includes/sessions.php
Mon, 16 Jan 2012 09:22:24 -0500 Dan Fuhry Typo
Sun, 04 Sep 2011 02:32:49 -0400 Dan Fuhry SECURITY: Various security enhancements to password resets. They are now rate-limited by username and IP, and it is possible to disable username autofill for guests.
Tue, 16 Nov 2010 12:31:41 -0500 Dan Fuhry SECURITY: Fix SQL injection in banlist check (1.1.7 branch) 1.1.7-maintenance 1.1.7pl2
Tue, 16 Nov 2010 12:11:29 -0500 Dan Fuhry SECURITY: Fix SQL injection in banlist check
Fri, 20 Aug 2010 01:36:44 -0400 Dan Fuhry Fixed some ACL scope warnings
Thu, 29 Jul 2010 19:30:11 -0400 Dan Pending group memberships no longer alter result in rank alterations
Mon, 26 Jul 2010 20:10:01 -0400 Dan Improved captcha word generation; fixed duplicate auth parameter in Special:Login privileged login; improved search indexer performance on websites with lots of words
Sun, 25 Jul 2010 11:15:53 -0400 Dan Fuhry Made login window focus the controls earlier if animations are disabled.
Thu, 01 Jul 2010 20:51:53 -0400 Dan Fuhry Fixed the (rather expected) 1.0.x migration issues db revision system
Mon, 28 Jun 2010 10:43:04 -0400 Dan Fuhry SECURITY: Multiple XSS in Special:ChangeStyle. Reported by Mesut Timur of Mavituna Security - thanks! Also removed my stand-in for ucfirst().
Wed, 02 Jun 2010 21:58:26 -0400 Dan Rewrote category editor. This breaks the JSON API. Also fixed a few bugs with how Wiki Mode is set in $paths. (Hopefully that doesn't cause infinite loops, heh). Fixes issue 20.
Sat, 17 Apr 2010 03:33:14 -0400 Dan Made separate methods in sessionManager for static and non-static generate_aes_form(), because PHP (erroneously) always calls that method statically.
Tue, 06 Apr 2010 15:54:45 -0400 Dan Added Diffie-Hellman crypto support into the installer. Fixes issue 13.
Tue, 30 Mar 2010 11:37:00 -0400 Dan Added selection and popup for <pre> tags within wikitext. Also fixed more bugs found in the HTML paragraph parser (mostly self-closing tags e.g. <hr />).
Sun, 28 Mar 2010 23:10:46 -0400 Dan Going ahead with the switch to tabs. This is a major coding standards change! If any unusual parser bugs show up, check this changeset. Converted all .php, .js, .tpl, .css, and .json files and did basic testing.
Mon, 01 Feb 2010 02:15:04 -0500 Dan Fixed more places where author_uid wasn't right.
Sun, 10 Jan 2010 17:13:03 -0500 Dan Fixed author_uid in activation request insertion
Wed, 06 Jan 2010 02:02:51 -0500 Dan Fixed some bugs with account activation, especially if you're a half-logged-in vegetable.
Wed, 06 Jan 2010 01:18:19 -0500 Dan Sessions: fixed on_critical_page(), it referenced the wrong global; enabled better extensible behavior in the account_active column
Fri, 18 Dec 2009 19:17:18 -0500 Dan AJAX login: Fixed error box failure to destroy upon cancel. Fixes issue 8.
Fri, 18 Dec 2009 19:06:49 -0500 Dan Logs: Fully integrated an author_uid column. Logs are now linked by user ID instead of just username, so they survive username changes better. Database is changed. Fixes issue 6.
Fri, 18 Dec 2009 05:12:02 -0500 Dan Comments (AJAX): Now paginated server side. Fixes issue 2.
Thu, 17 Dec 2009 04:31:55 -0500 Dan ACP: Added lockout management feature
Sat, 12 Dec 2009 15:44:36 -0500 Dan Re-merge changes from a2hosting dev
Sat, 12 Dec 2009 15:39:36 -0500 Dan CAPTCHA: Added smart autosubmit for registration page. Usability testing was so-so, may back out later.
