Something went wrong during the AES decryption process.
'.print_r($decrypted_key, true).''); @@ -1042,24 +1086,59 @@ } $keyhash = md5($key); $salt = $db->escape($keydata[3]); - profiler_log("SessionManager: checking session: " . sha1($key) . ": decrypted session key to $decrypted_key"); + + return $this->validate_session_shared($keyhash, $salt, true); + } + + /** + * Shared portion of session validation. Do not try to call this. + * @return array + * @access private + */ + + protected function validate_session_shared($key, $salt, $loose_call = false) + { + global $db, $session, $paths, $template, $plugins; // Common objects + // using a normal call to $db->sql_query to avoid failing on errors here - $query = $db->sql_query('SELECT u.user_id AS uid,u.username,u.password,u.email,u.real_name,u.user_level,u.theme,u.style,u.signature,' . "\n" - . ' u.reg_time,u.account_active,u.activation_key,u.user_lang,u.user_title,k.source_ip,k.time,k.auth_level,k.key_type,COUNT(p.message_id) AS num_pms,' . "\n" - . ' u.user_timezone, u.user_dst, x.* FROM '.table_prefix.'session_keys AS k' . "\n" - . ' LEFT JOIN '.table_prefix.'users AS u' . "\n" - . ' ON ( u.user_id=k.user_id )' . "\n" - . ' LEFT JOIN '.table_prefix.'users_extra AS x' . "\n" - . ' ON ( u.user_id=x.user_id OR x.user_id IS NULL )' . "\n" - . ' LEFT JOIN '.table_prefix.'privmsgs AS p' . "\n" - . ' ON ( p.message_to=u.username AND p.message_read=0 )' . "\n" - . ' WHERE k.session_key=\''.$keyhash.'\'' . "\n" - . ' AND k.salt=\''.$salt.'\'' . "\n" - . ' GROUP BY u.user_id,u.username,u.password,u.email,u.real_name,u.user_level,u.theme,u.style,u.signature,u.reg_time,u.account_active,u.activation_key,u.user_lang,u.user_timezone,u.user_title,u.user_dst,k.source_ip,k.time,k.auth_level,k.key_type,x.user_id, x.user_aim, x.user_yahoo, x.user_msn, x.user_xmpp, x.user_homepage, x.user_location, x.user_job, x.user_hobbies, x.email_public, x.disable_js_fx;'); + $columns_select = "u.user_id AS uid, u.username, u.password, u.password_salt, u.email, u.real_name, u.user_level, u.theme,\n" + . " u.style,u.signature, u.reg_time, u.account_active, u.activation_key, u.user_lang, u.user_title, k.salt, k.source_ip,\n" + . " k.time, k.auth_level, k.key_type, COUNT(p.message_id) AS num_pms, u.user_timezone, u.user_dst, x.*"; + + $columns_groupby = "u.user_id, u.username, u.password, u.email, u.real_name, u.user_level, u.theme, u.style, u.signature,\n" + . " u.reg_time, u.account_active, u.activation_key, u.user_lang, u.user_timezone, u.user_title, u.user_dst,\n" + . " k.salt, k.source_ip, k.time, k.auth_level, k.key_type, x.user_id, x.user_aim, x.user_yahoo, x.user_msn,\n" + . " x.user_xmpp, x.user_homepage, x.user_location, x.user_job, x.user_hobbies, x.email_public,\n" + . " x.disable_js_fx"; + + $joins = " LEFT JOIN " . table_prefix . "users AS u\n" + . " ON ( u.user_id=k.user_id )\n" + . " LEFT JOIN " . table_prefix . "users_extra AS x\n" + . " ON ( u.user_id=x.user_id OR x.user_id IS NULL )\n" + . " LEFT JOIN " . table_prefix . "privmsgs AS p\n" + . " ON ( p.message_to=u.username AND p.message_read=0 )\n"; + if ( !$loose_call ) + { + $key_md5 = md5($key); + $query = $db->sql_query("SELECT $columns_select\n" + . "FROM " . table_prefix . "session_keys AS k\n" + . $joins + . " WHERE k.session_key='$key_md5'\n" + . " GROUP BY $columns_groupby;"); + } + else + { + $query = $db->sql_query("SELECT $columns_select\n" + . "FROM " . table_prefix . "session_keys AS k\n" + . $joins + . " WHERE k.session_key='$key'\n" + . " AND k.salt='$salt'\n" + . " GROUP BY $columns_groupby;"); + } if ( !