Enano CMS (1.1.x): comparison install.php

equal deleted inserted replaced

-:c83ff194977a
+:723bb7acf914
 require('includes/wikiformat.php');
 require('includes/constants.php');
 require('includes/rijndael.php');
 require('includes/functions.php');
+strip_magic_quotes_gpc();
 //die('Key size: ' . AES_BITS . '<br />Block size: ' . AES_BLOCKSIZE);
 if(!function_exists('wikiFormat'))
 {
 <script type="text/javascript">
 function verify()
 {
 var frm = document.forms.siteinfo;
 ret = true;
-if(frm.sitename.value.match(/^([A-z0-9 ]+)$/g) && frm.sitename.value != 'Enano')
+if(frm.sitename.value.match(/^(.+)$/g) && frm.sitename.value != 'Enano')
 {
 document.getElementById('s_name').src='images/good.gif';
 }
 else
 {
 </script>
 <form name="siteinfo" action="install.php?mode=login" method="post">
 <?php
 $k = array_keys($_POST);
 for($i=0;$i<sizeof($_POST);$i++) {
-echo '<input type="hidden" name="'.$k[$i].'" value="'.$_POST[$k[$i]].'" />'."\n";
+echo '<input type="hidden" name="'.htmlspecialchars($k[$i]).'" value="'.htmlspecialchars($_POST[$k[$i]]).'" />'."\n";
 }
 ?>
 <p>The next step is to enter some information about your website. You can always change this information later, using the administration panel.</p>
 <table border="0">
 <tr><td><b>Website name</b><br />The display name of your website. Allowed characters are uppercase and lowercase letters, numerals, and spaces. This must not be blank or "Enano".</td><td><input onkeyup="verify();" name="sitename" type="text" size="30" /></td><td><img id="s_name" alt="Good/bad icon" src="images/bad.gif" /></td></tr>
 </script>
 <form name="login" action="install.php?mode=confirm" method="post" onsubmit="runEncryption();">
 <?php
 $k = array_keys($_POST);
 for($i=0;$i<sizeof($_POST);$i++) {
-echo '<input type="hidden" name="'.$k[$i].'" value="'.$_POST[$k[$i]].'" />'."\n";
+echo '<input type="hidden" name="'.htmlspecialchars($k[$i]).'" value="'.htmlspecialchars($_POST[$k[$i]]).'" />'."\n";
 }
 ?>
 <p>Next, enter your desired username and password. The account you create here will be used to administer your site.</p>
 <table border="0">
 <tr><td><b>Administration username</b><br />The administration username you will use to log into your site.</td><td><input onkeyup="verify();" name="admin_user" type="text" size="30" /></td><td><img id="s_user" alt="Good/bad icon" src="images/bad.gif" /></td></tr>
 <input type="hidden" name="crypt_key" value="<?php echo $cryptkey; ?>" />
 <input type="hidden" name="crypt_data" value="" />
 </form>
 <script type="text/javascript">
 // <![CDATA[
-disableJSONExts();
-str = '';
-for(i=0;i<keySizeInBits/4;i++) str+='0';
-var key = hexToByteArray(str);
-var pt = hexToByteArray(str);
-var ct = rijndaelEncrypt(pt, key, "ECB");
-var ect = byteArrayToHex(ct);
-switch(keySizeInBits)
-{
-case 128:
-v = '66e94bd4ef8a2c3b884cfa59ca342b2e';
-break;
-case 192:
-v = 'aae06992acbf52a3e8f4a96ec9300bd7aae06992acbf52a3e8f4a96ec9300bd7';
-break;
-case 256:
-v = 'dc95c078a2408989ad48a21492842087dc95c078a2408989ad48a21492842087';
-break;
-}
-var testpassed = ( ect == v && md5_vm_test() );
-var frm = document.forms.login;
-if(testpassed)
-{
-frm.use_crypt.value = 'yes';
-var cryptkey = frm.crypt_key.value;
-frm.crypt_key.value = '';
-if(cryptkey != byteArrayToHex(hexToByteArray(cryptkey)))
-{
-alert('Byte array conversion SUCKS');
-testpassed = false;
-}
-cryptkey = hexToByteArray(cryptkey);
-if(!cryptkey || ( ( typeof cryptkey == 'string' || typeof cryptkey == 'object' ) ) && cryptkey.length != keySizeInBits / 8 )
-{
-frm._cont.disabled = true;
-len = ( typeof cryptkey == 'string' || typeof cryptkey == 'object' ) ? '\nLen: '+cryptkey.length : '';
