From 3affb2e8172b4cc673aafe9551c21dad6f606d87 Mon Sep 17 00:00:00 2001 From: redmatrix Date: Wed, 20 Jul 2016 17:55:40 -0700 Subject: sort out some of the authentication mess - with luck this may fix the DAV auth issue which I simply could not duplicate or find a reason for. --- Zotlabs/Storage/BasicAuth.php | 37 ++++++++++++------------------------- 1 file changed, 12 insertions(+), 25 deletions(-) (limited to 'Zotlabs/Storage/BasicAuth.php') diff --git a/Zotlabs/Storage/BasicAuth.php b/Zotlabs/Storage/BasicAuth.php index 9c73b47b9..67617b637 100644 --- a/Zotlabs/Storage/BasicAuth.php +++ b/Zotlabs/Storage/BasicAuth.php @@ -91,33 +91,20 @@ class BasicAuth extends DAV\Auth\Backend\AbstractBasic { require_once('include/auth.php'); $record = account_verify_password($username, $password); - if ($record && $record['account_default_channel']) { - $r = q("SELECT * FROM channel WHERE channel_account_id = %d AND channel_id = %d LIMIT 1", - intval($record['account_id']), - intval($record['account_default_channel']) - ); - if($r && $this->check_module_access($r[0]['channel_id'])) { - return $this->setAuthenticated($r[0]); + if($record && $record['account']) { + if($record['channel']) + $channel = $record['channel']; + else { + $r = q("SELECT * FROM channel WHERE channel_account_id = %d AND channel_id = %d LIMIT 1", + intval($record['account']['account_id']), + intval($record['account']['account_default_channel']) + ); + if($r) + $channel = $r[0]; } } - $r = q("SELECT * FROM channel WHERE channel_address = '%s' LIMIT 1", - dbesc($username) - ); - if ($r) { - $x = q("SELECT account_flags, account_salt, account_password FROM account WHERE account_id = %d LIMIT 1", - intval($r[0]['channel_account_id']) - ); - if ($x) { - // @fixme this foreach should not be needed? - foreach ($x as $record) { - if ((($record['account_flags'] == ACCOUNT_OK) || ($record['account_flags'] == ACCOUNT_UNVERIFIED)) - && (hash('whirlpool', $record['account_salt'] . $password) === $record['account_password'])) { - logger('password verified for ' . $username); - if($this->check_module_access($r[0]['channel_id'])) - return $this->setAuthenticated($r[0]); - } - } - } + if($channel && $this->check_module_access($channel['channel_id'])) { + return $this->setAuthenticated($channel); } if($this->module_disabled) -- cgit v1.2.3 From bc8c74eb422387a5537eb923c90a34c1196ce568 Mon Sep 17 00:00:00 2001 From: redmatrix Date: Wed, 20 Jul 2016 17:55:40 -0700 Subject: sort out some of the authentication mess - with luck this may fix the DAV auth issue which I simply could not duplicate or find a reason for. --- Zotlabs/Storage/BasicAuth.php | 37 ++++++++++++------------------------- 1 file changed, 12 insertions(+), 25 deletions(-) (limited to 'Zotlabs/Storage/BasicAuth.php') diff --git a/Zotlabs/Storage/BasicAuth.php b/Zotlabs/Storage/BasicAuth.php index 60fc2c988..e94a5c1dc 100644 --- a/Zotlabs/Storage/BasicAuth.php +++ b/Zotlabs/Storage/BasicAuth.php @@ -91,33 +91,20 @@ class BasicAuth extends DAV\Auth\Backend\AbstractBasic { require_once('include/auth.php'); $record = account_verify_password($username, $password); - if ($record && $record['account_default_channel']) { - $r = q("SELECT * FROM channel WHERE channel_account_id = %d AND channel_id = %d LIMIT 1", - intval($record['account_id']), - intval($record['account_default_channel']) - ); - if($r && $this->check_module_access($r[0]['channel_id'])) { - return $this->setAuthenticated($r[0]); + if($record && $record['account']) { + if($record['channel']) + $channel = $record['channel']; + else { + $r = q("SELECT * FROM channel WHERE channel_account_id = %d AND channel_id = %d LIMIT 1", + intval($record['account']['account_id']), + intval($record['account']['account_default_channel']) + ); + if($r) + $channel = $r[0]; } } - $r = q("SELECT * FROM channel WHERE channel_address = '%s' LIMIT 1", - dbesc($username) - ); - if ($r) { - $x = q("SELECT account_flags, account_salt, account_password FROM account WHERE account_id = %d LIMIT 1", - intval($r[0]['channel_account_id']) - ); - if ($x) { - // @fixme this foreach should not be needed? - foreach ($x as $record) { - if ((($record['account_flags'] == ACCOUNT_OK) || ($record['account_flags'] == ACCOUNT_UNVERIFIED)) - && (hash('whirlpool', $record['account_salt'] . $password) === $record['account_password'])) { - logger('password verified for ' . $username); - if($this->check_module_access($r[0]['channel_id'])) - return $this->setAuthenticated($r[0]); - } - } - } + if($channel && $this->check_module_access($channel['channel_id'])) { + return $this->setAuthenticated($channel); } if($this->module_disabled) -- cgit v1.2.3 From 63123759ed5d226cb97063746d35da01475670a6 Mon Sep 17 00:00:00 2001 From: redmatrix Date: Thu, 21 Jul 2016 15:50:07 -0700 Subject: DAV auth issue --- Zotlabs/Storage/BasicAuth.php | 1 + 1 file changed, 1 insertion(+) (limited to 'Zotlabs/Storage/BasicAuth.php') diff --git a/Zotlabs/Storage/BasicAuth.php b/Zotlabs/Storage/BasicAuth.php index 67617b637..38d984d19 100644 --- a/Zotlabs/Storage/BasicAuth.php +++ b/Zotlabs/Storage/BasicAuth.php @@ -165,6 +165,7 @@ class BasicAuth extends DAV\Auth\Backend\AbstractBasic { function check(RequestInterface $request, ResponseInterface $response) { if(local_channel()) { + this->setAuthenticated(\App::get_channel()); return [ true, $this->principalPrefix . $this->channel_name ]; } -- cgit v1.2.3 From 77a021025ff4c8dac6fb416031257e952de89914 Mon Sep 17 00:00:00 2001 From: redmatrix Date: Thu, 21 Jul 2016 15:50:07 -0700 Subject: DAV auth issue --- Zotlabs/Storage/BasicAuth.php | 1 + 1 file changed, 1 insertion(+) (limited to 'Zotlabs/Storage/BasicAuth.php') diff --git a/Zotlabs/Storage/BasicAuth.php b/Zotlabs/Storage/BasicAuth.php index e94a5c1dc..69eaed705 100644 --- a/Zotlabs/Storage/BasicAuth.php +++ b/Zotlabs/Storage/BasicAuth.php @@ -165,6 +165,7 @@ class BasicAuth extends DAV\Auth\Backend\AbstractBasic { function check(RequestInterface $request, ResponseInterface $response) { if(local_channel()) { + this->setAuthenticated(\App::get_channel()); return [ true, $this->principalPrefix . $this->channel_name ]; } -- cgit v1.2.3 From 5a1eb65ed6897376c12d859b56c3cf6b5cc4f5e4 Mon Sep 17 00:00:00 2001 From: Mario Vavti Date: Fri, 22 Jul 2016 01:07:53 +0200 Subject: missing $ --- Zotlabs/Storage/BasicAuth.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'Zotlabs/Storage/BasicAuth.php') diff --git a/Zotlabs/Storage/BasicAuth.php b/Zotlabs/Storage/BasicAuth.php index 69eaed705..2325a614b 100644 --- a/Zotlabs/Storage/BasicAuth.php +++ b/Zotlabs/Storage/BasicAuth.php @@ -165,7 +165,7 @@ class BasicAuth extends DAV\Auth\Backend\AbstractBasic { function check(RequestInterface $request, ResponseInterface $response) { if(local_channel()) { - this->setAuthenticated(\App::get_channel()); + $this->setAuthenticated(\App::get_channel()); return [ true, $this->principalPrefix . $this->channel_name ]; } @@ -263,4 +263,4 @@ class BasicAuth extends DAV\Auth\Backend\AbstractBasic { logger('owner_id ' . $this->owner_id, LOGGER_DATA); logger('owner_nick ' . $this->owner_nick, LOGGER_DATA); } -} \ No newline at end of file +} -- cgit v1.2.3