$query && ( defined('IN_ENANO_INSTALL') or defined('IN_ENANO_UPGRADE') ) ) { - $query = $this->sql('SELECT u.user_id AS uid,u.username,u.password,u.email,u.real_name,u.user_level,u.theme,u.style,u.signature,u.reg_time,u.account_active,u.activation_key,k.source_ip,k.time,k.auth_level,COUNT(p.message_id) AS num_pms, 1440 AS user_timezone, \'0;0;0;0;60\' AS user_dst, ' . SK_SHORT . ' AS key_type FROM '.table_prefix.'session_keys AS k + $query = $this->sql('SELECT u.user_id AS uid,u.username,u.password,\'\' AS password_salt,u.email,u.real_name,u.user_level,u.theme,u.style,u.signature,u.reg_time,u.account_active,u.activation_key,k.source_ip,k.time,k.auth_level,COUNT(p.message_id) AS num_pms, 1440 AS user_timezone, \'0;0;0;0;60\' AS user_dst, ' . SK_SHORT . ' AS key_type FROM '.table_prefix.'session_keys AS k LEFT JOIN '.table_prefix.'users AS u ON ( u.user_id=k.user_id ) LEFT JOIN '.table_prefix.'privmsgs AS p @@ -1078,7 +1157,8 @@ return false; } $row = $db->fetchrow(); - profiler_log("SessionManager: checking session: " . sha1($key) . ": selected and fetched results"); + profiler_log("SessionManager: session check: selected and fetched results"); + $row['user_id'] =& $row['uid']; $ip = $_SERVER['REMOTE_ADDR']; if($row['auth_level'] > $row['user_level']) @@ -1103,15 +1183,21 @@ return false; } - // Do the password validation - $real_pass = $aes->decrypt($row['password'], $this->private_key, ENC_HEX); - - //die('
'.print_r($keydata, true).''); - if(sha1($real_pass) != $keydata[2]) + // $loose_call is turned on only from validate_aes_session + if ( !$loose_call ) { - // Failed password check - // echo '(debug) $session->validate_session: encrypted password is wrong
1.1.5-1.1.6 migration script: ERROR: bad password returned from $session->pk_decrypt()
'; + $ui->show_footer(); + exit; + } + $hmac_secret = hexencode(AESCrypt::randkey(20), '', ''); + $password = hmac_sha1($password, $hmac_secret); + $e = $db->sql_query('UPDATE ' . table_prefix . "users SET password = '{$password}', password_salt = '{$hmac_secret}', old_encryption = 0 WHERE user_id = {$row['user_id']};"); + if ( !$e ) + $db->_die(); +} + + diff -r 9cdfe82c56cd -r eb8b23f11744 install/upgrade.php --- a/install/upgrade.php Sat Jan 03 18:11:18 2009 -0500 +++ b/install/upgrade.php Sun Jan 04 00:55:40 2009 -0500 @@ -2,7 +2,7 @@ /* * Enano - an open-source CMS capable of wiki functions, Drupal-like sidebar blocks, and everything in between - * Version 1.1.5 (Caoineag alpha 5) + * Version 1.1.6 (Caoineag beta 1) * Copyright (C) 2006-2008 Dan Fuhry * Installation package * upgrade.php - Upgrade interface @@ -19,7 +19,7 @@ // The list of versions in THIS AND PREVIOUS branches, in chronological order. $enano_versions = array(); $enano_versions['1.0'] = array('1.0', '1.0.1', '1.0.2b1', '1.0.2', '1.0.3', '1.0.4', '1.0.5'); -$enano_versions['1.1'] = array('1.1.1', '1.1.2', '1.1.3', '1.1.4', '1.1.5'); +$enano_versions['1.1'] = array('1.1.1', '1.1.2', '1.1.3', '1.1.4', '1.1.5', '1.1.6'); // Turn on every imaginable API hack to make common load on older databases define('IN_ENANO_UPGRADE', 1); diff -r 9cdfe82c56cd -r eb8b23f11744 plugins/PrivateMessages.php --- a/plugins/PrivateMessages.php Sat Jan 03 18:11:18 2009 -0500 +++ b/plugins/PrivateMessages.php Sun Jan 04 00:55:40 2009 -0500 @@ -12,7 +12,7 @@ /* * Enano - an open-source CMS capable of wiki functions, Drupal-like sidebar blocks, and everything in between - * Version 1.1.5 (Caoineag alpha 5) + * Version 1.1.6 (Caoineag beta 1) * Copyright (C) 2006-2008 Dan Fuhry * * This program is Free Software; you can redistribute and/or modify it under the terms of the GNU General Public License diff -r 9cdfe82c56cd -r