summaryrefslogtreecommitdiff
path: root/inc/auth.php
Commit message (Collapse)AuthorAge
...
* | Added support for Wordpress' password hashing FS#2134Andreas Gohr2011-01-15
| |
* | Merge branch 'master' of github.com:splitbrain/dokuwikiAdrian Lang2011-01-14
|\ \
| * | Fix handling of case in auth_isMember; add and fix test casesAdrian Lang2010-12-21
| |/
| * preg_quote namespaces in auth_aclcheckMichael Hamann2010-12-11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Like ids namespaces are now preg_quoted in the acl check (and therefore the escaping of "*" has been removed). When plugins call the ACL check function with strange ids the regex fails otherwise (in the case of the include plugin errors like "Warning: preg_grep() [function.preg-grep]: Compilation failed: missing terminating ] for character class at offset 47" have been reported by two users). I've run the acl tests after this change and everything passes so this shouldn't break anything but please test this especially with protected wikis as this change modifies the code that handles namespace permissions. Furthermore permissions for a namespace foobar are no longer applied to namespaces with names like foo.ar, I hope nobody has used that "feature". When you are using per-user namespaces, user registration is open and either write or read protection for these namespaces is important to you this is a security fix for you: When someone wants to get access to the namespace of a user "foo.bar" he can register as "fooxbar" (where "x" is an arbitrary character) and will have access to the user namespace of the user "foo.bar" as when a page in "foo.bar" is checked it will match the rule for "fooxbar".
| * added auth_isMember()Andreas Gohr2010-12-08
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This function abstracts checking a given user and her groups against a given member list (as used in the superuser and manager options). It is also used in auth_isManager() and auth_isAdmin(), unlike the previous function, this one skips the nameencode step as it should be unnessary here (all input is given decoded). The test cases where extended by some non-ID user and group names. People with non-plain auth backends should check that their administrator and manager setups still work as expected
* | tmpAdrian Lang2010-12-08
|/
* Remove enc=utf-8 in VIM modeline as it is not allowed in VIM 7.3Michael Hamann2010-11-29
| | | | | | As of VIM 7.3 it is no longer possible to specify the encoding in the modeline. This gives an error message whenever such a file is opened, thus this commit removes the enc setting from the modeline.
* a more correct fix for FS#2039Andreas Gohr2010-10-02
|
* properly encode user wildcard in ACLs FS#2039Andreas Gohr2010-10-02
|
* Do not allow empty strings as superuser or manager FS#2009Andreas Gohr2010-08-27
|
* Use config_cascade for ACLs and plain auth users FS#1677Andreas Gohr2010-06-27
|
* fixed wildcard handling in ACL manager FS#1955Andreas Gohr2010-06-26
| | | | | This patch also removes legacy support for @USER@. Only %USER% is valid now.
* new auth capability 'logout'Andreas Gohr2010-06-22
| | | | | | | | | | | | | | | | | | | | This patch implements what Adrian's patch "Hide logout button if auth backend cannot logout" intended to do. The 'logoff' capability was used to decide if a special method called $auth->logOff() should be called when the user logs out, not if the backend supports logouts at all. This was a superflous capability since an empty logOff() method is implemented in the base class anyway - it doesn't hurt to always call the method. The 'logoff' capability is now deprecated. Backends who want to do actions on logout simply need to overwrite logOff(). A new capability 'logout' was added which defaults to true. Backends that can't logoff the user (eg. because they use some automatic login/logoff mechanism) can set this to false. Probably makes sense to add a 'login' capability as well...
* Avoid broken ACL check if Auth Backend failsDominik Eckelmann2010-04-28
|
* Fixed selffail.Adrian Lang2010-03-24
|
* No warning for an undefined variableAdrian Lang2010-03-23
|
* first attempt to centralize all include loadingAndreas Gohr2010-01-31
| | | | | | | | Classes are loaded throug PHP5's class autoloader, all other includes are just loaded by default. This skips a lot of require_once calls. Parser and Plugin stuff isn't handled by the class loader yet.
