removed pre PHP 5.2 code wrt setcookie and session setting

- moved cookiedir determination in the if-statement

PHPDocs auth.php

AUTH_ACL_CHECK event around ACL checking

allows to modify ACL results in the AFTER event or to implement a
completely different ACL mechanism in the BEFORE event.

replace \s, \S with [ \t], [^ \t] in regexs used with acls

replace boolean conditional checks on possibly uninitialized vars with \!empty/empty/isset as appropriate

update for deprecated '/e' flag in preg_replace (php 5.5)

Fix CodeSniffer whitespace violoations

Removed extraneous whitespace to eliminate errors reported by the
Squiz.WhiteSpace.SuperfluousWhitespace sniff.

Fix CodeSniffer violations

Change indentation to ensure code confirms to CodeSniffer rules.

Fix CodeSniffer violations

Remove whitespace from end of lines to reduce the number of CodeSniffer
violations.

Fix a couple of bugs in ACL substitution mechanism

- %GROUP% & %USER% can now both be used in the same rule, e.g.

%GROUP%:%USER% 2

- rules with tokens will be skipped when the user is not logge

Fix a couple of bugs in ACL substitution mechanism

- %GROUP% & %USER% can now both be used in the same rule, e.g.

%GROUP%:%USER% 2

- rules with tokens will be skipped when the user is not logged in
previously %USER% was attempted

show more ...

Merge branch 'FS#2751' of git://github.com/splitbrain/dokuwiki into pull-request-245

* 'FS#2751' of git://github.com/splitbrain/dokuwiki:
coding corrections. correct type hint, remove unused varia

Merge branch 'FS#2751' of git://github.com/splitbrain/dokuwiki into pull-request-245

* 'FS#2751' of git://github.com/splitbrain/dokuwiki:
coding corrections. correct type hint, remove unused variable assignment
de/de-informal: localization updates (delete user function)
unit tests for self deleting of user accounts
FS#2751 - self deletion of user account

show more ...

coding corrections. correct type hint, remove unused variable assignment

Merge pull request #246 from splitbrain/profileform_improvements

HTML5isation of some forms

Change error message shown for incorrect current password on update profile form.

The current message confusingly mentions bad 'username' when username is not involved. The
new message is the same

Change error message shown for incorrect current password on update profile form.

The current message confusingly mentions bad 'username' when username is not involved. The
new message is the same as that introduced for an incorrect current password on the self
delete profile form (FS#2751)

show more ...

FS#2751 - self deletion of user account

auth_en/decrypt: Add explanation and more efficient decryption

Added an explanation that what we do is like normal CBC but that we
additionally encrypt the IV which is actually suggested by the NIST

auth_en/decrypt: Add explanation and more efficient decryption

Added an explanation that what we do is like normal CBC but that we
additionally encrypt the IV which is actually suggested by the NIST for
non-random (but unique) IVs. In the decryption process it's not
necessary to decrypt the IV, this should save some time.

show more ...

auth_random: remove exception comment as there is no exception

Add AES from phpseclib and use it for cookie encryption

This replaces the deprecated and broken Blowfish implementation that has
previously been used and should provide a lot more security.

Use a new, truly random secret for cookie encryption

Fix and add type declarations for the auth system

Add truly random numbers and use them in places where randomness matters

removed tabs

Increased strength of auto generated passwords a bit

If you want better random initialization and more control over the
password strength install the passpolicy plugin.

fixed syntax fuckup

AUTH_PASSWORD_GENERATE event added

This is needed to replace the password generator by a plugin
implementation. Related to PR #166 and FS#2147