eb8b23f11744 plugins/SpecialAdmin.php --- a/plugins/SpecialAdmin.php Sat Jan 03 18:11:18 2009 -0500 +++ b/plugins/SpecialAdmin.php Sun Jan 04 00:55:40 2009 -0500 @@ -12,7 +12,7 @@ /* * Enano - an open-source CMS capable of wiki functions, Drupal-like sidebar blocks, and everything in between - * Version 1.1.5 (Caoineag alpha 5) + * Version 1.1.6 (Caoineag beta 1) * Copyright (C) 2006-2008 Dan Fuhry * * This program is Free Software; you can redistribute and/or modify it under the terms of the GNU General Public License diff -r 9cdfe82c56cd -r eb8b23f11744 plugins/SpecialCSS.php --- a/plugins/SpecialCSS.php Sat Jan 03 18:11:18 2009 -0500 +++ b/plugins/SpecialCSS.php Sun Jan 04 00:55:40 2009 -0500 @@ -12,7 +12,7 @@ /* * Enano - an open-source CMS capable of wiki functions, Drupal-like sidebar blocks, and everything in between - * Version 1.1.5 (Caoineag alpha 5) + * Version 1.1.6 (Caoineag beta 1) * Copyright (C) 2006-2008 Dan Fuhry * * This program is Free Software; you can redistribute and/or modify it under the terms of the GNU General Public License diff -r 9cdfe82c56cd -r eb8b23f11744 plugins/SpecialGroups.php --- a/plugins/SpecialGroups.php Sat Jan 03 18:11:18 2009 -0500 +++ b/plugins/SpecialGroups.php Sun Jan 04 00:55:40 2009 -0500 @@ -12,7 +12,7 @@ /* * Enano - an open-source CMS capable of wiki functions, Drupal-like sidebar blocks, and everything in between - * Version 1.1.5 (Caoineag alpha 5) + * Version 1.1.6 (Caoineag beta 1) * Copyright (C) 2007 Dan Fuhry * * This program is Free Software; you can redistribute and/or modify it under the terms of the GNU General Public License diff -r 9cdfe82c56cd -r eb8b23f11744 plugins/SpecialPageFuncs.php --- a/plugins/SpecialPageFuncs.php Sat Jan 03 18:11:18 2009 -0500 +++ b/plugins/SpecialPageFuncs.php Sun Jan 04 00:55:40 2009 -0500 @@ -12,7 +12,7 @@ /* * Enano - an open-source CMS capable of wiki functions, Drupal-like sidebar blocks, and everything in between - * Version 1.1.5 (Caoineag alpha 5) + * Version 1.1.6 (Caoineag beta 1) * Copyright (C) 2006-2008 Dan Fuhry * * This program is Free Software; you can redistribute and/or modify it under the terms of the GNU General Public License diff -r 9cdfe82c56cd -r eb8b23f11744 plugins/SpecialRecentChanges.php --- a/plugins/SpecialRecentChanges.php Sat Jan 03 18:11:18 2009 -0500 +++ b/plugins/SpecialRecentChanges.php Sun Jan 04 00:55:40 2009 -0500 @@ -12,7 +12,7 @@ /* * Enano - an open-source CMS capable of wiki functions, Drupal-like sidebar blocks, and everything in between - * Version 1.1.5 (Caoineag alpha 5) + * Version 1.1.6 (Caoineag beta 1) * Copyright (C) 2006-2008 Dan Fuhry * * This program is Free Software; you can redistribute and/or modify it under the terms of the GNU General Public License diff -r 9cdfe82c56cd -r eb8b23f11744 plugins/SpecialSearch.php --- a/plugins/SpecialSearch.php Sat Jan 03 18:11:18 2009 -0500 +++ b/plugins/SpecialSearch.php Sun Jan 04 00:55:40 2009 -0500 @@ -12,7 +12,7 @@ /* * Enano - an open-source CMS capable of wiki functions, Drupal-like sidebar blocks, and everything in between - * Version 1.1.5 (Caoineag alpha 5) + * Version 1.1.6 (Caoineag beta 1) * Copyright (C) 2006-2008 Dan Fuhry * * This program is Free Software; you can redistribute and/or modify it under the terms of the GNU General Public License diff -r 9cdfe82c56cd -r eb8b23f11744 plugins/SpecialUpdownload.php --- a/plugins/SpecialUpdownload.php Sat Jan 03 18:11:18 2009 -0500 +++ b/plugins/SpecialUpdownload.php Sun Jan 04 00:55:40 2009 -0500 @@ -12,7 +12,7 @@ /* * Enano - an open-source CMS capable of wiki functions, Drupal-like sidebar blocks, and everything