* Provide AFTER event for AUTH_LOGIN_CHECKAdrian Lang2010-01-19
| | | | | | Ignore-this: 804d0837b9a04e4f82e6b54765f453cf darcs-hash:20091215095430-e4919-19c61854c27fdade90caeed035445ee3396b0095.gz
* correctly check auth capabilities on update profile FS#1329Andy Webber2009-11-28
| | | | | | Ignore-this: fb853b40911201a41c237d69d91f7d24 darcs-hash:20091128111547-6ad63-0432d3b190946b2b8f7c292119e034cdcdae3a00.gz
* Check whether $auth is setAdrian Lang2009-11-24
| | | | darcs-hash:20091124152419-e4919-b4d55158c15d637a453b082eae6a80a828818934.gz
* Added isCaseSensitive() to auth backends FS#1657Andreas Gohr2009-11-15
| | | | | | Ignore-this: 3591e5a36126c72bd9b931e4aa832da8 darcs-hash:20091115141725-7ad00-7c2fc662d1999731660673d05299c4f357b797b3.gz
* more work on user and group cleaningAndreas Gohr2009-11-14
| | | | | | Ignore-this: b824c2941d3631bdf83350e325606d3e darcs-hash:20091114123517-7ad00-d32833a88cb5f654a8874542d4d59f1f401d4453.gz
* Added group and user sanitationAndreas Gohr2009-11-13
| | | | | | Ignore-this: 26392125523d2c822580346074330ebe darcs-hash:20091113102249-7ad00-4cede040a940d739bd34d548e12956e8d8609cfa.gz
* Emit less E_NOTICEs and E_STRICTsAdrian Lang2009-11-04
| | | | | | | | | | | | | Changes of behaviour are: * Allow the user name, title & description \e2\80\9c0\e2\80\9d * Default to Port 443 if using HTTPS * Set $INFO['isadmin'] and $INFO['ismanager'] to \e2\80\9cfalse\e2\80\9d even if no user is logged in * Do not pass empty fragment field in the event data for event ACTION_SHOW_REDIRECT * Handle chunked encoding in HTTPClient darcs-hash:20091104100115-e4919-5cf6397d4a457e3f98a8ca49fbdab03f2147721d.gz
* Remove (unset) action param from AUTH_LOGIN_CHECK data, init $ACL before ↵Adrian Lang2009-10-23
| | | | | | firing the event darcs-hash:20091023085601-e4919-5c800a07bcf70c34720a39e7bca9a1250b973b32.gz
* Coding Standard CleanupAndreas Gohr2009-10-20
| | | | | | Ignore-this: 259cb5773c3144c6c706d87298dcf674 darcs-hash:20091020212338-7ad00-6bf1c5c403491f136a1c02af5ecd9f84d7227107.gz
* Support for kmd5 passcrypt methodAndreas Gohr2009-10-15
| | | | | | | | | Ignore-this: c809bd207504f78e84685612b0a668a7 This is a MD5 based hashing method used in the Unclassified NewsBoard forum software (which is used for DokuWiki's supprt forum) darcs-hash:20091015184330-7ad00-38680848952bdb46052dcf3597fa5e91f892ca51.gz
* encode parts in cookie seperatly. might fix FS#1437Andreas Gohr2009-10-04
| | | | | | Ignore-this: c9b92b33e2a3a3418fd0730bf4971b7e darcs-hash:20091004135409-7ad00-51c902a832fef7486a9afca9e9481b172a6894e1.gz
* auth_(quick)aclcheck needs resolved and cleaned idmichael2009-10-04
| | | | | | | | | Ignore-this: 3e0ad635a6f8536ed05871704a29e1e2 This patch adds a small notice to the comment that the id given to auth_(quick)aclcheck needs to be resolved and cleaned. darcs-hash:20091004093316-074e0-a4095962c52c16918d617d2ffecc783ba8fd0202.gz
* Change expensive uses of split to the much faster explode.Tom N Harris2009-05-28
| | | | darcs-hash:20090528215438-6942e-bf1b875e689ade6bd1a17e3d812ce16bf35c84a6.gz
* Make more use of clientIP() FS#1668Andreas Gohr2009-04-10
| | | | | | Ignore-this: 13616da575fbe56064b2aa3d1d803bf5 darcs-hash:20090410181613-7ad00-b74c82c1f9296a2cb0d00b03316141b19821bda1.gz
* pass correct event data in AUTH_LOGIN_CHECKAndreas Gohr2009-04-07
| | | | | | Ignore-this: ad04520c987ab71b4dcec5e5b38fae8a darcs-hash:20090407172723-7ad00-81d06920a678c7aab73778e2ce4f8f1f44faf314.gz
* Action Event wrappers around HTTP requests and authentication checksRobin Gareus2009-03-12
| | | | | | Ignore-this: 9ffd0327c318a633e33a60e0a8ecf7f5 darcs-hash:20090312224454-b7b7f-12b7fa78c0b638c1795f6d5e1b1c1aa2cbab64d4.gz
* do not close session in auth_logoff FS#1519Andreas Gohr2009-02-10
| | | | | | | | | | | | | | | Ignore-this: b30b94c67baa8a8916dd216424e9473c As auth_logoff is called very early for all not-logged in users it prevented writing the breadcrumbs and might have broken some other things relying on a open session at beginning of the script. auth_logoff now makes sure the session is open but will not close it. Additionally the session is now explicitly closed before a redirect. darcs-hash:20090210100257-7ad00-50470f18edb9fdbeb555fbf5d8a470a3b077915d.gz
