# HG changeset patch # User Dan # Date 1192931053 14400 # Node ID ebe99e82a59ac6e1518c189302a0333f42bd6b0b # Parent 9dbbec5e6096c6a3b18db93cf8be1682db5d2f48# Parent 9237767a23ae2181da59467ef6f4bd7e96396722 Merging in changes from stable diff -r 9237767a23ae -r ebe99e82a59a .hgtags --- a/.hgtags Sat Oct 20 11:11:40 2007 -0400 +++ b/.hgtags Sat Oct 20 21:44:13 2007 -0400 @@ -5,3 +5,4 @@ 6f0bbf88c3251ca597cb76ac8b59a1ee61d6dd3d rebrand 0b5244001799fa29e83bf06c5f14eb69350f171c rebrand 42c6c83b8a004163c9cc2d85f3c8eada3b73adf6 rebrand +d53cc29308f4f4b97fc6d054e9e0855f37137409 rebrand diff -r 9237767a23ae -r ebe99e82a59a ajax.php --- a/ajax.php Sat Oct 20 11:11:40 2007 -0400 +++ b/ajax.php Sat Oct 20 21:44:13 2007 -0400 @@ -2,7 +2,7 @@ /* * Enano - an open-source CMS capable of wiki functions, Drupal-like sidebar blocks, and everything in between - * Version 1.0.2 (Coblynau) + * Version 1.1.1 * Copyright (C) 2006-2007 Dan Fuhry * * This program is Free Software; you can redistribute and/or modify it under the terms of the GNU General Public License @@ -33,50 +33,35 @@ define('ENANO_ROOT', dirname($filename)); require(ENANO_ROOT.'/includes/functions.php'); require(ENANO_ROOT.'/includes/dbal.php'); - require(ENANO_ROOT.'/includes/json.php'); $db = new mysql(); $db->connect(); - // result is sent using JSON - $json = new Services_JSON(SERVICES_JSON_LOOSE_TYPE); - $return = Array( - 'mode' => 'success', - 'users_real' => Array() - ); - - // should be connected to the DB now + // should be connected now $name = (isset($_GET['name'])) ? $db->escape($_GET['name']) : false; if ( !$name ) { - $return = array( - 'mode' => 'error', - 'error' => 'Invalid URI' - ); - die( $json->encode($return) ); + die('userlist = new Array(); errorstring=\'Invalid URI\''); } - $allowanon = ( isset($_GET['allowanon']) && $_GET['allowanon'] == '1' ) ? '' : ' AND user_id > 1'; - $q = $db->sql_query('SELECT username FROM '.table_prefix.'users WHERE lcase(username) LIKE lcase(\'%'.$name.'%\')' . $allowanon . ' ORDER BY username ASC;'); + $q = $db->sql_query('SELECT username,user_id FROM '.table_prefix.'users WHERE lcase(username) LIKE lcase(\'%'.$name.'%\');'); if ( !$q ) { - $return = array( - 'mode' => 'error', - 'error' => 'MySQL error selecting username data: '.addslashes(mysql_error()) - ); - die( $json->encode($return) ); + die('userlist = new Array(); errorstring=\'MySQL error selecting username data: '.addslashes(mysql_error()).'\''); } + if($db->numrows() < 1) + { + die('userlist = new Array(); errorstring=\'No usernames found\';'); + } + echo 'var errorstring = false; userlist = new Array();'; $i = 0; while($r = $db->fetchrow()) { - $return['users_real'][] = $r['username']; + echo "userlist[$i] = '".addslashes($r['username'])."'; "; $i++; } $db->free_result(); // all done! :-) $db->close(); - - echo $json->encode( $return ); - exit; } diff -r 9237767a23ae -r ebe99e82a59a includes/captcha.php --- a/includes/captcha.php Sat Oct 20 11:11:40 2007 -0400 +++ b/includes/captcha.php Sat Oct 20 21:44:13 2007 -0400 @@ -1,7 +1,8 @@
For security reasons, Enano mandates that high-privilege logins last only 15 minutes, with the time being reset each time a page is loaded (or, more specifically, each time the session API is started). The consequence of this is that if you are performing an action in the administration panel that takes more than 15 minutes, your session may be terminated. The keep-alive feature attempts to relieve this by sending a "ping" to the server every 10 minutes.

Please note that keep-alive state is determined by a cookie. Thus, if you log out and then back in as a different administrator, keep-alive will use the same setting that was used when you were logged in as the first administrative user. In the same way, if you log into the administration panel under your account from another computer, keep-alive will be set to "off".

For more information:
Overview of Enano'+"'"+'s security model'); } +function ajaxShowCaptcha(code) +{ + var mydiv = document.createElement('div'); + mydiv.style.backgroundColor = '#FFFFFF'; + mydiv.style.padding = '10px'; + mydiv.style.position = 'absolute'; + mydiv.style.top = '0px'; + mydiv.id = 'autoCaptcha'; + var img = document.createElement('img'); + img.onload = function() + { + if ( this.loaded ) + return true; + var mydiv = document.getElementById('autoCaptcha'); + var width = getWidth(); + var divw = $(mydiv).Width(); + var left = ( width / 2 ) - ( divw / 2 ); + mydiv.style.left = left + 'px'; + fly_in_top(mydiv, false, true); + this.loaded = true; + }; + img.src = makeUrlNS('Special', 'Captcha/' + code); + img.onclick = function() { this.src = this.src + '/a'; }; + img.style.cursor = 'pointer'; + mydiv.appendChild(img); + domObjChangeOpac(0, mydiv); + var body = document.getElementsByTagName('body')[0]; + body.appendChild(mydiv); +} + diff -r 9237767a23ae -r ebe99e82a59a includes/clientside/static/misc.js --- a/includes/clientside/static/misc.js Sat Oct 20 11:11:40 2007 -0400 +++ b/includes/clientside/static/misc.js Sat Oct 20 21:44:13 2007 -0400 @@ -302,6 +302,51 @@ var ajax_auth_mb_cache = false; var ajax_auth_level_cache = false; var ajax_auth_error_string = false; +var ajax_auth_show_captcha = false; + +function ajaxAuthErrorToString($data) +{ + var $errstring = $data.error; + // this was literally copied straight from the PHP code. + switch($data.error) + { + case 'key_not_found': + $errstring = 'Enano couldn\'t look up the encryption key used to encrypt your password. This most often happens if a cache rotation occurred during your login attempt, or if you refreshed the login page.'; + break; + case 'key_wrong_length': + $errstring = 'The encryption key was the wrong length.'; + break; + case 'too_big_for_britches': + $errstring = 'You are trying to authenticate at a level that your user account does not permit.'; + break; + case 'invalid_credentials': + $errstring = 'You have entered an invalid username or password. Please enter your login details again.'; + if ( $data.lockout_policy == 'lockout' ) + { + $errstring += ' You have used up '+$data['lockout_fails']+' out of '+$data['lockout_threshold']+' login attempts. After you have used up all '+$data['lockout_threshold']+' login attempts, you will be locked out from logging in for '+$data['lockout_duration']+' minutes.'; + } + else if ( $data.lockout_policy == 'captcha' ) + { + $errstring += ' You have used up '+$data['lockout_fails']+' out of '+$data['lockout_threshold']+' login attempts. After you have used up all '+$data['lockout_threshold']+' login attempts, you will have to enter a visual confirmation code before logging in, effective for '+$data['lockout_duration']+' minutes.'; + } + break; + case 'backend_fail': + $errstring = 'You entered the right credentials and everything was validated, but for some reason Enano couldn\'t register your session. This is an internal problem with the site and you are encouraged to contact site administration.'; + break; + case 'locked_out': + $attempts = parseInt($data['lockout_fails']); + if ( $attempts > $data['lockout_threshold']) + $attempts = $data['lockout_threshold']; + $time_rem = $data.time_rem; + $s = ( $time_rem == 1 ) ? '' : 's'; + $errstring = "You have used up all "+$data['lockout_threshold']+" allowed login attempts. Please wait "+$time_rem+" minute"+$s+" before attempting to log in again"; + if ( $data['lockout_policy'] == 'captcha' ) + $errstring += ', or enter the visual confirmation code shown above in the appropriate box'; + $errstring += '.'; + break; + } + return $errstring; +} function ajaxPromptAdminAuth(call_on_ok, level) { @@ -320,6 +365,17 @@ var title = ( level > USER_LEVEL_MEMBER ) ? 'You are requesting a sensitive operation.' : 'Please enter your username and password to continue.'; ajax_auth_mb_cache = new messagebox(MB_OKCANCEL|MB_ICONLOCK, title, loading_win); ajax_auth_mb_cache.onbeforeclick['OK'] = ajaxValidateLogin; + ajax_auth_mb_cache.onbeforeclick['Cancel'] = function() + { + if ( document.getElementById('autoCaptcha') ) + { + var to = fly_out_top(document.getElementById('autoCaptcha'), false, true); + setTimeout(function() { + var d = document.getElementById('autoCaptcha'); + d.parentNode.removeChild(d); + }, to); + } + } ajaxAuthLoginInnerSetup(); } @@ -335,6 +391,20 @@ return false; } response = parseJSON(response); + var disable_controls = false; + if ( response.locked_out && !ajax_auth_error_string ) + { + response.error = 'locked_out'; + ajax_auth_error_string = ajaxAuthErrorToString(response); + if ( response.lockout_policy == 'captcha' ) + { + ajax_auth_show_captcha = response.captcha; + } + else + { + disable_controls = true; + } + } var level = ajax_auth_level_cache; var form_html = ''; var shown_error = false; @@ -348,14 +418,28 @@ { form_html += 'Please re-enter your login details, to verify your identity.

