Revision 1312
Added by Dietmar over 14 years ago
| branches/2.8.x/CHANGELOG | ||
|---|---|---|
| 11 | 11 |
! = Update/Change |
| 12 | 12 |
|
| 13 | 13 |
------------------------------------- 2.8.1 ------------------------------------- |
| 14 |
01-Apr-2010 Dietmar Woellbrink (Luisehahne) |
|
| 14 |
07-Apr-2010 Dietmar Woellbrink (Luisehahne) |
|
| 15 |
# Ticket #971 Using $_POST in Admin - account - login.php (tks to Aldus) |
|
| 16 |
! update class.wb.php added tokens function |
|
| 17 |
07-Apr-2010 Dietmar Woellbrink (Luisehahne) |
|
| 15 | 18 |
# Ticket #967 Typo in the mysql-query results in "not" upgrading the modul info ( tks to Aldus) |
| 16 | 19 |
01-Apr-2010 Dietmar Woellbrink (Luisehahne) |
| 17 | 20 |
# Ticket 963 Minor XSS issue in admin login |
| branches/2.8.x/wb/admin/interface/version.php | ||
|---|---|---|
| 52 | 52 |
|
| 53 | 53 |
// check if defined to avoid errors during installation (redirect to admin panel fails if PHP error/warnings are enabled) |
| 54 | 54 |
if(!defined('VERSION')) define('VERSION', '2.8.x');
|
| 55 |
if(!defined('REVISION')) define('REVISION', '1311');
|
|
| 55 |
if(!defined('REVISION')) define('REVISION', '1312');
|
|
| 56 | 56 |
|
| 57 | 57 |
?> |
| branches/2.8.x/wb/account/login.php | ||
|---|---|---|
| 46 | 46 |
require_once(WB_PATH.'/framework/class.login.php'); |
| 47 | 47 |
|
| 48 | 48 |
// Create new login app |
| 49 |
$redirect = strip_tags((isset($_REQUEST['redirect'])) ? $_REQUEST['redirect'] : '');
|
|
| 49 |
$redirect = strip_tags((isset($_POST['redirect'])) ? $_POST['redirect'] : '');
|
|
| 50 | 50 |
$thisApp = new Login( |
| 51 | 51 |
array( |
| 52 | 52 |
"MAX_ATTEMPS" => "3", |
| branches/2.8.x/wb/framework/class.wb.php | ||
|---|---|---|
| 269 | 269 |
} |
| 270 | 270 |
} |
| 271 | 271 |
|
| 272 |
/* |
|
| 273 |
* creates Formular transactionnumbers for unique use |
|
| 274 |
* @access public |
|
| 275 |
* @param bool $asTAG: true returns a complete prepared, hidden HTML-Input-Tag (default) |
|
| 276 |
* false returns an array including FTAN0 and FTAN1 |
|
| 277 |
* @return mixed: array or string |
|
| 278 |
* |
|
| 279 |
* requirements: an active session must be available |
|
| 280 |
*/ |
|
| 281 |
public function getFTAN( $asTAG = true) |
|
| 282 |
{
|
|
| 283 |
if(function_exists('microtime'))
|
|
| 284 |
{
|
|
| 285 |
list($usec, $sec) = explode(" ", microtime());
|
|
| 286 |
$time = ((float)$usec + (float)$sec); |
|
| 287 |
}else{
|
|
| 288 |
$time = time(); |
|
| 289 |
} |
|
| 290 |
$ftan = md5(((string)$time).$_SERVER['SERVER_ADDR']); |
|
| 291 |
$_SESSION['FTAN'] = $ftan; |
|
| 292 |
$ftan0 = 'a'.substr($ftan, -(10 + hexdec(substr($ftan, 1))), 10); |
|
| 293 |
$ftan1 = 'a'.substr($ftan, hexdec(substr($ftan, -1)), 10); |
|
| 294 |
if($asTAG == true) |
|
| 295 |
{
|
|
| 296 |
return '<input type="hidden" name="'.$ftan0.'" value="'.$ftan1.'" title="" />'; |
|
| 297 |
}else{
|
|
| 298 |
return array('FTAN0' => $ftan0, 'FTAN1' => $ftan1);
|
|
| 299 |
} |
|
| 300 |
} |
|
| 301 |
|
|
| 302 |
/* |
|
| 303 |
* checks received form-transactionnumbers against session-stored one |
|
| 304 |
* @access public |
|
| 305 |
* @param string $mode: requestmethode POST(default) or GET |
|
| 306 |
* @return bool: true if numbers matches against stored ones |
|
| 307 |
* |
|
| 308 |
* requirements: an active session must be available |
|
| 309 |
* this check will prevent from multiple sending a form. history.back() also will never work |
|
| 310 |
*/ |
|
| 311 |
public function checkFTAN( $mode = 'POST') |
|
| 312 |
{
|
|
| 313 |
$retval = false; |
|
| 314 |
if(isset($_SESSION['FTAN']) && strlen($_SESSION['FTAN']) == strlen(md5('dummy')))
|
|
| 315 |
{
|
|
| 316 |
$ftan = $_SESSION['FTAN']; |
|
| 317 |
$ftan0 = 'a'.substr($ftan, -(10 + hexdec(substr($ftan, 1))), 10); |
|
| 318 |
$ftan1 = 'a'.substr($ftan, hexdec(substr($ftan, -1)), 10); |
|
| 319 |
unset($_SESSION['FTAN']); |
|
| 320 |
if(strtoupper($mode) == 'POST') |
|
| 321 |
{
|
|
| 322 |
$retval = (isset($_POST[$ftan0]) && $_POST[$ftan0] == ($ftan1)); |
|
| 323 |
$_POST[$ftan0] = ''; |
|
| 324 |
}else{
|
|
| 325 |
$retval = (isset($_GET[$ftan0]) && $_GET[$ftan0] == ($ftan1)); |
|
| 326 |
$_GET[$ftan0] = ''; |
|
| 327 |
} |
|
| 328 |
} |
|
| 329 |
return $retval; |
|
| 330 |
} |
|
| 331 |
|
|
| 272 | 332 |
// Print a success message which then automatically redirects the user to another page |
| 273 | 333 |
function print_success($message, $redirect = 'index.php') {
|
| 274 | 334 |
global $TEXT, $database; |
Also available in: Unified diff
Ticket #971 Using $_POST in Admin - account - login.php (tks to Aldus)
update class.wb.php added tokens function