From 191bb90af90d4b063435ee55d67082e7453ed1fb Mon Sep 17 00:00:00 2001
From: Andreas Gohr <andi@splitbrain.org>
Date: Fri, 13 Nov 2009 11:22:49 +0100
Subject: Added group and user sanitation

Ignore-this: 26392125523d2c822580346074330ebe

darcs-hash:20091113102249-7ad00-4cede040a940d739bd34d548e12956e8d8609cfa.gz
---
 inc/auth/basic.class.php | 42 +++++++++++++++++++++++++++++++++++++++++-
 inc/auth/plain.class.php | 16 ++++++++++++++++
 2 files changed, 57 insertions(+), 1 deletion(-)

(limited to 'inc/auth')

diff --git a/inc/auth/basic.class.php b/inc/auth/basic.class.php
index 5af70a47a..a1f77dea5 100644
--- a/inc/auth/basic.class.php
+++ b/inc/auth/basic.class.php
@@ -128,7 +128,7 @@ class auth_basic {
    * only be needed when trustExternal is implemented.
    *
    * @see     auth_logoff()
-   * @author  Andreas Gohr
+   * @author  Andreas Gohr <andi@splitbrain.org>
    */
   function logOff(){
   }
@@ -322,6 +322,46 @@ class auth_basic {
     return array();
   }
 
+  /**
+   * Sanitize a given username [OPTIONAL]
+   *
+   * This function is applied to any user name that is given to
+   * the backend and should also be applied to any user name within
+   * the backend before returning it somewhere.
+   *
+   * This should be used to enforce username restrictions. Eg. when
+   * the backend is case insensitive all usernames should be lowercased
+   * here.
+   *
+   * @author Andreas Gohr <andi@splitbrain.org>
+   * @param string $user - username
+   * @param string - the cleaned username
+   */
+  function cleanUser($user){
+    return $user;
+  }
+
+  /**
+   * Sanitize a given groupname [OPTIONAL]
+   *
+   * This function is applied to any groupname that is given to
+   * the backend and should also be applied to any groupname within
+   * the backend before returning it somewhere.
+   *
+   * This should be used to enforce groupname restrictions. Eg. when
+   * the backend is case insensitive all groupames should be lowercased
+   * here.
+   *
+   * Groupnames are to be passed without a leading '@' here.
+   *
+   * @author Andreas Gohr <andi@splitbrain.org>
+   * @param string $group - groupname
+   * @param string - the cleaned groupname
+   */
+  function cleanGroup($group){
+    return $group;
+  }
+
 
   /**
    * Check Session Cache validity [implement only where required/possible]
diff --git a/inc/auth/plain.class.php b/inc/auth/plain.class.php
index 68976287a..0ff18d58a 100644
--- a/inc/auth/plain.class.php
+++ b/inc/auth/plain.class.php
@@ -260,6 +260,22 @@ class auth_plain extends auth_basic {
       return $out;
     }
 
+    /**
+     * Only valid pageid's (no namespaces) for usernames
+     */
+    function cleanUser($user){
+        global $conf;
+        return cleanID(str_replace(':',$conf['sepchar'],$user));
+    }
+
+    /**
+     * Only valid pageid's (no namespaces) for groupnames
+     */
+    function cleanGroup($user){
+        global $conf;
+        return cleanID(str_replace(':',$conf['sepchar'],$group));
+    }
+
     /**
      * Load all user data
      *
-- 
cgit v1.2.3