'; } + if ( ajax_auth_show_captcha ) + { + var captcha_html = ' \ + \ + Code in image: \ + \ + '; + } + else + { + var captcha_html = ''; + } + var disableme = ( disable_controls ) ? 'disabled="disabled" ' : ''; form_html += ' \ \ \ - \ \ - \ + ' + captcha_html + ' \ \ + + + + + + + + + + + + + + + + + + + + + + + @@ -2685,7 +2732,7 @@ } else { - echo '
Please wait while the administration panel loads. You need to be using a recent browser with AJAX support in order to use Runt.
'; + echo ''; } ?> @@ -2979,7 +3026,7 @@ echo '
$_GET[\'side\'] contained an SQL injection attempt
'; break; } - $query = $db->sql_query('UPDATE '.table_prefix.'sidebar SET sidebar_id=' . $db->escape($_GET['side']) . ' WHERE item_id=' . intval($_GET['id']) . ';'); + $query = $db->sql_query('UPDATE '.table_prefix.'sidebar SET sidebar_id=' . $db->escape($_GET['side']) . ' WHERE item_id=' . $db->escape($_GET['id']) . ';'); if(!$query) { echo $db->get_error(); @@ -2989,7 +3036,7 @@ echo '
Item moved.
'; break; case 'delete': - $query = $db->sql_query('DELETE FROM '.table_prefix.'sidebar WHERE item_id=' . intval($_GET['id']) . ';'); // Already checked for injection attempts ;-) + $query = $db->sql_query('DELETE FROM '.table_prefix.'sidebar WHERE item_id=' . $db->escape($_GET['id']) . ';'); // Already checked for injection attempts ;-) if(!$query) { echo $db->get_error(); @@ -3004,7 +3051,7 @@ echo '
Item deleted.
'; break; case 'disenable'; - $q = $db->sql_query('SELECT item_enabled FROM '.table_prefix.'sidebar WHERE item_id=' . intval($_GET['id']) . ';'); + $q = $db->sql_query('SELECT item_enabled FROM '.table_prefix.'sidebar WHERE item_id=' . $db->escape($_GET['id']) . ';'); if(!$q) { echo $db->get_error(); @@ -3014,22 +3061,7 @@ $r = $db->fetchrow(); $db->free_result(); $e = ( $r['item_enabled'] == 1 ) ? '0' : '1'; - $q = $db->sql_query('UPDATE '.table_prefix.'sidebar SET item_enabled='.$e.' WHERE item_id=' . intval($_GET['id']) . ';'); - if(!$q) - { - echo $db->get_error(); - $template->footer(); - exit; - } - if(isset($_GET['ajax'])) - { - ob_end_clean(); - die('GOOD'); - } - break; - case 'rename'; - $newname = $db->escape($_POST['newname']); - $q = $db->sql_query('UPDATE '.table_prefix.'sidebar SET block_name=\''.$newname.'\' WHERE item_id=' . intval($_GET['id']) . ';'); + $q = $db->sql_query('UPDATE '.table_prefix.'sidebar SET item_enabled='.$e.' WHERE item_id=' . $db->escape($_GET['id']) . ';'); if(!$q) { echo $db->get_error(); @@ -3043,7 +3075,7 @@ } break; case 'getsource': - $q = $db->sql_query('SELECT block_content,block_type FROM '.table_prefix.'sidebar WHERE item_id=' . intval($_GET['id']) . ';'); + $q = $db->sql_query('SELECT block_content,block_type FROM '.table_prefix.'sidebar WHERE item_id=' . $db->escape($_GET['id']) . ';'); if(!$q) { echo $db->get_error(); @@ -3059,7 +3091,7 @@ case 'save': if ( defined('ENANO_DEMO_MODE') ) { - $q = $db->sql_query('SELECT block_type FROM '.table_prefix.'sidebar WHERE item_id=' . intval($_GET['id']) . ';'); + $q = $db->sql_query('SELECT block_type FROM '.table_prefix.'sidebar WHERE item_id=' . $db->escape($_GET['id']) . ';'); if(!$q) { echo 'var status=unescape(\''.hexencode($db->get_error()).'\');'; @@ -3075,13 +3107,13 @@ $_POST['content'] = sanitize_html($_POST['content'], true); } } - $q = $db->sql_query('UPDATE '.table_prefix.'sidebar SET block_content=\''.$db->escape(rawurldecode($_POST['content'])).'\' WHERE item_id=' . intval($_GET['id']) . ';'); + $q = $db->sql_query('UPDATE '.table_prefix.'sidebar SET block_content=\''.$db->escape(rawurldecode($_POST['content'])).'\' WHERE item_id=' . $db->escape($_GET['id']) . ';'); if(!$q) { echo 'var status=unescape(\''.hexencode($db->get_error()).'\');'; exit; } - $q = $db->sql_query('SELECT block_type,block_content FROM '.table_prefix.'sidebar WHERE item_id=' . intval($_GET['id']) . ';'); + $q = $db->sql_query('SELECT block_type,block_content FROM '.table_prefix.'sidebar WHERE item_id=' . $db->escape($_GET['id']) . ';'); if(!$q) { echo 'var status=unescape(\''.hexencode($db->get_error()).'\');'; @@ -3173,8 +3205,6 @@ $parser = $template->makeParserText($vars['sidebar_section']); $c = $template->tplWikiFormat($row['block_content'], false, 'sidebar-editor.tpl'); $c = preg_replace('#(.*?)#is', '\\2', $c); - // fix for the "Administration" link that somehow didn't get rendered properly - $c = preg_replace("/(^|\n)([ ]*)(.+)<\/a>()([\r\n]+|$)/isU", '\\1\\2
  • \\4
    • \\7', $c); break; case BLOCK_HTML: $parser = $template->makeParserText($vars['sidebar_section_raw']); @@ -3194,7 +3224,7 @@ $c = ($template->fetch_block($row['block_content'])) ? $template->fetch_block($row['block_content']) : 'Can\'t find plugin block'; break; } - $t = '' . $template->tplWikiFormat($row['block_name']) . ''; + $t = $template->tplWikiFormat($row['block_name']); if($row['item_enabled'] == 0) $t .= ' (disabled)'; else $t .= ' '; $side = ( $row['sidebar_id'] == SIDEBAR_LEFT ) ? SIDEBAR_RIGHT : SIDEBAR_LEFT; diff -r 9237767a23ae -r ebe99e82a59a plugins/SpecialUserFuncs.php --- a/plugins/SpecialUserFuncs.php Sat Oct 20 11:11:40 2007 -0400 +++ b/plugins/SpecialUserFuncs.php Sat Oct 20 21:44:13 2007 -0400 @@ -4,13 +4,13 @@ Plugin URI: http://enanocms.org/ Description: Provides the pages Special:Login, Special:Logout, Special:Register, and Special:Preferences. Author: Dan Fuhry -Version: 1.0.2 +Version: 1.0.1 Author URI: http://enanocms.org/ */ /* * Enano - an open-source CMS capable of wiki functions, Drupal-like sidebar blocks, and everything in between - * Version 1.0.2 + * Version 1.0 release candidate 2 * Copyright (C) 2006-2007 Dan Fuhry * * This program is Free Software; you can redistribute and/or modify it under the terms of the GNU General Public License @@ -104,14 +104,60 @@ $pubkey = $session->rijndael_genkey(); $challenge = $session->dss_rand(); + $locked_out = false; + // are we locked out? + $threshold = ( $_ = getConfig('lockout_threshold') ) ? intval($_) : 5; + $duration = ( $_ = getConfig('lockout_duration') ) ? intval($_) : 15; + // convert to minutes + $duration = $duration * 60; + $policy = ( $x = getConfig('lockout_policy') && in_array(getConfig('lockout_policy'), array('lockout', 'disable', 'captcha')) ) ? getConfig('lockout_policy') : 'lockout'; + if ( $policy != 'disable' ) + { + $ipaddr = $db->escape($_SERVER['REMOTE_ADDR']); + $timestamp_cutoff = time() - $duration; + $q = $session->sql('SELECT timestamp FROM '.table_prefix.'lockout WHERE timestamp > ' . $timestamp_cutoff . ' AND ipaddr = \'' . $ipaddr . '\' ORDER BY timestamp DESC;'); + $fails = $db->numrows(); + if ( $fails >= $threshold ) + { + $row = $db->fetchrow(); + $locked_out = true; + $lockdata = array( + 'locked_out' => true, + 'lockout_threshold' => $threshold, + 'lockout_duration' => ( $duration / 60 ), + 'lockout_fails' => $fails, + 'lockout_policy' => $policy, + 'lockout_last_time' => $row['timestamp'], + 'time_rem' => ( $duration / 60 ) - round( ( time() - $row['timestamp'] ) / 60 ), + 'captcha' => '' + ); + if ( $policy == 'captcha' ) + { + $lockdata['captcha'] = $session->make_captcha(); + } + } + $db->free_result(); + } + if ( isset($_GET['act']) && $_GET['act'] == 'getkey' ) { $username = ( $session->user_logged_in ) ? $session->username : false; $response = Array( 'username' => $username, 'key' => $pubkey, - 'challenge' => $challenge + 'challenge' => $challenge, + 'locked_out' => false ); + + if ( $locked_out ) + { + foreach ( $lockdata as $x => $y ) + { + $response[$x] = $y; + } + unset($x, $y); + } + $json = new Services_JSON(SERVICES_JSON_LOOSE_TYPE); $response = $json->encode($response); echo $response; @@ -138,7 +184,48 @@ $header = ( $level > USER_LEVEL_MEMBER ) ? 'Please re-enter your login details' : 'Please enter your username and password to log in.'; if ( isset($_POST['login']) ) { - echo '

    '.$__login_status.'

    '; + $errstring = $__login_status['error']; + switch($__login_status['error']) + { + case 'key_not_found': + $errstring = 'Enano couldn\'t look up the encryption key used to encrypt your password. This most often happens if a cache rotation occurred during your login attempt, or if you refreshed the login page.'; + break; + case 'key_wrong_length': + $errstring = 'The encryption key was the wrong length.'; + break; + case 'too_big_for_britches': + $errstring = 'You are trying to authenticate at a level that your user account does not permit.'; + break; + case 'invalid_credentials': + $errstring = 'You have entered an invalid username or password. Please enter your login details again.'; + if ( $__login_status['lockout_policy'] == 'lockout' ) + { + $errstring .= ' You have used up '.$__login_status['lockout_fails'].' out of '.$__login_status['lockout_threshold'].' login attempts. After you have used up all '.$data['lockout_threshold'].' login attempts, you will be locked out from logging in for '.$__login_status['lockout_duration'].' minutes.'; + } + else if ( $__login_status['lockout_policy'] == 'captcha' ) + { + $errstring .= ' You have used up '.$__login_status['lockout_fails'].' out of '.$__login_status['lockout_threshold'].' login attempts. After you have used up all '.$data['lockout_threshold'].' login attempts, you will have to enter a visual confirmation code before logging in, effective for '.$__login_status['lockout_duration'].' minutes.'; + } + break; + case 'backend_fail': + $errstring = 'You entered the right credentials and everything was validated, but for some reason Enano couldn\'t register your session. This is an internal problem with the site and you are encouraged to contact site administration.'; + break; + case 'locked_out': + $attempts = intval($__login_status['lockout_fails']); + if ( $attempts > $__login_status['lockout_threshold']) + $attempts = $__login_status['lockout_threshold']; + + $server_time = time(); + $time_rem = $__login_status['lockout_duration'] - round( ( $server_time - $__login_status['lockout_last_time'] ) / 60 ); + + $s = ( $time_rem == 1 ) ? '' : 's'; + $errstring = "You have used up all {$__login_status['lockout_threshold']} allowed login attempts. Please wait {$time_rem} minute$s before attempting to log in again"; + if ( $__login_status['lockout_policy'] == 'captcha' ) + $errstring .= ', or enter the visual confirmation code shown above in the appropriate box'; + $errstring .= '.'; + break; + } + echo '
    '.$errstring.'
    '; } if ( $p = $paths->getAllParams() ) { @@ -189,7 +276,7 @@ ?> /> -     @@ -198,6 +285,21 @@ + + + + + + + + '; break; - case PAGE_GRP_REGEX: - echo ' - - - '; - break; case PAGE_GRP_CATLINK: // Build category list diff -r 9237767a23ae -r ebe99e82a59a plugins/admin/SecurityLog.php --- a/plugins/admin/SecurityLog.php Sat Oct 20 11:11:40 2007 -0400 +++ b/plugins/admin/SecurityLog.php Sat Oct 20 21:44:13 2007 -0400 @@ -2,7 +2,7 @@ /* * Enano - an open-source CMS capable of wiki functions, Drupal-like sidebar blocks, and everything in between - * Version 1.0.2 (Coblynau) + * Version 1.1.1 * Copyright (C) 2006-2007 Dan Fuhry * * This program is Free Software; you can redistribute and/or modify it under the terms of the GNU General Public License diff -r 9237767a23ae -r ebe99e82a59a plugins/admin/UserManager.php --- a/plugins/admin/UserManager.php Sat Oct 20 11:11:40 2007 -0400 +++ b/plugins/admin/UserManager.php Sat Oct 20 21:44:13 2007 -0400 @@ -2,7 +2,7 @@ /* * Enano - an open-source CMS capable of wiki functions, Drupal-like sidebar blocks, and everything in between - * Version 1.0.2 (Coblynau) + * Version 1.1.1 * Copyright (C) 2006-2007 Dan Fuhry * * This program is Free Software; you can redistribute and/or modify it under the terms of the GNU General Public License diff -r 9237767a23ae -r ebe99e82a59a schema.sql --- a/schema.sql Sat Oct 20 11:11:40 2007 -0400 +++ b/schema.sql Sat Oct 20 21:44:13 2007 -0400 @@ -254,6 +254,16 @@ PRIMARY KEY ( tag_id ) ) CHARACTER SET `utf8`; +-- Added in 1.1.1 + +CREATE TABLE {{TABLE_PREFIX}}lockout( + id int(12) NOT NULL auto_increment, + ipaddr varchar(40) NOT NULL, + action ENUM('credential', 'level') NOT NULL DEFAULT 'credential', + timestamp int(12) NOT NULL DEFAULT 0, + PRIMARY KEY ( id ) +) CHARACTER SET `utf8`; + INSERT INTO {{TABLE_PREFIX}}config(config_name, config_value) VALUES ('site_name', '{{SITE_NAME}}'), ('main_page', 'Main_Page'), diff -r 9237767a23ae -r ebe99e82a59a upgrade.php --- a/upgrade.php Sat Oct 20 11:11:40 2007 -0400 +++ b/upgrade.php Sat Oct 20 21:44:13 2007 -0400 @@ -2,7 +2,7 @@ /* * Enano - an open-source CMS capable of wiki functions, Drupal-like sidebar blocks, and everything in between - * Version 1.0.2 (Coblynau) + * Version 1.1.1 * upgrade.php - upgrade script * Copyright (C) 2006-2007 Dan Fuhry * @@ -61,7 +61,7 @@ // Everything related to versions goes here! // Valid versions to upgrade from -$valid_versions = Array('1.0b1', '1.0b2', '1.0b3', '1.0b4', '1.0RC1', '1.0RC2', '1.0RC3', '1.0', '1.0.1', '1.0.1.1', '1.0.2b1'); +$valid_versions = Array('1.0b1', '1.0b2', '1.0b3', '1.0b4', '1.0RC1', '1.0RC2', '1.0RC3', '1.0', '1.0.1', '1.0.1.1', '1.0.2b1', '1.0.2', 'Stable1.0ToUnstable1.1'); // Basically a list of dependencies, which should be resolved automatically // If, for example, upgrading from 1.0b1 to 1.0RC1 requires one extra query that would not @@ -76,9 +76,11 @@ '1.0RC3' => Array('1.0'), '1.0' => Array('1.0.1'), '1.0.1' => Array('1.0.1.1'), - '1.0.1.1' => Array('1.0.2b1') + '1.0.1.1' => Array('1.0.2b1'), + '1.0.2b1' => Array('Stable1.0ToUnstable1.1'), + 'Stable1.0ToUnstable1.1' => Array('1.1.1') ); -$this_version = '1.0.2'; +$this_version = '1.1.1'; $func_list = Array( '1.0' => Array('u_1_0_1_update_del_votes'), '1.0b4' => Array('u_1_0_RC1_update_user_ids', 'u_1_0_RC1_add_admins_to_group', 'u_1_0_RC1_alter_files_table', 'u_1_0_RC1_destroy_session_cookie', 'u_1_0_RC1_set_contact_email', 'u_1_0_RC1_update_page_text'), // , @@ -445,7 +447,7 @@ { if(isset($_POST['login'])) { - $session->login_without_crypto($_POST['username'], $_POST['password'], false, $ul_admin); + $result = $session->login_without_crypto($_POST['username'], $_POST['password'], false, $ul_admin); if($session->sid_super) { header('Location: upgrade.php?mode=welcome&auth='.$session->sid_super); @@ -462,7 +464,7 @@ '; + echo ''; } ?> diff -r 9237767a23ae -r ebe99e82a59a upgrade.sql --- a/upgrade.sql Sat Oct 20 11:11:40 2007 -0400 +++ b/upgrade.sql Sat Oct 20 21:44:13 2007 -0400 @@ -3,7 +3,15 @@ -- ALL NON-SQL LINES, even otherwise blank lines, must start with "--" or they will get sent to MySQL! -- Common tasks (version numbers) DELETE FROM {{TABLE_PREFIX}}config WHERE config_name='enano_version' OR config_name='enano_beta_version' OR config_name='enano_alpha_version' OR config_name='enano_rc_version'; -INSERT INTO {{TABLE_PREFIX}}config (config_name, config_value) VALUES( 'enano_version', '1.0.2' ); +INSERT INTO {{TABLE_PREFIX}}config (config_name, config_value) VALUES( 'enano_version', '1.1.1' ); +---BEGIN Stable1.0ToUnstable1.1--- +-- UPDATE {{TABLE_PREFIX}}groups SET group_id=9998 WHERE group_id=4; +-- UPDATE {{TABLE_PREFIX}}group_members SET group_id=9998 WHERE group_id=4; +-- INSERT INTO {{TABLE_PREFIX}}groups(group_id,group_name,group_type,system_group) VALUES(4, 'Regular members', 3, 1); +CREATE TABLE {{TABLE_PREFIX}}lockout( id int(12) NOT NULL auto_increment, ipaddr varchar(40) NOT NULL, action ENUM('credential', 'level') NOT NULL DEFAULT 'credential', timestamp int(12) NOT NULL DEFAULT 0, PRIMARY KEY ( id ) ) CHARACTER SET `utf8`; +---END Stable1.0ToUnstable1.1--- +---BEGIN 1.0.2--- +---END 1.0.2--- ---BEGIN 1.0.2b1--- -- This is really optional, but could reduce confusion if regex page groups get truncated for no apparent reason. ALTER TABLE {{TABLE_PREFIX}}page_groups MODIFY COLUMN pg_target text DEFAULT NULL;
    Username: \ + Username: \
    Password: \ + Password: \
    \
    Trouble logging in? Try the full login form.
    '; @@ -383,8 +467,21 @@ { $('ajaxlogin_user').object.focus(); } - $('ajaxlogin_pass').object.onblur = function(e) { if ( !shift ) $('messageBox').object.nextSibling.firstChild.focus(); }; - $('ajaxlogin_pass').object.onkeypress = function(e) { if ( !e && IE ) return true; if ( e.keyCode == 13 ) $('messageBox').object.nextSibling.firstChild.click(); }; + if ( ajax_auth_show_captcha ) + { + $('ajaxlogin_captcha_code').object.onblur = function(e) { if ( !shift ) $('messageBox').object.nextSibling.firstChild.focus(); }; + $('ajaxlogin_captcha_code').object.onkeypress = function(e) { if ( !e && IE ) return true; if ( e.keyCode == 13 ) $('messageBox').object.nextSibling.firstChild.click(); }; + } + else + { + $('ajaxlogin_pass').object.onblur = function(e) { if ( !shift ) $('messageBox').object.nextSibling.firstChild.focus(); }; + $('ajaxlogin_pass').object.onkeypress = function(e) { if ( !e && IE ) return true; if ( e.keyCode == 13 ) $('messageBox').object.nextSibling.firstChild.click(); }; + } + if ( disable_controls ) + { + var panel = document.getElementById('messageBoxButtons'); + panel.firstChild.disabled = true; + } /* ## This causes the background image to disappear under Fx 2 if ( shown_error ) @@ -398,6 +495,11 @@ fader.start(); } */ + if ( ajax_auth_show_captcha ) + { + ajaxShowCaptcha(ajax_auth_show_captcha); + ajax_auth_show_captcha = false; + } } }); } @@ -412,6 +514,15 @@ password = document.getElementById('ajaxlogin_pass').value; auth_enabled = false; + if ( document.getElementById('autoCaptcha') ) + { + var to = fly_out_top(document.getElementById('autoCaptcha'), false, true); + setTimeout(function() { + var d = document.getElementById('autoCaptcha'); + d.parentNode.removeChild(d); + }, to); + } + disableJSONExts(); // @@ -467,6 +578,12 @@ 'level' : ajax_auth_level_cache }; + if ( document.getElementById('ajaxlogin_captcha_hash') ) + { + json_data.captcha_hash = document.getElementById('ajaxlogin_captcha_hash').value; + json_data.captcha_code = document.getElementById('ajaxlogin_captcha_code').value; + } + json_data = toJSONString(json_data); json_data = encodeURIComponent(json_data); @@ -509,18 +626,23 @@ } break; case 'error': - if ( response.error == 'The username and/or password is incorrect.' ) + if ( response.data.error == 'invalid_credentials' || response.data.error == 'locked_out' ) { - ajax_auth_error_string = response.error; + ajax_auth_error_string = ajaxAuthErrorToString(response.data); mb_current_obj.updateContent(''); document.getElementById('messageBox').style.backgroundColor = '#C0C0C0'; var mb_parent = document.getElementById('messageBox').parentNode; new Spry.Effect.Shake(mb_parent, {duration: 1500}).start(); setTimeout("document.getElementById('messageBox').style.backgroundColor = '#FFF'; ajaxAuthLoginInnerSetup();", 2500); + + if ( response.data.lockout_policy == 'captcha' && response.data.error == 'locked_out' ) + { + ajax_auth_show_captcha = response.captcha; + } } else { - alert(response.error); + ajax_auth_error_string = ajaxAuthErrorToString(response.data); ajaxAuthLoginInnerSetup(); } break; diff -r 9237767a23ae -r ebe99e82a59a includes/comment.php --- a/includes/comment.php Sat Oct 20 11:11:40 2007 -0400 +++ b/includes/comment.php Sat Oct 20 21:44:13 2007 -0400 @@ -2,7 +2,7 @@ /* * Enano - an open-source CMS capable of wiki functions, Drupal-like sidebar blocks, and everything in between - * Version 1.0.2 (Coblynau) + * Version 1.1.1 * Copyright (C) 2006-2007 Dan Fuhry * * This program is Free Software; you can redistribute and/or modify it under the terms of the GNU General Public License diff -r 9237767a23ae -r ebe99e82a59a includes/common.php --- a/includes/common.php Sat Oct 20 11:11:40 2007 -0400 +++ b/includes/common.php Sat Oct 20 21:44:13 2007 -0400 @@ -2,7 +2,7 @@ /* * Enano - an open-source CMS capable of wiki functions, Drupal-like sidebar blocks, and everything in between - * Version 1.0.2 (Coblynau) + * Version 1.1.1 * Copyright (C) 2006-2007 Dan Fuhry * * This program is Free Software; you can redistribute and/or modify it under the terms of the GNU General Public License @@ -23,7 +23,7 @@ exit; } -$version = '1.0.2'; +$version = '1.1.1'; function microtime_float() { @@ -68,9 +68,6 @@ if ( file_exists( ENANO_ROOT . '/_nightly.php') ) require(ENANO_ROOT.'/_nightly.php'); -// List of scheduled tasks -$cron_tasks = array(); - // Start including files. LOTS of files. Yeah! require_once(ENANO_ROOT.'/includes/constants.php'); dc_here('Enano CMS '.$version.' (dev) - debug window
    Powered by debugConsole'); diff -r 9237767a23ae -r ebe99e82a59a includes/constants.php --- a/includes/constants.php Sat Oct 20 11:11:40 2007 -0400 +++ b/includes/constants.php Sat Oct 20 21:44:13 2007 -0400 @@ -2,7 +2,7 @@ /* * Enano - an open-source CMS capable of wiki functions, Drupal-like sidebar blocks, and everything in between - * Version 1.0.2 (Coblynau) + * Version 1.1.1 * Copyright (C) 2006-2007 Dan Fuhry * constants.php - important defines used Enano-wide * @@ -70,7 +70,7 @@ define('MAX_PMS_PER_BATCH', 7); // The maximum number of users that users can send PMs to in one go; restriction does not apply to users with mod_misc rights define('SEARCH_RESULTS_PER_PAGE', 10); define('MYSQL_MAX_PACKET_SIZE', 1048576); // 1MB; this is the default in MySQL 4.x I think -define('SEARCH_MODE', 'FULLTEXT'); // Can be FULLTEXT or BUILTIN +define('SEARCH_MODE', 'BUILTIN'); // Can be FULLTEXT or BUILTIN // Sidebar diff -r 9237767a23ae -r ebe99e82a59a includes/dbal.php --- a/includes/dbal.php Sat Oct 20 11:11:40 2007 -0400 +++ b/includes/dbal.php Sat Oct 20 21:44:13 2007 -0400 @@ -2,7 +2,7 @@ /* * Enano - an open-source CMS capable of wiki functions, Drupal-like sidebar blocks, and everything in between - * Version 1.0.2 (Coblynau) + * Version 1.1.1 * Copyright (C) 2006-2007 Dan Fuhry * * This program is Free Software; you can redistribute and/or modify it under the terms of the GNU General Public License diff -r 9237767a23ae -r ebe99e82a59a includes/email.php --- a/includes/email.php Sat Oct 20 11:11:40 2007 -0400 +++ b/includes/email.php Sat Oct 20 21:44:13 2007 -0400 @@ -2,7 +2,7 @@ /* * Enano - an open-source CMS capable of wiki functions, Drupal-like sidebar blocks, and everything in between - * Version 1.0.2 (Coblynau) + * Version 1.1.1 * Copyright (C) 2006-2007 Dan Fuhry * * This program is Free Software; you can redistribute and/or modify it under the terms of the GNU General Public License diff -r 9237767a23ae -r ebe99e82a59a includes/functions.php --- a/includes/functions.php Sat Oct 20 11:11:40 2007 -0400 +++ b/includes/functions.php Sat Oct 20 21:44:13 2007 -0400 @@ -2796,7 +2796,7 @@ $strip_tags = implode('|', $strip_tags); // Strip out the tags and replace with placeholders - preg_match_all("#<($strip_tags)([ ]+.*?)?>(.*?)#is", $html, $matches); + preg_match_all("#<($strip_tags)(.*?)>(.*?)#is", $html, $matches); $seed = md5(microtime() . mt_rand()); // Random value used for placeholders for ($i = 0;$i < sizeof($matches[1]); $i++) { @@ -2804,7 +2804,7 @@ } // Optimize (but don't obfuscate) Javascript - preg_match_all('/(.*?)(\]\]>)?<\/script>/is', $html, $jscript); + preg_match_all('/(.+?)<\/script>/is', $html, $jscript); // list of Javascript reserved words - from about.com $reserved_words = array('abstract', 'as', 'boolean', 'break', 'byte', 'case', 'catch', 'char', 'class', 'continue', 'const', 'debugger', 'default', 'delete', 'do', @@ -2819,8 +2819,6 @@ { $js =& $jscript[2][$i]; - // echo('
    ' . "-----------------------------------------------------------------------------\n" . htmlspecialchars($js) . '
    '); - // for line optimization, explode it $particles = explode("\n", $js); @@ -3168,20 +3166,6 @@ return $score; } -/** - * Registers a task that will be run every X hours. Scheduled tasks should always be scheduled at runtime - they are not stored in the DB. - * @param string Function name to call, or array(object, string method) - * @param int Interval between runs, in hours. Defaults to 24. - */ - -function register_cron_task($func, $hour_interval = 24) -{ - global $cron_tasks; - if ( !isset($cron_tasks[$hour_interval]) ) - $cron_tasks[$hour_interval] = array(); - $cron_tasks[$hour_interval][] = $func; -} - //die('
    Original:  01010101010100101010100101010101011010'."\nProcessed: ".uncompress_bitfield(compress_bitfield('01010101010100101010100101010101011010')).'
