svn: /web/php-master/trunk/ include/functions.inc include/login.inc manage/users.php

bjori Thu, 24 Mar 2011 16:16:36 +0000 Revision: http://svn.php.net/viewvc?view=revision&revision=309656 Log: Only allow login via https, and exit on already-authenticated-http access # No idea why I thought the other crap made sense Changed paths: U web/php-master/trunk/include/functions.inc U web/php-master/trunk/include/login.inc U web/php-master/trunk/manage/users.php Modified: web/php-master/trunk/include/functions.inc =================================================================== --- web/php-master/trunk/include/functions.inc 2011-03-24 16:12:18 UTC (rev 309655) +++ web/php-master/trunk/include/functions.inc 2011-03-24 16:16:36 UTC (rev 309656) @@ -34,15 +34,9 @@ <li><a href="http://wiki.php.net/">Wiki</a></li> <li><a href="http://bugs.php.net/">Bugsweb</a></li> </ul> +<?php warn("Have you changed your password yet?"); ?> <?php -if (!isset($_SERVER["HTTPS"]) || $_SERVER["HTTPS"] != "on") { - warn("Why are you not using https?"); -} else { - warn("Have you changed your password yet?"); } -?> -<?php -} function foot() { echo "</body></html>"; Modified: web/php-master/trunk/include/login.inc =================================================================== --- web/php-master/trunk/include/login.inc 2011-03-24 16:12:18 UTC (rev 309655) +++ web/php-master/trunk/include/login.inc 2011-03-24 16:16:36 UTC (rev 309656) @@ -12,14 +12,16 @@ list($user, $pw) = array($_POST['user'], $_POST['pw']); } elseif (isset($_SESSION["credentials"]) && count($_SESSION["credentials"]) == 2) { list($user, $pw) = $_SESSION["credentials"]; -} elseif (isset($_COOKIE['MAGIC_COOKIE'])) { - list($user, $pw) = explode(":", base64_decode($_COOKIE['MAGIC_COOKIE']), 2); } // Login form, if the user is not yet logged in if (!$user || !$pw || !verify_password($user,$pw)) { $_SESSION["credentials"] = array(); session_destroy(); + + if (!isset($_SERVER["HTTPS"]) || $_SERVER["HTTPS"] != "on") { + header("https://master.php.net/manage/" . basename($_SERVER["SCRIPT_NAME"])); + } ?> <html> @@ -51,6 +53,10 @@ } // At this point, we have logged in successfully +if (!isset($_SERVER["HTTPS"]) || $_SERVER["HTTPS"] != "on") { + exit("Bad puppy. Use https."); +} + $_SESSION["credentials"] = array($user, $pw); // Killing magic cookie Modified: web/php-master/trunk/manage/users.php =================================================================== --- web/php-master/trunk/manage/users.php 2011-03-24 16:12:18 UTC (rev 309655) +++ web/php-master/trunk/manage/users.php 2011-03-24 16:16:36 UTC (rev 309656) @@ -149,14 +149,9 @@ . ($in[passwd] ? ",pchanged=" . time() : "") . " WHERE userid=$id"; if ($in[passwd]) { - if (!isset($_SERVER["HTTPS"]) || $_SERVER["HTTPS"] != "on") { - warn("Did you actually try to change your password without using https? - Thats not gonna fly"); - } - else { - // Kill the session data after updates :) - $_SERVER["credentials"] = array(); - db_query($query); - } + // Kill the session data after updates :) + $_SERVER["credentials"] = array(); + db_query($query); } else { db_query($query); }