in between - * Version 1.1.5 (Caoineag alpha 5) + * Version 1.1.6 (Caoineag beta 1) * Copyright (C) 2006-2008 Dan Fuhry * SpecialUpdownload.php - handles uploading and downloading of user-uploaded files - possibly the most rigorously security-enforcing script in all of Enano, although sessions.php comes in a close second * diff -r 9cdfe82c56cd -r eb8b23f11744 plugins/SpecialUserFuncs.php --- a/plugins/SpecialUserFuncs.php Sat Jan 03 18:11:18 2009 -0500 +++ b/plugins/SpecialUserFuncs.php Sun Jan 04 00:55:40 2009 -0500 @@ -12,7 +12,7 @@ /* * Enano - an open-source CMS capable of wiki functions, Drupal-like sidebar blocks, and everything in between - * Version 1.1.5 (Caoineag alpha 5) + * Version 1.1.6 (Caoineag beta 1) * Copyright (C) 2006-2008 Dan Fuhry * * This program is Free Software; you can redistribute and/or modify it under the terms of the GNU General Public License @@ -121,12 +121,6 @@ global $__login_status; global $lang; - require_once( ENANO_ROOT . '/includes/diffiehellman.php' ); - global $dh_supported, $_math; - - $pubkey = $session->rijndael_genkey(); - $challenge = $session->dss_rand(); - $locked_out = false; // are we locked out? $threshold = ( $_ = getConfig('lockout_threshold') ) ? intval($_) : 5; @@ -436,10 +430,6 @@ - - - - str($dh_key_priv); - $dh_key_pub = $_math->str($dh_key_pub); - // store the keys in the DB - $q = $db->sql_query('INSERT INTO ' . table_prefix . "diffiehellman( public_key, private_key ) VALUES ( '$dh_key_pub', '$dh_key_priv' );"); - if ( !$q ) - $db->_die(); - - echo " - - "; - } - else - { - echo ""; - } + echo $session->generate_aes_form(); ?> aes_javascript('loginform', 'pass', 'use_crypt', 'crypt_key', 'crypt_data', 'challenge_data', 'dh_supported', 'dh_public_key', 'dh_client_public_key'); + echo $session->aes_javascript('loginform', 'pass'); ?> footer(); @@ -516,93 +483,28 @@ } if ( isset($_GET['act']) && $_GET['act'] == 'ajaxlogin' ) { - echo 'This version of the Enano LoginAPI is deprecated. Please use the action.json method instead.'; + echo 'This version of the Enano LoginAPI is deprecated. Please clear your browser\'s cache and try your login again. Developers, please use the action.json method instead.'; return true; } if(isset($_POST['login'])) { $captcha_hash = ( isset($_POST['captcha_hash']) ) ? $_POST['captcha_hash'] : false; $captcha_code = ( isset($_POST['captcha_code']) ) ? $_POST['captcha_code'] : false; - if ( $_POST['use_crypt'] == 'yes' ) + + try { - $result = $session->login_with_crypto($_POST['username'], $_POST['crypt_data'], $_POST['crypt_key'], $_POST['challenge_data'], intval($_POST['auth_level']), $captcha_hash, $captcha_code, isset($_POST['remember'])); + $password = $session->get_aes_post('pass'); } - else if ( $_POST['use_crypt'] == 'yes_dh' ) + catch ( Exception $e ) { - // retrieve and decrypt the password using DiffieHellman - - require_once( ENANO_ROOT . '/includes/diffiehellman.php' ); - global $dh_supported, $_math; - - if ( !$dh_supported ) - { - die_semicritical('DiffieHellman error', 'Server does not support DiffieHellman, denying logon request'); - } - - // Fetch private key - $dh_public = $_POST['dh_public_key']; - if ( !preg_match('/^[0-9]+$/', $dh_public) ) - { - $__login_status = array( - 'success' => false, - 'error' => 'ERR_DH_KEY_NOT_INTEGER', - 'debug' => "public key: $dh_public" - ); - return false; - } - $q = $db->sql_query('SELECT private_key, key_id FROM ' . table_prefix . "diffiehellman WHERE public_key = '$dh_public';"); - if ( !