Fri, 11 Dec 2009 17:11:47 -0500 Dan A couple fixes to permission out-of-scope errors.
Mon, 07 Dec 2009 15:21:47 -0500 Dan Sessions: Made acl_check_deps() verify scope, so that all of an action's dependencies must apply to the namespace of the given action.
Sun, 06 Dec 2009 21:51:55 -0500 Dan PostgreSQL: Fixed $session->create_user()
Tue, 03 Nov 2009 22:08:48 -0500 Dan Logins: reorganized data structures a bit. WiP - needs test routine done.
Fri, 21 Aug 2009 20:41:38 -0400 Dan Sessions: Improved inactive account UX; shuffled around a bit of code so that whitelist checks are shared; fixed a bunch of bugs related to ban code and IPv6 addresses
Fri, 21 Aug 2009 13:49:45 -0400 Dan User ACP: redirect to Special:Login on own account deletion
Thu, 20 Aug 2009 21:15:19 -0400 Dan Sessions: whoops, left a debug message in by accident, broke a few redirects
Thu, 20 Aug 2009 20:01:55 -0400 Dan Fixed some upgrade bugs; added support for choosing one's own date/time formats; rebrand as 1.1.7
Mon, 10 Aug 2009 22:43:26 -0400 Dan Added ability for authentication plugins to modify session keys (to allow invalidation when their own authentication data is changed) as well as the ability to disable the built-in password change facility
Mon, 03 Aug 2009 02:58:43 -0400 Dan Sessions: fixed logout() destroying normal session (instead of elevated) if $level = USER_LEVEL_CHPREF. Possible very minor security concern: elevated sessions were not fully destroyed, so if a normal session is opened from the same IP, the elevated one may be reusable for 15 minutes.
Fri, 31 Jul 2009 19:15:48 -0400 Dan Merged development from Scribus and Charlie
Fri, 17 Jul 2009 17:11:09 -0400 Dan AJAX Login: Fixed all known issues with lockout (and some unknown ones)
Wed, 29 Jul 2009 11:49:30 -0400 Dan Fixed logins with usernames containing Unicode characters
Thu, 02 Jul 2009 09:01:29 -0400 Dan Login and sessions: fixed some improper handling of the config for lockout logic
Sun, 21 Jun 2009 00:16:21 -0400 Dan AJAX login: fixed improper run of login_submit_early; fixed failure to redirect if main_page_members == current page
Fri, 22 May 2009 13:49:02 -0400 Dan Sped up AJAX de-auth a little; added a little extra info to login_success JSON responses
Fri, 15 May 2009 15:56:10 -0400 Dan Fixed undefined indices for user_extra in various places
Tue, 05 May 2009 00:10:26 -0400 Dan Made some more changes to the way namespaces are handled, for optimization purposes. This is a bit of a structural reorganization: $paths->pages is obsoleted in its entirety; calculating page existence and metadata is now the job of the Namespace_* backend class. There are many things in PageProcessor that should be reorganized, and page actions in general should really be rethought. This is probably the beginning of a long process that will be taking place over the course of the betas.
Sun, 19 Apr 2009 19:01:08 -0400 Dan Upgrader: UX: Added welcome page, different between Caoineag and Banshee
Wed, 15 Apr 2009 19:44:47 -0400 Dan New, beautiful, rethought Admin:Home. No, really, you'll like it.
Sat, 11 Apr 2009 16:58:32 -0400 Dan session: login_process_userdata_json hook should work with more than one installed auth plugin now
Sat, 04 Apr 2009 22:35:44 -0400 Dan Session: additional metadata passed back from auth plugins is passed through to client for optional further parsing
Sat, 14 Mar 2009 14:06:02 -0400 Dan Added support for alternate port numbers on database servers. Also in install-cli, merged in new sysreqs functionality.
Thu, 26 Feb 2009 01:07:32 -0500 Dan Added possibility for auth plugins, which can log a user in using non-standard authentication methods.