* fixed logoff cookie problemAndreas Gohr2009-01-30
| | | | | | Ignore-this: 53d4440e4bffdcf66330ffc6b2b3372a darcs-hash:20090130090624-7ad00-a6f6da5b1d42ac48cf4906e40addbd15e995125c.gz
* keep breadcrumbs for anonymous users FS#1519Andreas Gohr2009-01-16
| | | | darcs-hash:20090116145345-7ad00-153c9e6e0a83d937c48967ed5bc90578a5f49a15.gz
* fixed corrupt if statement introduced by earlier patchAndreas Gohr2009-01-14
| | | | darcs-hash:20090114175244-7ad00-22fe37641598c13f13266bf0b50c3b93fe912344.gz
* make HTTP SSO possible for IIS or rewritingAndreas Gohr2009-01-14
| | | | | | | | | | | | | | | DokuWiki silently attemps to resuse received HTTP auth credentials for user logins. Unfortunately these are only passed to PHP when using mod_php. IIS provides a HTTP_AUTHORIZATION header which now will be decoded and used as well. This header can also be faked via mod_rewrite: <IfModule mod_rewrite.c> RewriteEngine on RewriteRule .* - [E darcs-hash:20090114153601-7ad00-6c75e8568eda6753834981642eed638b9eb01694.gz
* ACL user wildcard changed to %USER% FS#1504 :!:Andreas Gohr2008-12-16
| | | | | | | | | | | | | | | | | | DokuWiki supports a wildcard which gets replaced with the currently loggedin user in its ACL configuration file. This patch changes the wildcard from @USER@ to %USER% (case sensitive) and also makes sure the ACL Manager does not replace the wildcard when displaying the currently set rules. The change was needed for better compatibility with the User Manager without complicating the code. The old @USER@ wildcard is still supported, but changing an ACL rule using it, through the ACL manager will fail. It is recommended to update ACL rules using the @USER@ wildchar to use the new %USER% one instead. darcs-hash:20081216171126-7ad00-94ce0c2afa411abc936f13572efd0e31941901ee.gz
* removed some illogical path setupsAndreas Gohr2008-12-13
| | | | darcs-hash:20081213090400-7ad00-4e21cd75978bb07513f32f5d750658e8d777c59e.gz
* show update profile dialog only when logged inMichael Klier2008-11-17
| | | | darcs-hash:20081117154409-23886-d0ad833c6bcf96bcc54f6998397de90ff07b7686.gz
* fixed missing global scope in auth_setCookie() FS#1530Oliver Geisen2008-11-08
| | | | darcs-hash:20081108225035-6837b-a662b0728205e64f5eaf7bd0003748a5be8a6b2f.gz
* Ensure 'smd5' password hashing method is only triggered when availableChris Smith2008-10-13
| | | | darcs-hash:20081013123417-f07c6-eaa5586edad17a971f4daf38afac77c6946539f0.gz
* remove unused/redundant isvalidemail() functionChris Smith2008-10-13
| | | | darcs-hash:20081013123311-f07c6-8dc34c8fb9a170fae412a6c37928e601c1728a18.gz
* Fix for FS#1050Chris Smith2008-10-13
| | | | | | Update cookie and session with new details after an "update profile" action darcs-hash:20081013122958-f07c6-244b949b074ac73711c61833f1fa663e55da19c7.gz
* FS#564 FS#1270 new option to disable the rememberme checkboxMichael Klier2008-10-12
| | | | darcs-hash:20081012144253-23886-c904f82c559c3ad5477bf921e93cb439a212134d.gz
* Fail silently if trying to login through supplied HTTP credentials (FS#1228)Gina Haeussge2008-10-12
| | | | darcs-hash:20081012131042-2b4f5-029f4f0ffa6c89e23653584c8bb41db78834cc73.gz
* Empty breadcrumbs on logout (see FS#979)Guy Brand2008-10-11
| | | | darcs-hash:20081011161458-19e2d-97001154886654be84d70b1b140743b124a1c763.gz
* reopen the session in auth_logoff FS#1484Andreas Gohr2008-10-11
| | | | | | | To clean data from the session correctly on logout, the session needs to be reopened. darcs-hash:20081011092157-7ad00-e5cc905b6e04b13fe667690c0e6aad68524254f1.gz
* more cookie security FS#1490Andreas Gohr2008-09-13
| | | | | | | | | | | | This patch adds the httponly option to the PHP session cookies and DokuWiki's auth cookie when supported by the PHP version. It also adds a new config option 'securecookie' which is enabled by default. It makes sure the browser will not sent a cookie set via HTTPS over a non-secured connection. This option has to be disabled for wikis that only protect the login with SSL but not the whole wiki. darcs-hash:20080912224922-7ad00-d5275147ba9d17a9f6defa8a51ca720da74ba8a0.gz
generated by cgit v1.2.3 (git 2.25.1) at 2025-05-10 11:53:54 +0000