Enano CMS (1.1.x): comparison includes/sessions.php

equal deleted inserted replaced

-:7846d45bd250
+:b2f985e4cef3
 /**
 * Regex that defines a valid username, minus the ^ and $, these are added later
 * @var string
 */
-//var $valid_username = '([A-Za-z0-9 \!\@\(\)-]+)';
 var $valid_username = '([^<>&\?\'"%\n\r\t\a\/]+)';
 /**
 * What we're allowed to do as far as permissions go. This changes based on the value of the "auth" URI param.
 * @var string
 {
 if(is_writable(ENANO_ROOT.'/config.php'))
 {
 // Generate and stash a private key
 // This should only happen during an automated silent gradual migration to the new encryption platform.
-$aes = new AESCrypt(AES_BITS, AES_BLOCKSIZE);
+$aes = AESCrypt::singleton(AES_BITS, AES_BLOCKSIZE);
 $this->private_key = $aes->gen_readymade_key();
 $config = file_get_contents(ENANO_ROOT.'/config.php');
 if(!$config)
 {
 $super = $this->compat_validate_session($key);
 }
 else
 {
 $key = strrev($_REQUEST['auth']);
-$super = $this->validate_session($key);
+if ( !empty($key) && ( strlen($key) / 2 ) % 4 == 0 )
+{
+$super = $this->validate_session($key);
+}
 }
 if(is_array($super))
 {
 $this->auth_level = intval($super['auth_level']);
 $this->sid_super = $_REQUEST['auth'];
 $this->register_guest_session();
 }
 if(!$this->compat)
 {
 // init groups
-$q = $this->sql('SELECT g.group_name,g.group_id,m.is_mod FROM '.table_prefix.'groups AS g
+$q = $this->sql('SELECT g.group_name,g.group_id,m.is_mod FROM '.table_prefix.'groups AS g' . "\n"
-LEFT JOIN '.table_prefix.'group_members AS m
+. '  LEFT JOIN '.table_prefix.'group_members AS m' . "\n"
-ON g.group_id=m.group_id
+. '    ON g.group_id=m.group_id' . "\n"
-WHERE ( m.user_id='.$this->user_id.'
+. '  WHERE ( m.user_id='.$this->user_id.'' . "\n"
-OR g.group_name=\'Everyone\')
+. '    OR g.group_name=\'Everyone\')' . "\n"
-' . ( enano_version() == '1.0RC1' ? '' : 'AND ( m.pending != 1 OR m.pending IS NULL )' ) . '
+. '    ' . ( enano_version() == '1.0RC1' ? '' : 'AND ( m.pending != 1 OR m.pending IS NULL )' ) . '' . "\n"
-ORDER BY group_id ASC;'); // Make sure "Everyone" comes first so the permissions can be overridden
+. '  ORDER BY group_id ASC;'); // Make sure "Everyone" comes first so the permissions can be overridden
 if($row = $db->fetchrow())
 {
 do {
 $this->groups[$row['group_id']] = $row['group_name'];
 $this->group_mod[$row['group_id']] = ( intval($row['is_mod']) == 1 );
 global $db, $session, $paths, $template, $plugins; // Common objects
 $privcache = $this->private_key;
 // Instanciate the Rijndael encryption object
-$aes = new AESCrypt(AES_BITS, AES_BLOCKSIZE);
+$aes = AESCrypt::singleton(AES_BITS, AES_BLOCKSIZE);
 // Fetch our decryption key
 $aes_key = $this->fetch_public_key($aes_key_id);
 if(!$aes_key)
 {
 return $this->login_compat($username, $pass_hashed, $level);
 }
 // Instanciate the Rijndael encryption object
-$aes = new AESCrypt(AES_BITS, AES_BLOCKSIZE);
+$aes = AESCrypt::singleton(AES_BITS, AES_BLOCKSIZE);
 // Initialize our success switch