    '); ?> diff -r 9237767a23ae -r ebe99e82a59a includes/graphs.php --- a/includes/graphs.php Sat Oct 20 11:11:40 2007 -0400 +++ b/includes/graphs.php Sat Oct 20 21:44:13 2007 -0400 @@ -2,7 +2,7 @@ /* * Enano - an open-source CMS capable of wiki functions, Drupal-like sidebar blocks, and everything in between - * Version 1.0.2 (Coblynau) + * Version 1.1.1 * Copyright (C) 2006-2007 Dan Fuhry * * This program is Free Software; you can redistribute and/or modify it under the terms of the GNU General Public License diff -r 9237767a23ae -r ebe99e82a59a includes/js-compressor.php --- a/includes/js-compressor.php Sat Oct 20 11:11:40 2007 -0400 +++ b/includes/js-compressor.php Sat Oct 20 21:44:13 2007 -0400 @@ -2,7 +2,7 @@ /* * Enano - an open-source CMS capable of wiki functions, Drupal-like sidebar blocks, and everything in between - * Version 1.0.2 (Coblynau) + * Version 1.1.1 * Copyright (C) 2006-2007 Dan Fuhry * Javascript compression library - used to compact the client-side Javascript code (all 72KB of it!) to save some bandwidth * diff -r 9237767a23ae -r ebe99e82a59a includes/pageprocess.php --- a/includes/pageprocess.php Sat Oct 20 11:11:40 2007 -0400 +++ b/includes/pageprocess.php Sat Oct 20 21:44:13 2007 -0400 @@ -2,7 +2,7 @@ /* * Enano - an open-source CMS capable of wiki functions, Drupal-like sidebar blocks, and everything in between - * Version 1.0.2 (Coblynau) + * Version 1.1.1 * pageprocess.php - intelligent retrieval of pages * Copyright (C) 2006-2007 Dan Fuhry * diff -r 9237767a23ae -r ebe99e82a59a includes/pageutils.php --- a/includes/pageutils.php Sat Oct 20 11:11:40 2007 -0400 +++ b/includes/pageutils.php Sat Oct 20 21:44:13 2007 -0400 @@ -1,7 +1,8 @@ 'face-plain.png', ':joke:' => 'face-plain.png', ']:->' => 'face-devil-grin.png', - ']:->' => 'face-devil-grin.png', ':kiss:' => 'face-kiss.png', ':-P' => 'face-tongue-out.png', ':P' => 'face-tongue-out.png', diff -r 9237767a23ae -r ebe99e82a59a includes/search.php --- a/includes/search.php Sat Oct 20 11:11:40 2007 -0400 +++ b/includes/search.php Sat Oct 20 21:44:13 2007 -0400 @@ -2,7 +2,7 @@ /* * Enano - an open-source CMS capable of wiki functions, Drupal-like sidebar blocks, and everything in between - * Version 1.0.2 (Coblynau) + * Version 1.1.1 * Copyright (C) 2006-2007 Dan Fuhry * search.php - algorithm used to search pages * diff -r 9237767a23ae -r ebe99e82a59a includes/sessions.php --- a/includes/sessions.php Sat Oct 20 11:11:40 2007 -0400 +++ b/includes/sessions.php Sat Oct 20 21:44:13 2007 -0400 @@ -547,14 +547,55 @@ * @param string $aes_key The MD5 hash of the encryption key, hex-encoded * @param string $challenge The 256-bit MD5 challenge string - first 128 bits should be the hash, the last 128 should be the challenge salt * @param int $level The privilege level we're authenticating for, defaults to 0 + * @param array $captcha_hash Optional. If we're locked out and the lockout policy is captcha, this should be the identifier for the code. + * @param array $captcha_code Optional. If we're locked out and the lockout policy is captcha, this should be the code the user entered. * @return string 'success' on success, or error string on failure */ - function login_with_crypto($username, $aes_data, $aes_key, $challenge, $level = USER_LEVEL_MEMBER) + function login_with_crypto($username, $aes_data, $aes_key, $challenge, $level = USER_LEVEL_MEMBER, $captcha_hash = false, $captcha_code = false) { global $db, $session, $paths, $template, $plugins; // Common objects $privcache = $this->private_key; + + if ( !defined('IN_ENANO_INSTALL') ) + { + // Lockout stuff + $threshold = ( $_ = getConfig('lockout_threshold') ) ? intval($_) : 5; + $duration = ( $_ = getConfig('lockout_duration') ) ? intval($_) : 15; + // convert to minutes + $duration = $duration * 60; + $policy = ( $x = getConfig('lockout_policy') && in_array(getConfig('lockout_policy'), array('lockout', 'disable', 'captcha')) ) ? getConfig('lockout_policy') : 'lockout'; + if ( $policy == 'captcha' && $captcha_hash && $captcha_code ) + { + // policy is captcha -- check if it's correct, and if so, bypass lockout check + $real_code = $this->get_captcha($captcha_hash); + } + if ( $policy != 'disable' && !( $policy == 'captcha' && isset($real_code) && $real_code == $captcha_code ) ) + { + $ipaddr = $db->escape($_SERVER['REMOTE_ADDR']); + $timestamp_cutoff = time() - $duration; + $q = $this->sql('SELECT timestamp FROM '.table_prefix.'lockout WHERE timestamp > ' . $timestamp_cutoff . ' AND ipaddr = \'' . $ipaddr . '\' ORDER BY timestamp DESC;'); + $fails = $db->numrows(); + if ( $fails >= $threshold ) + { + // ooh boy, somebody's in trouble ;-) + $row = $db->fetchrow(); + $db->free_result(); + return array( + 'success' => false, + 'error' => 'locked_out', + 'lockout_threshold' => $threshold, + 'lockout_duration' => ( $duration / 60 ), + 'lockout_fails' => $fails, + 'lockout_policy' => $policy, + 'time_rem' => ( $duration / 60 ) - round( ( time() - $row['timestamp'] ) / 60 ), + 'lockout_last_time' => $row['timestamp'] + ); + } + $db->free_result(); + } + } // Instanciate the Rijndael encryption object $aes = new AESCrypt(AES_BITS, AES_BLOCKSIZE); @@ -563,13 +604,19 @@ $aes_key = $this->fetch_public_key($aes_key); if(!$aes_key) - return 'Couldn\'t look up public key "'.$aes_key.'" for decryption'; + return array( + 'success' => false, + 'error' => 'key_not_found' + ); // Convert the key to a binary string $bin_key = hexdecode($aes_key); if(strlen($bin_key) != AES_BITS / 8) - return 'The decryption key is the wrong length'; + return array( + 'success' => false, + 'error' => 'key_wrong_length' + ); // Decrypt our password $password = $aes->decrypt($aes_data, $bin_key, ENC_HEX); @@ -590,7 +637,29 @@ $this->sql('INSERT INTO '.table_prefix.'logs(log_type,action,time_id,date_string,author,edit_summary,page_text) VALUES(\'security\', \'admin_auth_bad\', '.time().', \''.date('d M Y h:i a').'\', \''.$db->escape($username).'\', \''.$db->escape($_SERVER['REMOTE_ADDR']).'\', ' . intval($level) . ')'); else $this->sql('INSERT INTO '.table_prefix.'logs(log_type,action,time_id,date_string,author,edit_summary) VALUES(\'security\', \'auth_bad\', '.time().', \''.date('d M Y h:i a').'\', \''.$db->escape($username).'\', \''.$db->escape($_SERVER['REMOTE_ADDR']).'\')'); - return "The username and/or password is incorrect."; + + if ( $policy != 'disable' && !defined('IN_ENANO_INSTALL') ) + { + $ipaddr = $db->escape($_SERVER['REMOTE_ADDR']); + // increment fail count + $this->sql('INSERT INTO '.table_prefix.'lockout(ipaddr, timestamp, action) VALUES(\'' . $ipaddr . '\', UNIX_TIMESTAMP(), \'credential\');'); + $fails++; + // ooh boy, somebody's in trouble ;-) + return array( + 'success' => false, + 'error' => ( $fails >= $threshold ) ? 'locked_out' : 'invalid_credentials', + 'lockout_threshold' => $threshold, + 'lockout_duration' => ( $duration / 60 ), + 'lockout_fails' => $fails, + 'time_rem' => ( $duration / 60 ), + 'lockout_policy' => $policy + ); + } + + return array( + 'success' => false, + 'error' => 'invalid_credentials' + ); } $row = $db->fetchrow(); @@ -641,7 +710,10 @@ if($success) { if($level > $row['user_level']) - return 'You are not authorized for this level of access.'; + return array( + 'success' => false, + 'error' => 'too_big_for_britches' + ); $sess = $this->register_session(intval($row['user_id']), $username, $password, $level); if($sess) @@ -661,10 +733,15 @@ { eval($cmd); } - return 'success'; + return array( + 'success' => true + ); } else - return 'Your login credentials were correct, but an internal error occurred while registering the session key in the database.'; + return array( + 'success' => false, + 'error' => 'backend_fail' + ); } else { @@ -673,7 +750,28 @@ else $this->sql('INSERT INTO '.table_prefix.'logs(log_type,action,time_id,date_string,author,edit_summary) VALUES(\'security\', \'auth_bad\', '.time().', \''.date('d M Y h:i a').'