Mon, 16 Feb 2009 16:17:25 -0500 Dan Major redesign of rendering pipeline that separates pages saved with MCE from pages saved with the plaintext editor (full description in long commit message)
Sun, 25 Jan 2009 21:20:14 -0500 Dan Replaced integer checks that used preg_match() to use ctype_digit() instead
Fri, 16 Jan 2009 13:13:37 -0500 Dan Deprecated old grab_password_hash() functions in session
Sun, 11 Jan 2009 21:37:49 -0500 Dan Added support for live re-auth and de-auth; fully AJAX, no page reload required, plus plugin-usable API.
Sun, 04 Jan 2009 01:43:16 -0500 Dan Upgrades should work now.
Sun, 04 Jan 2009 00:55:40 -0500 Dan Two big commits in one day I know, but redid password storage to use HMAC-SHA1. Consolidated much AES processing to three core methods in session that should handle everything automagically. Installation works; upgrades should. Rebranded as 1.1.6.
Sun, 21 Dec 2008 17:25:28 -0500 Dan Corrected a few issues with languages and client-side code
Sun, 21 Dec 2008 07:07:21 -0500 Dan Fixed a couple PostgreSQL bugs.
Sun, 21 Dec 2008 04:26:56 -0500 Dan Fixed timezone preference setting not fully implemented; added ability for users to select their own rank from a list of possible ranks based on group membership and user level
Thu, 20 Nov 2008 22:59:25 -0500 Dan Added dependency checking in ACL tracer
Sun, 09 Nov 2008 14:22:41 -0500 Dan Merging with upstream
Mon, 03 Nov 2008 08:56:44 -0500 Dan Fixed error-out when DiffieHellman not supported and respawn requested (part of OS X QA process)
Sun, 09 Nov 2008 09:03:10 -0500 Dan Added config option to grant userpage rights to new users (defaults to on, as it was hardcoded on before)
Sat, 08 Nov 2008 22:35:59 -0500 Dan Fixed DiffieHellman being included twice when not supported and login fails
Sun, 21 Sep 2008 09:01:27 -0400 Dan Added initial support for DST. Rules are defined in constants.php and are extensible.
Tue, 19 Aug 2008 20:57:17 -0400 Dan Made upgrades from 1.1.4 -> 1.1.5 work if keyhash is not present
Wed, 13 Aug 2008 08:48:03 -0400 Dan Made login forms that use $session->aes_javascript() use new whiteOutForm() function
Tue, 12 Aug 2008 00:06:35 -0400 Dan Added customizable parameters for session length and the long-missing "remember me" option (or rather, the ability to turn it off and make sessions temporary)
Mon, 11 Aug 2008 22:31:04 -0400 Dan Rebranded as 1.1.5 (Caoineag alpha 5) and fixed a couple bugs related to CDN support in template_nodb and installerUI. Updated readme.
Sat, 12 Jul 2008 03:55:14 -0400 Dan Added Gravatar support in UserManager in admin panel
Wed, 09 Jul 2008 21:02:28 -0400 Dan Fixed undefined group_rank_id in sessions
Mon, 07 Jul 2008 02:49:26 -0400 Dan Moved all account deactivation notice presentation code to its own method in sessions
Thu, 03 Jul 2008 15:34:09 -0400 Dan As promised, dropped in the new librijndael. Benchmarks say about 3 times faster, but more performance testing will be done.
Wed, 02 Jul 2008 22:15:55 -0400 Dan More optimization work. Moved special page init functions to common instead of common_post hook. Allowed paths to cache page metadata on filesystem. Phased out the redundancy in $paths->pages that paired a number with every urlname as foreach loops are allowed now (and have been for some time). Fixed missing includes for several functions. Rewrote str_replace_once to be a lot more efficient.
Wed, 02 Jul 2008 19:36:44 -0400 Dan Another sweep from the optimization monster.