 $success = false;
 // Retrieve the real password from the database
 // Unencrypted session key
 $session_key = "u=$username;p=$passha1;s=$salt";
 // Encrypt the key
-$aes = new AESCrypt(AES_BITS, AES_BLOCKSIZE);
+$aes = AESCrypt::singleton(AES_BITS, AES_BLOCKSIZE);
 $session_key = $aes->encrypt($session_key, $this->private_key, ENC_HEX);
 // If we're registering an elevated-privilege key, it needs to be on GET
 if($level > USER_LEVEL_MEMBER)
 {
 $aes = new AESCrypt(AES_BITS, AES_BLOCKSIZE, true);
 $decrypted_key = $aes->decrypt($key, $this->private_key, ENC_HEX);
 if ( !$decrypted_key )
 {
-die_semicritical('AES encryption error', '<p>Something went wrong during the AES decryption process.</p><pre>'.print_r($decrypted_key, true).'</pre>');
+// die_semicritical('AES encryption error', '<p>Something went wrong during the AES decryption process.</p><pre>'.print_r($decrypted_key, true).'</pre>');
+return false;
 }
 $n = preg_match('/^u='.$this->valid_username.';p=([A-Fa-f0-9]+?);s=([A-Fa-f0-9]+?)$/', $decrypted_key, $keydata);
 if($n < 1)
 {
 // echo '(debug) $session->validate_session: Key does not match regex<br />Decrypted key: '.$decrypted_key;
 return false;
 }
 $keyhash = md5($key);
 $salt = $db->escape($keydata[3]);
-$query = $db->sql_query('SELECT u.user_id AS uid,u.username,u.password,u.email,u.real_name,u.user_level,u.theme,u.style,u.signature,u.reg_time,u.account_active,u.activation_key,k.source_ip,k.time,k.auth_level,COUNT(p.message_id) AS num_pms,x.* FROM '.table_prefix.'session_keys AS k
+// using a normal call to $db->sql_query to avoid failing on errors here
-LEFT JOIN '.table_prefix.'users AS u
+$query = $db->sql_query('SELECT u.user_id AS uid,u.username,u.password,u.email,u.real_name,u.user_level,u.theme,u.style,u.signature,' . "\n"
-ON ( u.user_id=k.user_id )
+. '    u.reg_time,u.account_active,u.activation_key,k.source_ip,k.time,k.auth_level,COUNT(p.message_id) AS num_pms,' . "\n"
-LEFT JOIN '.table_prefix.'users_extra AS x
+. '    x.* FROM '.table_prefix.'session_keys AS k' . "\n"
-ON ( u.user_id=x.user_id OR x.user_id IS NULL )
+. '  LEFT JOIN '.table_prefix.'users AS u' . "\n"
-LEFT JOIN '.table_prefix.'privmsgs AS p
+. '    ON ( u.user_id=k.user_id )' . "\n"
-ON ( p.message_to=u.username AND p.message_read=0 )
+. '  LEFT JOIN '.table_prefix.'users_extra AS x' . "\n"
-WHERE k.session_key=\''.$keyhash.'\'
+. '    ON ( u.user_id=x.user_id OR x.user_id IS NULL )' . "\n"
-AND k.salt=\''.$salt.'\'
+. '  LEFT JOIN '.table_prefix.'privmsgs AS p' . "\n"
-GROUP BY u.user_id;');
+. '    ON ( p.message_to=u.username AND p.message_read=0 )' . "\n"
+. '  WHERE k.session_key=\''.$keyhash.'\'' . "\n"
+. '    AND k.salt=\''.$salt.'\'' . "\n"
+. '  GROUP BY u.user_id;');
 if ( !$query )
 {
 $query = $this->sql('SELECT u.user_id AS uid,u.username,u.password,u.email,u.real_name,u.user_level,u.theme,u.style,u.signature,u.reg_time,u.account_active,u.activation_key,k.source_ip,k.time,k.auth_level,COUNT(p.message_id) AS num_pms FROM '.table_prefix.'session_keys AS k