-alert('The key is messed up\nType: '+typeof(cryptkey)+len);
-}
-}
 frm.admin_user.focus();
 function runEncryption()
 {
+str = '';
+for(i=0;i<keySizeInBits/4;i++) str+='0';
+var key = hexToByteArray(str);
+var pt = hexToByteArray(str);
+var ct = rijndaelEncrypt(pt, key, "ECB");
+var ect = byteArrayToHex(ct);
+switch(keySizeInBits)
+{
+case 128:
+v = '66e94bd4ef8a2c3b884cfa59ca342b2e';
+break;
+case 192:
+v = 'aae06992acbf52a3e8f4a96ec9300bd7aae06992acbf52a3e8f4a96ec9300bd7';
+break;
+case 256:
+v = 'dc95c078a2408989ad48a21492842087dc95c078a2408989ad48a21492842087';
+break;
+}
+var testpassed = ( ect == v && md5_vm_test() );
+var frm = document.forms.login;
+if(testpassed)
+{
+// alert('encryption self-test passed');
+frm.use_crypt.value = 'yes';
+var cryptkey = frm.crypt_key.value;
+frm.crypt_key.value = '';
+if(cryptkey != byteArrayToHex(hexToByteArray(cryptkey)))
+{
+alert('Byte array conversion SUCKS');
+testpassed = false;
+}
+cryptkey = hexToByteArray(cryptkey);
+if(!cryptkey || ( ( typeof cryptkey == 'string' || typeof cryptkey == 'object' ) ) && cryptkey.length != keySizeInBits / 8 )
+{
+frm._cont.disabled = true;
+len = ( typeof cryptkey == 'string' || typeof cryptkey == 'object' ) ? '\nLen: '+cryptkey.length : '';
+alert('The key is messed up\nType: '+typeof(cryptkey)+len);
+}
+}
+else
+{
+// alert('encryption self-test FAILED');
+}
 if(testpassed)
 {
 pass = frm.admin_pass.value;
 pass = stringToByteArray(pass);
 cryptstring = rijndaelEncrypt(pass, cryptkey, 'ECB');
 if(!cryptstring)
 {
 return false;
 }
 cryptstring = byteArrayToHex(cryptstring);
-document.getElementById('cryptdebug').innerHTML = '<pre>Data: '+cryptstring+'<br />Key:  '+byteArrayToHex(cryptkey)+'</pre>';
+// document.getElementById('cryptdebug').innerHTML = '<pre>Data: '+cryptstring+'<br />Key:  '+byteArrayToHex(cryptkey)+'</pre>';
 frm.crypt_data.value = cryptstring;
 frm.admin_pass.value = '';
 frm.admin_pass_confirm.value = '';
 }
 return false;
 ?>
 <form name="confirm" action="install.php?mode=install" method="post">
 <?php
 $k = array_keys($_POST);
 for($i=0;$i<sizeof($_POST);$i++) {
-echo '<input type="hidden" name="'.$k[$i].'" value="'.$_POST[$k[$i]].'" />'."\n";
+echo '<input type="hidden" name="'.htmlspecialchars($k[$i]).'" value="'.htmlspecialchars($_POST[$k[$i]]).'" />'."\n";
 }
 ?>
 <h3>Enano is ready to install.</h3>
 <p>The wizard has finished collecting information and is ready to install the database schema. Please review the information below,
 and then click the button below to install the database.</p>
 }
 $cacheonoff = is_writable(ENANO_ROOT.'/cache/') ? '1' : '0';
 echo 'Decrypting administration password...';
-require('config.php');
-if ( !isset($cryptkey) )
-{
-echo 'failed!<br />Cannot get the key from config.php';
-break;
-}
 $aes = new AESCrypt(AES_BITS, AES_BLOCKSIZE);
-$key = $aes->hexToByteArray($cryptkey);
-$enc = $aes->hexToByteArray($_POST['crypt_data']);
+if ( !empty($_POST['crypt_data']) )
-$dec = $aes->rijndaelDecrypt($enc, $key, 'ECB');
+{
-$dec = $aes->byteArrayToString($dec);
+require('config.php');
+if ( !isset($cryptkey) )
+{
+echo 'failed!<br />Cannot get the key from config.php';
+break;
+}
+$key = hexdecode($cryptkey);
+$dec = $aes->decrypt($_POST['crypt_data'], $key, ENC_HEX);
+}
+else
+{
+$dec = $_POST['admin_pass'];
+}
 echo 'done!<br />Generating '.AES_BITS.'-bit AES private key...';
 $privkey = $aes->gen_readymade_key();
 $pkba = hexdecode($privkey);
 $encpass = $aes->encrypt($dec, $pkba, ENC_HEX);

changeset 40	723bb7acf914
parent 39	c83ff194977a
child 69	63638a42cee9