Mon, 30 Jun 2008 17:22:29 -0400 Dan Made $session->private_key protected and added pk_{en,de}crypt methods for encrypting and decrypting data using the private key
Mon, 30 Jun 2008 17:20:02 -0400 Dan Several optimization changes including getting rid of a few eval()s. Added placeholder functions for the theme manager, which should be working now
Thu, 26 Jun 2008 18:03:04 -0400 Dan Made encryption work in form-based logon again; modified load_component() to fetch compressed versions when possible
Thu, 26 Jun 2008 17:01:42 -0400 Dan Fixed missing table_prefix in generate_rank_sql()
Wed, 18 Jun 2008 22:43:16 -0400 Dan Fixed SQL syntax error thrown during rank data fetch
Mon, 16 Jun 2008 19:05:16 -0400 Dan Fixed undefined index left over from scope system rewrite a few days ago
Sun, 15 Jun 2008 01:30:00 -0400 Dan Renamed some functions (that were new in this release anyway) due to compatibility broken with PunBB bridge
Sun, 15 Jun 2008 00:59:37 -0400 Dan Got ACL scope logic working again and began enforcing it. Breaking API change: assigning page title with $template->tpl_strings['PAGE_NAME'] will no longer work, use $template->assign_vars(). Workaround may be added later. Test for assign_vars method if compatibility needed. Added namespace processor API (non-breaking change). Several other things tweaked around as well.
Sat, 14 Jun 2008 22:01:24 -0400 Dan Fixed some plugin compatibility issues seen in Nuggie
Tue, 10 Jun 2008 00:21:34 -0400 Dan A bit of UX improvement to upgrade UI; updated readme for 1.1.4
Sat, 07 Jun 2008 12:39:24 -0400 Dan Modified $template->init_vars() to pivot to local page metadata and permissions from a PageProcessor object instead of global data from $paths and permissions from $session to allow redirects to affect on-page controls as well as the actual content (only partially complete, protection and several other elements still need to be localized)
Sat, 24 May 2008 23:40:42 -0400 Dan More work done on effective permissions API, namely reporting of page group and usergroup names
Fri, 16 May 2008 12:22:26 -0400 Dan Added user preference for disabling visual effects in Javascript applets; added re-import button to installed plugins
Mon, 12 May 2008 00:59:46 -0400 Dan Revamped some ACL code and added effective permissions calculation code into session manager
Mon, 05 May 2008 20:06:37 -0400 Dan Added ETag support and increased caching settings to try and speed the system up. Result of a YSlow audit.
Sun, 04 May 2008 21:57:48 -0400 Dan Massive commit with various changes. Added user ranks system (no admin interface yet) and ability for users to have custom user titles. Made cron framework accept fractions of hours through floating-point intervals. Modifed ACL editor to use miniPrompt framework for close confirmation box. Made avatar system use a special page as opposed to fetching the files directly for caching reasons.
Mon, 14 Apr 2008 12:13:12 -0400 Dan Rebrand as 1.1.4 (Caoineag alpha 4)
Tue, 08 Apr 2008 20:32:30 -0400 Dan Merging nighthawk and scribus branches
Tue, 08 Apr 2008 20:30:05 -0400 Dan Implemented the password-reset redirect _properly_ instead of the hackish direct header() call in sessions.php
Sun, 06 Apr 2008 14:02:20 -0400 Dan SECURITY: Disabled caching of decrypted DiffieHellman login requests
Wed, 26 Mar 2008 20:20:22 -0400 Dan Made some improvements to ACL system including: warning on setting Deny for Everyone on the entire site, added ACL_ALWAYS_ALLOW_ADMIN_EDIT_ACL, and changed behavior as noted in the docs so that Deny for Everyone is no longer able to be overridden
Tue, 18 Mar 2008 14:32:40 -0400 Dan Fixed some stray version numbers (again!); added support for Diffie-Hellman logins in the normal login form (not AJAX) - even works in IE
Sun, 16 Mar 2008 16:06:59 -0400 Dan Added support for embedding language data into plugins; updated all version numbers on plugin files
Sat, 15 Mar 2008 00:08:01 -0400 Dan Fixed some bugs with PostgreSQL and added a word_lcase column to the search_index table because collation is not working under MySQL. TODO: Trigger search index rebuild on upgrade to 1.1.4.
