aboutsummaryrefslogtreecommitdiffstats
path: root/include/security.php
diff options
context:
space:
mode:
Diffstat (limited to 'include/security.php')
-rw-r--r--include/security.php45
1 files changed, 19 insertions, 26 deletions
diff --git a/include/security.php b/include/security.php
index f3cf2d1b6..38045c8a9 100644
--- a/include/security.php
+++ b/include/security.php
@@ -14,21 +14,19 @@
*/
function authenticate_success($user_record, $login_initial = false, $interactive = false, $return = false, $update_lastlog = false) {
- $a = get_app();
-
$_SESSION['addr'] = $_SERVER['REMOTE_ADDR'];
$lastlog_updated = false;
if(x($user_record, 'account_id')) {
- $a->account = $user_record;
+ App::$account = $user_record;
$_SESSION['account_id'] = $user_record['account_id'];
$_SESSION['authenticated'] = 1;
$uid_to_load = (((x($_SESSION,'uid')) && (intval($_SESSION['uid'])))
? intval($_SESSION['uid'])
- : intval($a->account['account_default_channel'])
+ : intval(App::$account['account_default_channel'])
);
if($uid_to_load) {
@@ -40,9 +38,9 @@ function authenticate_success($user_record, $login_initial = false, $interactive
dbesc(datetime_convert()),
intval($_SESSION['account_id'])
);
- $a->account['account_lastlog'] = datetime_convert();
+ App::$account['account_lastlog'] = datetime_convert();
$lastlog_updated = true;
- call_hooks('logged_in', $a->account);
+ call_hooks('logged_in', App::$account);
}
}
@@ -59,7 +57,7 @@ function authenticate_success($user_record, $login_initial = false, $interactive
return;
}
- if(($a->module !== 'home') && x($_SESSION,'login_return_url') && strlen($_SESSION['login_return_url'])) {
+ if((App::$module !== 'home') && x($_SESSION,'login_return_url') && strlen($_SESSION['login_return_url'])) {
$return_url = $_SESSION['login_return_url'];
// don't let members get redirected to a raw ajax page update - this can happen
@@ -68,14 +66,14 @@ function authenticate_success($user_record, $login_initial = false, $interactive
$return_url = '';
unset($_SESSION['login_return_url']);
- goaway($a->get_baseurl() . '/' . $return_url);
+ goaway(z_root() . '/' . $return_url);
}
/* This account has never created a channel. Send them to new_channel by default */
- if($a->module === 'login') {
+ if(App::$module === 'login') {
$r = q("select count(channel_id) as total from channel where channel_account_id = %d and channel_removed = 0 ",
- intval($a->account['account_id'])
+ intval(App::$account['account_id'])
);
if(($r) && (! $r[0]['total']))
goaway(z_root() . '/new_channel');
@@ -116,7 +114,7 @@ function change_channel($change_channel) {
if($r) {
$hash = $r[0]['channel_hash'];
$_SESSION['uid'] = intval($r[0]['channel_id']);
- get_app()->set_channel($r[0]);
+ App::set_channel($r[0]);
$_SESSION['theme'] = $r[0]['channel_theme'];
$_SESSION['mobile_theme'] = get_pconfig(local_channel(),'system', 'mobile_theme');
date_default_timezone_set($r[0]['channel_timezone']);
@@ -127,10 +125,10 @@ function change_channel($change_channel) {
);
if($x) {
$_SESSION['my_url'] = $x[0]['xchan_url'];
- $_SESSION['my_address'] = $r[0]['channel_address'] . '@' . substr(get_app()->get_baseurl(), strpos(get_app()->get_baseurl(), '://') + 3);
+ $_SESSION['my_address'] = $r[0]['channel_address'] . '@' . substr(z_root(), strpos(z_root(), '://') + 3);
- get_app()->set_observer($x[0]);
- get_app()->set_perms(get_all_perms(local_channel(), $hash));
+ App::set_observer($x[0]);
+ App::set_perms(get_all_perms(local_channel(), $hash));
}
if(! is_dir('store/' . $r[0]['channel_address']))
@os_mkdir('store/' . $r[0]['channel_address'], STORAGE_DEFAULT_PERMISSIONS,true);
@@ -293,7 +291,7 @@ function scopes_sql($uid,$observer) {
if(! is_foreigner($observer))
$str .= " or public_policy = 'network: red' ";
if(local_channel())
- $str .= " or public_policy = 'site: " . get_app()->get_hostname() . "' ";
+ $str .= " or public_policy = 'site: " . App::get_hostname() . "' ";
$ab = q("select * from abook where abook_xchan = '%s' and abook_channel = %d limit 1",
dbesc($observer),
@@ -320,7 +318,7 @@ function scopes_sql($uid,$observer) {
*/
function public_permissions_sql($observer_hash) {
- //$observer = get_app()->get_observer();
+ //$observer = App::get_observer();
$groups = init_groups_visitor($observer_hash);
$gs = '<<>>'; // should be impossible to match
@@ -360,10 +358,9 @@ function public_permissions_sql($observer_hash) {
* so this mechanism brings in some damage control (the attacker would be able to forge a request to a form of this type, but not to forms of other types).
*/
function get_form_security_token($typename = '') {
- $a = get_app();
$timestamp = time();
- $sec_hash = hash('whirlpool', $a->user['guid'] . $a->user['prvkey'] . session_id() . $timestamp . $typename);
+ $sec_hash = hash('whirlpool', App::$observer['xchan_guid'] . ((local_channel()) ? App::$channel['channel_prvkey'] : '') . session_id() . $timestamp . $typename);
return $timestamp . '.' . $sec_hash;
}
@@ -374,12 +371,10 @@ function check_form_security_token($typename = '', $formname = 'form_security_to
$max_livetime = 10800; // 3 hours
- $a = get_app();
-
$x = explode('.', $hash);
if (time() > (IntVal($x[0]) + $max_livetime)) return false;
- $sec_hash = hash('whirlpool', $a->user['guid'] . $a->user['prvkey'] . session_id() . $x[0] . $typename);
+ $sec_hash = hash('whirlpool', App::$observer['xchan_guid'] . ((local_channel()) ? App::$channel['channel_prvkey'] : '') . session_id() . $x[0] . $typename);
return ($sec_hash == $x[1]);
}
@@ -389,17 +384,15 @@ function check_form_security_std_err_msg() {
}
function check_form_security_token_redirectOnErr($err_redirect, $typename = '', $formname = 'form_security_token') {
if (!check_form_security_token($typename, $formname)) {
- $a = get_app();
- logger('check_form_security_token failed: user ' . $a->user['guid'] . ' - form element ' . $typename);
+ logger('check_form_security_token failed: user ' . App::$observer['xchan_name'] . ' - form element ' . $typename);
logger('check_form_security_token failed: _REQUEST data: ' . print_r($_REQUEST, true), LOGGER_DATA);
notice( check_form_security_std_err_msg() );
- goaway($a->get_baseurl() . $err_redirect );
+ goaway(z_root() . $err_redirect );
}
}
function check_form_security_token_ForbiddenOnErr($typename = '', $formname = 'form_security_token') {
if (!check_form_security_token($typename, $formname)) {
- $a = get_app();
- logger('check_form_security_token failed: user ' . $a->user['guid'] . ' - form element ' . $typename);
+ logger('check_form_security_token failed: user ' . App::$observer['xchan_name'] . ' - form element ' . $typename);
logger('check_form_security_token failed: _REQUEST data: ' . print_r($_REQUEST, true), LOGGER_DATA);
header('HTTP/1.1 403 Forbidden');
killme();
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-26 16:46:55 +0000