\', \''.$db->escape($username).'\', \''.$db->escape($_SERVER['REMOTE_ADDR']).'\')'); - return 'The username and/or password is incorrect.'; + // Do we also need to increment the lockout countdown? + if ( $policy != 'disable' && !defined('IN_ENANO_INSTALL') ) + { + $ipaddr = $db->escape($_SERVER['REMOTE_ADDR']); + // increment fail count + $this->sql('INSERT INTO '.table_prefix.'lockout(ipaddr, timestamp, action) VALUES(\'' . $ipaddr . '\', UNIX_TIMESTAMP(), \'credential\');'); + $fails++; + return array( + 'success' => false, + 'error' => ( $fails >= $threshold ) ? 'locked_out' : 'invalid_credentials', + 'lockout_threshold' => $threshold, + 'lockout_duration' => ( $duration / 60 ), + 'lockout_fails' => $fails, + 'time_rem' => ( $duration / 60 ), + 'lockout_policy' => $policy + ); + } + + return array( + 'success' => false, + 'error' => 'invalid_credentials' + ); } } @@ -699,6 +797,45 @@ return $this->login_compat($username, $pass_hashed, $level); } + if ( !defined('IN_ENANO_INSTALL') ) + { + // Lockout stuff + $threshold = ( $_ = getConfig('lockout_threshold') ) ? intval($_) : 5; + $duration = ( $_ = getConfig('lockout_duration') ) ? intval($_) : 15; + // convert to minutes + $duration = $duration * 60; + $policy = ( $x = getConfig('lockout_policy') && in_array(getConfig('lockout_policy'), array('lockout', 'disable', 'captcha')) ) ? getConfig('lockout_policy') : 'lockout'; + if ( $policy == 'captcha' && $captcha_hash && $captcha_code ) + { + // policy is captcha -- check if it's correct, and if so, bypass lockout check + $real_code = $this->get_captcha($captcha_hash); + } + if ( $policy != 'disable' && !( $policy == 'captcha' && isset($real_code) && $real_code == $captcha_code ) ) + { + $ipaddr = $db->escape($_SERVER['REMOTE_ADDR']); + $timestamp_cutoff = time() - $duration; + $q = $this->sql('SELECT timestamp FROM '.table_prefix.'lockout WHERE timestamp > ' . $timestamp_cutoff . ' AND ipaddr = \'' . $ipaddr . '\' ORDER BY timestamp DESC;'); + $fails = $db->numrows(); + if ( $fails > $threshold ) + { + // ooh boy, somebody's in trouble ;-) + $row = $db->fetchrow(); + $db->free_result(); + return array( + 'success' => false, + 'error' => 'locked_out', + 'lockout_threshold' => $threshold, + 'lockout_duration' => ( $duration / 60 ), + 'lockout_fails' => $fails, + 'lockout_policy' => $policy, + 'time_rem' => $duration - round( ( time() - $row['timestamp'] ) / 60 ), + 'lockout_last_time' => $row['timestamp'] + ); + } + $db->free_result(); + } + } + // Instanciate the Rijndael encryption object $aes = new AESCrypt(AES_BITS, AES_BLOCKSIZE); @@ -707,14 +844,35 @@ // Retrieve the real password from the database $this->sql('SELECT password,old_encryption,user_id,user_level,temp_password,temp_password_time FROM '.table_prefix.'users WHERE lcase(username)=\''.$this->prepare_text(strtolower($username)).'\';'); - if ( $db->numrows() < 1 ) + if($db->numrows() < 1) { // This wasn't logged in <1.0.2, dunno how it slipped through if($level > USER_LEVEL_MEMBER) $this->sql('INSERT INTO '.table_prefix.'logs(log_type,action,time_id,date_string,author,edit_summary,page_text) VALUES(\'security\', \'admin_auth_bad\', '.time().', \''.date('d M Y h:i a').'\', \''.$db->escape($username).'\', \''.$db->escape($_SERVER['REMOTE_ADDR']).'\', ' . intval($level) . ')'); else $this->sql('INSERT INTO '.table_prefix.'logs(log_type,action,time_id,date_string,author,edit_summary) VALUES(\'security\', \'auth_bad\', '.time().', \''.date('d M Y h:i a').'\', \''.$db->escape($username).'\', \''.$db->escape($_SERVER['REMOTE_ADDR']).'\')'); - return "The username and/or password is incorrect."; + + // Do we also need to increment the lockout countdown? + if ( $policy != 'disable' && !defined('IN_ENANO_INSTALL') ) + { + $ipaddr = $db->escape($_SERVER['REMOTE_ADDR']); + // increment fail count + $this->sql('INSERT INTO '.table_prefix.'lockout(ipaddr, timestamp, action) VALUES(\'' . $ipaddr . '\', UNIX_TIMESTAMP(), \'credential\');'); + $fails++; + return array( + 'success' => false, + 'error' => ( $fails >= $threshold ) ? 'locked_out' : 'invalid_credentials', + 'lockout_threshold' => $threshold, + 'lockout_duration' => ( $duration / 60 ), + 'lockout_fails' => $fails, + 'lockout_policy' => $policy + ); + } + + return array( + 'success' => false, + 'error' => 'invalid_credentials' + ); } $row = $db->fetchrow(); @@ -764,7 +922,10 @@ if($success) { if((int)$level > (int)$row['user_level']) - return 'You are not authorized for this level of access.'; + return array( + 'success' => false, + 'error' => 'too_big_for_britches' + ); $sess = $this->register_session(intval($row['user_id']), $username, $real_pass, $level); if($sess) { @@ -779,10 +940,15 @@ eval($cmd); } - return 'success'; + return array( + 'success' => true + ); } else - return 'Your login credentials were correct, but an internal error occured while registering the session key in the database.'; + return array( + 'success' => false, + 'error' => 'backend_fail' + ); } else { @@ -791,7 +957,27 @@ else $this->sql('INSERT INTO '.table_prefix.'logs(log_type,action,time_id,date_string,author,edit_summary) VALUES(\'security\', \'auth_bad\', '.time().', \''.date('d M Y h:i a').'\', \''.$db->escape($username).'\', \''.$db->escape($_SERVER['REMOTE_ADDR']).'\')'); - return 'The username and/or password is incorrect.'; + // Do we also need to increment the lockout countdown? + if ( $policy != 'disable' && !defined('IN_ENANO_INSTALL') ) + { + $ipaddr = $db->escape($_SERVER['REMOTE_ADDR']); + // increment fail count + $this->sql('INSERT INTO '.table_prefix.'lockout(ipaddr, timestamp, action) VALUES(\'' . $ipaddr . '\', UNIX_TIMESTAMP(), \'credential\');'); + $fails++; + return array( + 'success' => false, + 'error' => ( $fails >= $threshold ) ? 'locked_out' : 'invalid_credentials', + 'lockout_threshold' => $threshold, + 'lockout_duration' => ( $duration / 60 ), + 'lockout_fails' => $fails, + 'lockout_policy' => $policy + ); + } + + return array( + 'success' => false, + 'error' => 'invalid_credentials' + ); } } diff -r 9237767a23ae -r ebe99e82a59a includes/stats.php --- a/includes/stats.php Sat Oct 20 11:11:40 2007 -0400 +++ b/includes/stats.php Sat Oct 20 21:44:13 2007 -0400 @@ -1,7 +1,8 @@ setHook('template_compile_logic_keyword'); - foreach ( $code as $cmd ) - { - eval($cmd); - } + // If-else-end + $text = preg_replace('/(.*?)(.*?)/is', '\'; if ( $this->tpl_bool[\'\\1\'] ) { echo \'\\2\'; } else { echo \'\\3\'; } echo \'', $text); + + // If-end + $text = preg_replace('/(.*?)/is', '\'; if ( $this->tpl_bool[\'\\1\'] ) { echo \'\\2\'; } echo \'', $text); - $keywords = implode('|', $keywords); + // If not-else-end + $text = preg_replace('/(.*?)(.*?)/is', '\'; if ( !$this->tpl_bool[\'\\1\'] ) { echo \'\\2\'; } else { echo \'\\3\'; } echo \'', $text); - // Matches - // 1 2 3 4 56 7 8 - $regexp = '/()(.*)(()(.*))?()/isU'; - - /* - The way this works is: match all blocks using the standard form with a different keyword in the block each time, - and replace them with appropriate PHP logic. Plugin-extensible now. :-) + // If not-end + $text = preg_replace('/(.*?)/is', '\'; if ( !