10-16
| | | | \!empty/empty/isset as appropriate
* update for deprecated '/e' flag in preg_replace (php 5.5)Christopher Smith2013-10-16
|
* Fix CodeSniffer whitespace violoationsMatt Perry2013-09-10
| | | | | Removed extraneous whitespace to eliminate errors reported by the Squiz.WhiteSpace.SuperfluousWhitespace sniff.
* Fix CodeSniffer violationsMatt Perry2013-08-22
| | | | Change indentation to ensure code confirms to CodeSniffer rules.
* Fix CodeSniffer violationsMatt Perry2013-08-20
| | | | | Remove whitespace from end of lines to reduce the number of CodeSniffer violations.
* Fix a couple of bugs in ACL substitution mechanismChristopher Smith2013-08-03
| | | | | | | | | - %GROUP% & %USER% can now both be used in the same rule, e.g. %GROUP%:%USER% 2 - rules with tokens will be skipped when the user is not logged in previously %USER% was attempted
* Merge branch 'FS#2751' of git://github.com/splitbrain/dokuwiki into ↵Andreas Gohr2013-08-02
|\ | | | | | | | | | | | | | | | | | | pull-request-245 * 'FS#2751' of git://github.com/splitbrain/dokuwiki: coding corrections. correct type hint, remove unused variable assignment de/de-informal: localization updates (delete user function) unit tests for self deleting of user accounts FS#2751 - self deletion of user account
| * coding corrections. correct type hint, remove unused variable assignmentChristopher Smith2013-08-02
| |
| * FS#2751 - self deletion of user accountChristopher Smith2013-07-31
| |
* | Merge pull request #246 from splitbrain/profileform_improvementsAndreas Gohr2013-07-31
|\ \ | | | | | | HTML5isation of some forms
| * | Change error message shown for incorrect current password on update profile ↵Christopher Smith2013-07-31
| |/ | | | | | | | | | | | | | | form. The current message confusingly mentions bad 'username' when username is not involved. The new message is the same as that introduced for an incorrect current password on the self delete profile form (FS#2751)
* | auth_en/decrypt: Add explanation and more efficient decryptionMichael Hamann2013-07-31
| | | | | | | | | | | | | | Added an explanation that what we do is like normal CBC but that we additionally encrypt the IV which is actually suggested by the NIST for non-random (but unique) IVs. In the decryption process it's not necessary to decrypt the IV, this should save some time.
* | auth_random: remove exception comment as there is no exceptionMichael Hamann2013-07-31
| |
* | Add AES from phpseclib and use it for cookie encryptionMichael Hamann2013-07-30
| | | | | | | | | | This replaces the deprecated and broken Blowfish implementation that has previously been used and should provide a lot more security.
* | Use a new, truly random secret for cookie encryptionMichael Hamann2013-07-30
| |
* | Add truly random numbers and use them in places where randomness mattersMichael Hamann2013-07-30
|/
* Fix and add type declarations for the auth systemMichael Hamann2013-07-30
|
* removed tabsAndreas Gohr2013-06-16
|
* Increased strength of auto generated passwords a bitAndreas Gohr2013-06-14
| | | | | If you want better random initialization and more control over the password strength install the passpolicy plugin.
* fixed syntax fuckupAndreas Gohr2013-06-09
|
* AUTH_PASSWORD_GENERATE event addedAndreas Gohr2013-06-09
| | | | | This is needed to replace the password generator by a plugin implementation. Related to PR #166 and FS#2147
* make password reset token completely randomAndreas Gohr2013-05-31
| | | | | | No need for HMAC here because there's no length attack vector here. We only care for the existance of the file and each reset request is completely (random) independent from each other.
* use HMAC in password reset token FS#2794Andreas Gohr2013-05-31
|
* fixed wrong use of quotes in authtype warning messageAnika Henke2013-05-27
|
* Fix wrong config key in deprecated auth messageKlap-in2013-05-15
|
* restrict 'authtype deprecated' alert to superusers onlyChristopher Smith2013-04-01
|
* backward compatibility for old authtype settingsGuy Brand2013-03-17
|
generated by cgit v1.2.3 (git 2.25.1) at 2024-05-20 22:19:54 +0000