$q ) - $db->die_json(); - - if ( $db->numrows() < 1 ) - { - $__login_status = array( - 'success' => false, - 'error' => 'ERR_DH_KEY_NOT_FOUND', - 'debug' => "public key: $dh_public" - ); - return false; - } - - list($dh_private, $dh_key_id) = $db->fetchrow_num(); - $db->free_result(); - - // We have the private key, now delete the key pair, we no longer need it - $q = $db->sql_query('DELETE FROM ' . table_prefix . "diffiehellman WHERE key_id = $dh_key_id;"); - if ( !$q ) - $db->die_json(); - - // Generate the shared secret - $dh_secret = dh_gen_shared_secret($dh_private, $_POST['dh_client_public_key']); - $dh_secret = $_math->str($dh_secret); - - // Did we get all our math right? - $dh_secret_check = sha1($dh_secret); - $dh_hash = $_POST['crypt_key']; - if ( $dh_secret_check !== $dh_hash ) - { - $__login_status = array( - 'success' => false, - 'error' => 'ERR_DH_HASH_NO_MATCH', - 'debug' => "dh_secret_check = $dh_secret_check\ndh_hash_input = $dh_hash" - ); - return false; - } - - // All good! Generate the AES key - $aes_key = substr(sha256($dh_secret), 0, ( AES_BITS / 4 )); - - // decrypt user info - $aes_key = hexdecode($aes_key); - $aes = AESCrypt::singleton(AES_BITS, AES_BLOCKSIZE); - $password = $aes->decrypt($_POST['crypt_data'], $aes_key, ENC_HEX); - - $result = $session->login_without_crypto($_POST['username'], $password, false, intval($_POST['auth_level']), $captcha_hash, $captcha_code, isset($_POST['remember'])); + $__login_status = array( + 'mode' => 'error', + 'error' => $e->getMessage() + ); + return false; } - else - { - $result = $session->login_without_crypto($_POST['username'], $_POST['pass'], false, intval($_POST['auth_level']), $captcha_hash, $captcha_code, isset($_POST['remember'])); - } + + $result = $session->login_without_crypto($_POST['username'], $password, false, intval($_POST['auth_level']), $captcha_hash, $captcha_code, isset($_POST['remember'])); if($result['success']) { @@ -1598,6 +1500,9 @@ $template->header(); if($paths->getParam(0) == 'stage2') { + require_once(ENANO_ROOT . '/includes/math.php'); + require_once(ENANO_ROOT . '/includes/diffiehellman.php'); + $user_id = intval($paths->getParam(1)); $encpass = $paths->getParam(2); if ( $user_id < 2 ) @@ -1613,7 +1518,7 @@ return false; } - $q = $db->sql_query('SELECT username,temp_password_time FROM '.table_prefix.'users WHERE user_id='.$user_id.' AND temp_password=\'' . $encpass . '\';'); + $q = $db->sql_query('SELECT username,temp_password_time,temp_password,password_salt FROM '.table_prefix.'users WHERE user_id='.$user_id.';'); if($db->numrows() < 1) { echo 'Invalid credentials
'; @@ -1623,6 +1528,16 @@ $row = $db->fetchrow(); $db->free_result(); + $temp_pass = $session->pk_decrypt($encpass); + $temp_hmac = hmac_sha1($temp_pass, $row['password_salt']); + + if ( $temp_hmac !== $row['temp_password'] ) + { + echo 'Invalid credentials
'; + $template->footer(); + return false; + } + if ( ( intval($row['temp_password_time']) + ( 3600 * 24 ) ) < time() ) { echo '' . $lang->get('userfuncs_passreset_err_pass_expired', array('reset_url' => makeUrlNS('Special', 'PasswordReset'))) . '
'; @@ -1632,48 +1547,29 @@ if ( isset($_POST['do_stage2']) ) { - $aes = AESCrypt::singleton(AES_BITS, AES_BLOCKSIZE); - if($_POST['use_crypt'] == 'yes') - { - $crypt_key = $session->fetch_public_key($_POST['crypt_key']); - if(!$crypt_key) - { - echo $lang->get('user_err_key_not_found'); - $template->footer(); - return false; - } - $crypt_key = hexdecode($crypt_key); - $data = $aes->decrypt($_POST['crypt_data'], $crypt_key, ENC_HEX); - if(strlen($data) < 6) - { - echo $lang->get('userfuncs_passreset_err_too_short'); - $template->footer(); - return false; - } - } - else - { - $data = $_POST['pass']; - $conf = $_POST['pass_confirm']; - if($data != $conf) - { - echo $lang->get('userfuncs_passreset_err_no_match'); - $template->footer(); - return false; - } - if(strlen($data) < 6) - { - echo $lang->get('userfuncs_passreset_err_too_short'); - $template->footer(); - return false; - } - } + $data = $session->get_aes_post('pass'); + if(empty($data)) { echo 'ERROR: Sanity check failed!'; $template->footer(); return false; } + if ( strlen($data) < 6 ) + { + echo '' . $lang->get('userfuncs_passreset_err_too_short') . '