$this->tpl_bool[\'\\1\'] ) { echo \'\\2\'; } echo \'', $text); - The while-loop is to bypass what is apparently a PCRE bug. It's hackish but it works. Properly written plugins should only need - to compile templates (using this method) once for each time the template file is changed. - */ - while ( preg_match($regexp, $text) ) - { - preg_match_all($regexp, $text, $matches); - for ( $i = 0; $i < count($matches[0]); $i++ ) - { - $start_tag =& $matches[1][$i]; - $type =& $matches[2][$i]; - $test =& $matches[3][$i]; - $particle_true =& $matches[4][$i]; - $else_tag =& $matches[6][$i]; - $particle_else =& $matches[7][$i]; - $end_tag =& $matches[8][$i]; - - switch($type) - { - case 'BEGIN': - $cond = "isset(\$this->tpl_bool['$test']) && \$this->tpl_bool['$test']"; - break; - case 'BEGINNOT': - $cond = "!isset(\$this->tpl_bool['$test']) || ( isset(\$this->tpl_bool['$test']) && !\$this->tpl_bool['$test'] )"; - break; - case 'IFPLUGIN': - $cond = "getConfig('plugin_$test') == '1'"; - break; - case 'IFSET': - $cond = "isset(\$this->tpl_strings['$test'])"; - break; - default: - $code = $plugins->setHook('template_compile_logic_cond'); - foreach ( $code as $cmd ) - { - eval($cmd); - } - break; - } - - if ( !isset($cond) || ( isset($cond) && !is_string($cond) ) ) - continue; - - $tag_complete = <<(.*?)(.*?)/is', '\'; if ( isset($this->tpl_strings[\'\\1\']) ) { echo \'\\2\'; } else { echo \'\\3\'; } echo \'', $text); + + // If set-end + $text = preg_replace('/(.*?)/is', '\'; if ( isset($this->tpl_strings[\'\\1\']) ) { echo \'\\2\'; } echo \'', $text); - // For debugging ;-) - // die("
    <?php\n" . htmlspecialchars($text."\n\n".print_r($matches,true)) . "\n\n?>
    "); + // If plugin loaded-else-end + $text = preg_replace('/(.*?)(.*?)/is', '\'; if ( getConfig(\'plugin_\\1\') == \'1\' ) { echo \'\\2\'; } else { echo \'\\3\'; } echo \'', $text); + + // If plugin loaded-end + $text = preg_replace('/(.*?)/is', '\'; if ( getConfig(\'plugin_\\1\') == \'1\' ) { echo \'\\2\'; } echo \'', $text); // // Data substitution/variables @@ -1089,8 +1029,6 @@ $text = str_replace_once($tag, "'; $match echo '", $text); } - // echo('
    ' . htmlspecialchars($text) . '
    '); - return $text; } @@ -1473,7 +1411,7 @@ function username_field($name, $value = false) { $randomid = md5( time() . microtime() . mt_rand() ); - $text = 'load_theme('oxygen', 'bleu', false); +$template->load_theme('stpatty', 'shamrock', false); $modestrings = Array( 'welcome' => 'Welcome', @@ -313,10 +313,9 @@ case 'welcome': ?>
    - [ Enano CMS Project logo ] + [ Enano CMS Project logo ]

    Welcome to Enano

    -

    version 1.0.2 – stable
    - also affectionately known as "coblynau" :)

    +

    version 1.1.1 – unstable

    Your changes to the site configuration have been saved.

    '; } @@ -351,6 +361,43 @@
    Account lockouts
    Configure Enano to prevent or restrict logins for a specified period of time if a user enters an incorrect password a specific number of times.
    Lockout threshold:
    + How many times can a user enter wrong credentials before a lockout goes into effect? +     		+ +
    Lockout duration:
    + This is how long an account lockout should last, in minutes. +     		+ +
    Lockout policy:
    + What should be done when a lockout goes into effect? +     		+
    +
    + +
    Password strength
    + Forgot your password? No problem.
    Maybe you need to create an account.
    Password:
    Code in image:
    + +
    @@ -242,12 +344,12 @@ $plugins->attachHook('login_password_reset', 'SpecialLogin_SendResponse_PasswordReset($row[\'user_id\'], $row[\'temp_password\']);'); $json = new Services_JSON(SERVICES_JSON_LOOSE_TYPE); $data = $json->decode($_POST['params']); + $captcha_hash = ( isset($data['captcha_hash']) ) ? $data['captcha_hash'] : false; + $captcha_code = ( isset($data['captcha_code']) ) ? $data['captcha_code'] : false; $level = ( isset($data['level']) ) ? intval($data['level']) : USER_LEVEL_MEMBER; - $result = $session->login_with_crypto($data['username'], $data['crypt_data'], $data['crypt_key'], $data['challenge'], $level); + $result = $session->login_with_crypto($data['username'], $data['crypt_data'], $data['crypt_key'], $data['challenge'], $level, $captcha_hash, $captcha_code); $session->start(); - //echo "$result\n$session->sid_super"; - //exit; - if ( $result == 'success' ) + if ( $result['success'] ) { $response = Array( 'result' => 'success', @@ -256,9 +358,16 @@ } else { + $captcha = ''; + if ( $result['error'] == 'locked_out' && $result['lockout_policy'] == 'captcha' ) + { + $session->kill_captcha(); + $captcha = $session->make_captcha(); + } $response = Array( 'result' => 'error', - 'error' => $result + 'data' => $result, + 'captcha' => $captcha ); } $response = $json->encode($response); @@ -267,17 +376,19 @@ exit; } if(isset($_POST['login'])) { + $captcha_hash = ( isset($_POST['captcha_hash']) ) ? $_POST['captcha_hash'] : false; + $captcha_code = ( isset($_POST['captcha_code']) ) ? $_POST['captcha_code'] : false; if($_POST['use_crypt'] == 'yes') { - $result = $session->login_with_crypto($_POST['username'], $_POST['crypt_data'], $_POST['crypt_key'], $_POST['challenge_data'], intval($_POST['auth_level'])); + $result = $session->login_with_crypto($_POST['username'], $_POST['crypt_data'], $_POST['crypt_key'], $_POST['challenge_data'], intval($_POST['auth_level']), $captcha_hash, $captcha_code); } else { - $result = $session->login_without_crypto($_POST['username'], $_POST['pass'], false, intval($_POST['auth_level'])); + $result = $session->login_without_crypto($_POST['username'], $_POST['pass'], false, intval($_POST['auth_level']), $captcha_hash, $captcha_code); } $session->start(); $paths->init(); - if($result == 'success') + if($result['success']) { $template->load_theme($session->theme, $session->style); if(isset($_POST['return_to'])) diff -r 9237767a23ae -r ebe99e82a59a plugins/admin/PageGroups.php --- a/plugins/admin/PageGroups.php Sat Oct 20 11:11:40 2007 -0400 +++ b/plugins/admin/PageGroups.php Sat Oct 20 21:44:13 2007 -0400 @@ -2,7 +2,7 @@ /* * Enano - an open-source CMS capable of wiki functions, Drupal-like sidebar blocks, and everything in between - * Version 1.0.2 (Coblynau) + * Version 1.1.1 * Copyright (C) 2006-2007 Dan Fuhry * * This program is Free Software; you can redistribute and/or modify it under the terms of the GNU General Public License @@ -602,23 +602,6 @@ echo '
    The affecting tag was updated.
    '; } } - else if ( $_POST['pg_type'] == PAGE_GRP_REGEX ) - { - $target = $_POST['pg_target']; - if ( empty($target) ) - { - echo '
    Please enter an expression to match against..
    '; - } - else - { - $target = $db->escape($target); - $q = $db->sql_query('UPDATE '.table_prefix.'page_groups SET pg_target=\'' . $target . '\' WHERE pg_id=' . $edit_id . ';'); - if ( !$q ) - $db->_die(); - else - echo '
    The expression to match against was updated.
    '; - } - } else if ( $_POST['pg_type'] == PAGE_GRP_CATLINK ) { $target = $_POST['pg_target']; @@ -877,22 +860,6 @@
    - Regular expression to use:
    - Be sure to include the starting and ending delimiters and any flags you might need.
    - These pages might help: Pattern modifiers • - Pattern syntax
    - Examples: /^(Special|Admin):/i • /^Image:([0-9]+)$/
    - Developers, remember that this will be matched against the full page identifier string. This means that /^About_Enano$/ - will NOT match the page Special:About_Enano.     -     		- -

    Login failed. Bad password?

    Login failed: '. $result['error'] . '