 LEFT JOIN '.table_prefix.'users AS u
 ON ( u.user_id=k.user_id )
 global $db, $session, $paths, $template, $plugins; // Common objects
 $ou = $this->username;
 $oid = $this->user_id;
 if($level > USER_LEVEL_CHPREF)
 {
-$aes = new AESCrypt(AES_BITS, AES_BLOCKSIZE);
+$aes = AESCrypt::singleton(AES_BITS, AES_BLOCKSIZE);
 if(!$this->user_logged_in || $this->auth_level < USER_LEVEL_MOD) return 'success';
 // Destroy elevated privileges
 $keyhash = md5(strrev($this->sid_super));
 $this->sql('DELETE FROM '.table_prefix.'session_keys WHERE session_key=\''.$keyhash.'\' AND user_id=\'' . $this->user_id . '\';');
 $this->sid_super = false;
 * @return string Hex-encoded AES key
 */
 function rijndael_genkey()
 {
-$aes = new AESCrypt(AES_BITS, AES_BLOCKSIZE);
+$aes = AESCrypt::singleton(AES_BITS, AES_BLOCKSIZE);
 $key = $aes->gen_readymade_key();
 $keys = getConfig('login_key_cache');
 if(is_string($keys))
 $keys .= $key;
 else
 * @return string
 */
 function dss_rand()
 {
-$aes = new AESCrypt();
+$aes = AESCrypt::singleton(AES_BITS, AES_BLOCKSIZE);
 $random = $aes->randkey(128);
 unset($aes);
 return md5(microtime() . $random);
 }
 function check_banlist()
 {
 global $db, $session, $paths, $template, $plugins; // Common objects
 $col_reason = ( $this->compat ) ? '"No reason entered (session manager is in compatibility mode)" AS reason' : 'reason';
-$is_banned = false;
+$banned = false;
 if ( $this->user_logged_in )
 {
 // check by IP, email, and username
 $sql = "SELECT $col_reason, ban_value, ban_type, is_regex FROM " . table_prefix . "banlist WHERE \n"
 . "    ( ban_type = " . BAN_IP    . " AND is_regex = 0 ) OR \n"
 function create_user($username, $password, $email, $real_name = '', $coppa = false)
 {
 global $db, $session, $paths, $template, $plugins; // Common objects
 // Initialize AES
-$aes = new AESCrypt(AES_BITS, AES_BLOCKSIZE);
+$aes = AESCrypt::singleton(AES_BITS, AES_BLOCKSIZE);
 if(!preg_match('#^'.$this->valid_username.'$#', $username)) return 'The username you chose contains invalid characters.';
 $username = str_replace('_', ' ', $username);
 $user_orig = $username;
 $username = $this->prepare_text($username);
 * @return bool
 */
 function register_temp_password($user_id, $password)
 {
-$aes = new AESCrypt(AES_BITS, AES_BLOCKSIZE);
+$aes = AESCrypt::singleton(AES_BITS, AES_BLOCKSIZE);
 $temp_pass = $aes->encrypt($password, $this->private_key, ENC_HEX);
 $this->sql('UPDATE '.table_prefix.'users SET temp_password=\'' . $temp_pass . '\',temp_password_time='.time().' WHERE user_id='.intval($user_id).';');
 }
 /**
 // Scan the user ID for problems
 if(intval($user_id) < 1) $errors[] = 'SQL injection attempt';
 // Instanciate the AES encryption class
-$aes = new AESCrypt(AES_BITS, AES_BLOCKSIZE);
+$aes = AESCrypt::singleton(AES_BITS, AES_BLOCKSIZE);
 // If all of our input vars are false, then we've effectively done our job so get out of here
 if($username === false && $password === false && $email === false && $realname === false && $signature === false && $user_level === false)