Sat, 08 Mar 2008 12:13:23 -0500 Dan Fixed undefined variable ($row['is_regex'] instead of $is_regex) in sessions.php
Thu, 06 Mar 2008 23:31:28 -0500 Dan [Security] made session manager have some degree of IP validation for session keys and upgrades
Thu, 06 Mar 2008 23:27:50 -0500 Dan Fixed session validation bug in upgrade script; fixed non-object reference in template_nodb
Thu, 06 Mar 2008 20:53:26 -0500 Dan Added a cron task to sessions.php that deletes old admin keys once a week
Sun, 02 Mar 2008 19:32:19 -0500 Dan Implemented password reset (albeit hackishly) into the new login API; added dummy window.console object to hopefully reduce errors when Firebug isn't around; fixed the longstanding ACL dismiss/close button bug; fixed a couple undefined variables in mailer; fixed PHP error on attempted opening of /dev/(u)random in rijndael.php; clarified documentation for PageProcessor::update_page(); fixed some logic problems in theme ACL code; disabled CAPTCHA debug
Sat, 01 Mar 2008 23:02:05 -0500 Dan Implemented all security features on theme disabling and ACLs; added clean_key mode to login API to clean unused encryption keys
Sat, 01 Mar 2008 18:55:54 -0500 Dan Fixed improper serializing of IP that could allow reusing of key from multiple IP addresses.
Sun, 24 Feb 2008 12:52:07 -0500 Dan Merging in changes from Nighthawk
Fri, 22 Feb 2008 12:51:53 -0500 Dan Merging fixes and updates from stable branch
Mon, 31 Dec 2007 21:16:27 -0500 Dan Integrating patch for PHP 6.0-dev compatibility
Wed, 20 Feb 2008 14:38:39 -0500 Dan Added support for Diffie-Hellman key exchange during login. w00t!
Mon, 18 Feb 2008 16:13:56 -0500 Dan Fixed typo in ban logic
Mon, 11 Feb 2008 14:33:31 -0500 Dan Rebrand as 1.1.2; made upgrade framework functional
Fri, 08 Feb 2008 23:20:20 -0500 Dan Added some basic timezone support; DST support is still to come.
Wed, 06 Feb 2008 19:27:43 -0500 Dan Fixed some captcha bugs and made all captcha fields case-insensitive
Wed, 06 Feb 2008 18:41:47 -0500 Dan Implemented a new CAPTCHA API; the frontend ($session->{make,get}_captcha) is API-compatible but the backend (the captcha class) is deprecated.
Tue, 29 Jan 2008 23:15:44 -0500 Dan Localization is FINISHED, DAMN IT HELLAH YEAH! OVER WITH! Man, it feels to get that off my chest. Release is in under 48 hours, folks. And we're ready for it.
Tue, 29 Jan 2008 16:19:51 -0500 Dan Rebranded source code as 1.1.1; added TinyMCE ACL rule as per Vadi's request: http://forum.enanocms.org/viewtopic.php?f=7&t=54
Sun, 27 Jan 2008 22:57:40 -0500 Dan Got Enano to load even if there are no plugins; added caching for decrypted session keys to significantly improve performance (in theory at least)
Sat, 26 Jan 2008 15:42:32 -0500 Dan Removed stray debugging info from ACL editor success notification; added ability for guests to set language on URI (?lang=eng); added html_in_pages ACL type and separated from php_in_pages so HTML can be embedded but not PHP; rewote portions of the path manager to better abstract URL input; added Zend Framework into list of BSD-licensed libraries; localized some remaining strings; got the migration script working, but just barely; fixed display bug in Special:Contributions; localized Main Page button in admin panel
Thu, 24 Jan 2008 22:14:40 -0500 Dan [minor] Trying to be a little more careful with values from users_extra in validate_session()
Thu, 24 Jan 2008 22:06:09 -0500 Dan A number of scattered changes. Profiler added and only enabled in debug mode (currently on), but awfully useful for fixing performance in the future. Started work on Admin:LangManager
less more (0) -120 tip