'; + $template->footer(); + return false; + } + if ( $_POST['use_crypt'] == 'no' ) + { + if ( $_POST['pass'] !== $_POST['pass_confirm'] ) + { + echo '' . $lang->get('userfuncs_passreset_err_no_match') . '
'; + $template->footer(); + return false; + } + } if ( getConfig('pw_strength_enable') == '1' ) { $min_score = intval(getConfig('pw_strength_minimum')); @@ -1686,8 +1582,10 @@ return false; } } - $encpass = $session->pk_encrypt($data, ENC_HEX); - $q = $db->sql_query('UPDATE '.table_prefix.'users SET password=\'' . $encpass . '\',temp_password=\'\',temp_password_time=0 WHERE user_id='.$user_id.';'); + + $session->set_password($user_id, $data); + + $q = $db->sql_query('UPDATE '.table_prefix.'users SET temp_password=\'\',temp_password_time=0 WHERE user_id = '.$user_id.';'); if($q) { @@ -1704,10 +1602,8 @@ } // Password reset form - $pubkey = $session->rijndael_genkey(); - $evt_get_score = ( getConfig('pw_strength_enable') == '1' ) ? 'onkeyup="password_score_field(this);" ' : ''; - $pw_meter = ( getConfig('pw_strength_enable') == '1' ) ? '| @@ -1346,26 +1269,7 @@ } $form_action = makeUrlNS('Special', 'Administration', 'module=' . $paths->cpage['module'], true); - $aes_javascript = $session->aes_javascript("useredit_$this->uuid", 'new_password', 'use_crypt', 'crypt_key', 'crypt_data', 'challenge_data', 'dh_supported', 'dh_public', 'dh_mypublic'); - - // FIXME should this be in logic rather than presentation code? - if ( $dh_supported ) - { - global $_math; - - $dh_key_priv = dh_gen_private(); - $dh_key_pub = dh_gen_public($dh_key_priv); - $dh_key_priv = $_math->str($dh_key_priv); - $dh_key_pub = $_math->str($dh_key_pub); - // store the keys in the DB for later fetching - $q = $db->sql_query('INSERT INTO ' . table_prefix . "diffiehellman( public_key, private_key ) VALUES ( '$dh_key_pub', '$dh_key_priv' );"); - if ( !$q ) - $db->_die(); - } - else - { - $dh_key_pub = ''; - } + $aes_javascript = $session->aes_javascript("useredit_$this->uuid", 'new_password'); // build rank list $q = $db->sql_query('SELECT rank_id, rank_title FROM ' . table_prefix . 'ranks'); @@ -1382,10 +1286,7 @@ 'USERNAME' => $this->username, 'EMAIL' => $this->email, 'USER_ID' => $this->user_id, - 'MD5_CHALLENGE' => $session->dss_rand(), - 'PUBLIC_KEY' => $session->rijndael_genkey(), - 'DH_SUPPORTED' => ( $dh_supported ? 'true' : 'false' ), - 'DH_PUBLIC' => $dh_key_pub, + 'AES_FORM' => $session->generate_aes_form(), 'REAL_NAME' => $this->real_name, 'SIGNATURE_FIELD' => $template->tinymce_textarea('signature', $this->signature, 10, 50), 'USER_TITLE' => $this->user_title, diff -r 9cdfe82c56cd -r eb8b23f11744 plugins/admin/UserRanks.php --- a/plugins/admin/UserRanks.php Sat Jan 03 18:11:18 2009 -0500 +++ b/plugins/admin/UserRanks.php Sun Jan 04 00:55:40 2009 -0500 @@ -2,7 +2,7 @@ /* * Enano - an open-source CMS capable of wiki functions, Drupal-like sidebar blocks, and everything in between - * Version 1.1.5 (Caoineag alpha 5) + * Version 1.1.6 (Caoineag beta 1) * Copyright (C) 2006-2008 Dan Fuhry * * This program is Free Software; you can redistribute and/or modify it under the terms of the GNU General Public License |