 {
 // echo 'debug: $session->update_user(): success (no changes requested)';
 // Initialize the permissions list with some defaults
 $this->perms = $this->acl_types;
 $this->acl_defaults_used = $this->perms;
 // Fetch sitewide defaults from the permissions table
-$bs = 'SELECT rules FROM '.table_prefix.'acl WHERE page_id IS NULL AND namespace IS NULL AND ( ';
+$bs = 'SELECT rules, target_type, target_id FROM '.table_prefix.'acl' . "\n"
+. '  WHERE page_id IS NULL AND namespace IS NULL AND' . "\n"
+. '  ( ';
 $q = Array();
 $q[] = '( target_type='.ACL_TYPE_USER.' AND target_id='.$this->user_id.' )';
 if(count($this->groups) > 0)
 {
 foreach($this->groups as $g_id => $g_name)
 {
 $q[] = '( target_type='.ACL_TYPE_GROUP.' AND target_id='.intval($g_id).' )';
 }
 }
-$bs .= implode(' OR ', $q) . ' ) ORDER BY target_type ASC, target_id ASC;';
+$bs .= implode(" OR \n    ", $q) . " ) \n  ORDER BY target_type ASC, target_id ASC;";
 $q = $this->sql($bs);
 if ( $row = $db->fetchrow() )
 {
 do {
 $rules = $this->string_to_perm($row['rules']);
 $q[] = '( target_type='.ACL_TYPE_GROUP.' AND target_id='.intval($g_id).' )';
 }
 }
 // The reason we're using an ORDER BY statement here is because ACL_TYPE_GROUP is less than ACL_TYPE_USER, causing the user's individual
 // permissions to override group permissions.
-$bs .= implode(' OR ', $q) . ' ) AND (' . $pg_info . ' ( page_id=\''.$db->escape($paths->cpage['urlname_nons']).'\' AND namespace=\''.$db->escape($paths->namespace).'\' ) )
+$bs .= implode(" OR\n    ", $q) . " )\n  AND (" . $pg_info . ' ( page_id=\''.$db->escape($paths->cpage['urlname_nons']).'\' AND namespace=\''.$db->escape($paths->namespace).'\' ) )
 ORDER BY target_type ASC, page_id ASC, namespace ASC;';
 $q = $this->sql($bs);
 if ( $row = $db->fetchrow() )
 {
 do {
 {
 $pg_info .= ' ( page_id=\'' . $g_id . '\' AND namespace=\'__PageGroup\' ) OR';
 }
 // Build a query to grab ACL info
-$bs = 'SELECT rules FROM '.table_prefix.'acl WHERE ( ';
+$bs = 'SELECT rules FROM '.table_prefix.'acl WHERE ' . "\n"
+. '  ( ';
 $q = Array();
 $q[] = '( target_type='.ACL_TYPE_USER.' AND target_id='.$session->user_id.' )';
 if(count($session->groups) > 0)
 {
 foreach($session->groups as $g_id => $g_name)
 $q[] = '( target_type='.ACL_TYPE_GROUP.' AND target_id='.intval($g_id).' )';
 }
 }
 // The reason we're using an ORDER BY statement here is because ACL_TYPE_GROUP is less than ACL_TYPE_USER, causing the user's individual
 // permissions to override group permissions.
-$bs .= implode(' OR ', $q) . ' ) AND (' . $pg_info . ' page_id=\''.$db->escape($page_id).'\' AND namespace=\''.$db->escape($namespace).'\' )
+$bs .= implode(" OR\n    ", $q) . ' ) AND (' . $pg_info . ' page_id=\''.$db->escape($page_id).'\' AND namespace=\''.$db->escape($namespace).'\' )
 ORDER BY target_type ASC, page_id ASC, namespace ASC;';
 $q = $session->sql($bs);
 if ( $row = $db->fetchrow() )
 {
 do {

changeset 286	b2f985e4cef3
parent 270	5bcdee999015
child 289	2b60c89dc27f