auth_en/decrypt: Add explanation and more efficient decryption

Added an explanation that what we do is like normal CBC but that we
additionally encrypt the IV which is actually suggested by the NIST

auth_en/decrypt: Add explanation and more efficient decryption

Added an explanation that what we do is like normal CBC but that we
additionally encrypt the IV which is actually suggested by the NIST for
non-random (but unique) IVs. In the decryption process it's not
necessary to decrypt the IV, this should save some time.

show more ...

auth_random: remove exception comment as there is no exception

Add AES from phpseclib and use it for cookie encryption

This replaces the deprecated and broken Blowfish implementation that has
previously been used and should provide a lot more security.

Use a new, truly random secret for cookie encryption

Fix and add type declarations for the auth system

Add truly random numbers and use them in places where randomness matters

removed tabs

Increased strength of auto generated passwords a bit

If you want better random initialization and more control over the
password strength install the passpolicy plugin.

fixed syntax fuckup

AUTH_PASSWORD_GENERATE event added

This is needed to replace the password generator by a plugin
implementation. Related to PR #166 and FS#2147

make password reset token completely random

No need for HMAC here because there's no length attack vector here. We
only care for the existance of the file and each reset request is
completely (rando

make password reset token completely random

No need for HMAC here because there's no length attack vector here. We
only care for the existance of the file and each reset request is
completely (random) independent from each other.

show more ...

use HMAC in password reset token FS#2794

fixed wrong use of quotes in authtype warning message

Fix wrong config key in deprecated auth message

restrict 'authtype deprecated' alert to superusers only

backward compatibility for old authtype settings

Fix remaining missing $INPUT uses FS#2577

This adds $INPUT in all places where it was still missing and available.
$INPUT is now also used in places where using $_REQUEST/... was okay in
order to ma

Fix remaining missing $INPUT uses FS#2577

This adds $INPUT in all places where it was still missing and available.
$INPUT is now also used in places where using $_REQUEST/... was okay in
order to make the code consistent.

show more ...

Fix handling of failed authentication loading

In the case of a failed authentication initialization, the
authentication setup was simply continued with an unset $auth object.
This restores the previ

Fix handling of failed authentication loading

In the case of a failed authentication initialization, the
authentication setup was simply continued with an unset $auth object.
This restores the previous behavior (before merging #141) of simply
returning after unsetting $auth. Furthermore this re-introduces the
check if $auth is set before checking $auth and removes a useless
check if $auth is true (could never be false).

show more ...

fixed auth_browseruid on IE9

IE9 send different HTTP_ACCEPT_LANGUAGE header on ajax request. This causes different results from auth_browseruid. This patch removes the HTTP_ACCEPT_LANGUAGE from the

fixed auth_browseruid on IE9

IE9 send different HTTP_ACCEPT_LANGUAGE header on ajax request. This causes different results from auth_browseruid. This patch removes the HTTP_ACCEPT_LANGUAGE from the browser id calculation.

show more ...

introduced http_status() for sending HTTP status code FS#1698

It seems, some servers require a special Status: header for sending the
HTTP status code from PHP (F)CGI to the server. This patch intro

introduced http_status() for sending HTTP status code FS#1698

It seems, some servers require a special Status: header for sending the
HTTP status code from PHP (F)CGI to the server. This patch introduces a
new function (adopted from CodeIgniter) for simplifying the status
handling.

show more ...

Merge branch 'master' into future

* master: (162 commits)
fixed revision JS for images
upgraded SimplePie to 1.3.1 FS#2708
removed obsolete browser plugin (migrate does it)
adjust spacing to

Merge branch 'master' into future

* master: (162 commits)
fixed revision JS for images
upgraded SimplePie to 1.3.1 FS#2708
removed obsolete browser plugin (migrate does it)
adjust spacing to match standard 1.4em grid
added comment on use of whitelist vs blacklist
Updated idfilter() function for IIS
use var and remove suggestions when needed Use variable for maximum number of suggestions for quicksearch. And hide suggestions when search field is emptied, or when no suggestion are found.
added 'home' class to first link in hierarchical breadcrumbs
reduced required max width to go into tablet mode
re-added linear gradients for firefox
added missing styling for disabled form elements (FS#2705)
fixed acronyms in italics (FS#2684)
improved print styles (includes fixes for FS#2645 and FS#2707)
basic styles improvements
Greek language update
Use list in acl help text, for more structure
Galician language update
touch the config on save, even if no changes were made
unwind the width narrowing commit
put some whitespace between form submit button and fieldset bottom border
...

Conflicts:
lib/plugins/config/admin.php
lib/plugins/config/settings/config.class.php

show more ...

Merge branch 'subscription' Pull Request #125

* subscription: (25 commits)
link directly to subscription management in mails
only use mailfromnobody for bulk mails
added missing context for li

Merge branch 'subscription' Pull Request #125

* subscription: (25 commits)
link directly to subscription management in mails
only use mailfromnobody for bulk mails
added missing context for list mails
readded mailfromnobody to subscription sending
correctly escape diffs in HTML mails
fixed lists in HTML mails
simplified subscription->add() code a bit
comment adjusted
removed unused vars
removed data parameter in subscription_handle_post()
fixed tests
some reformatting
added compatibility function
moved registration notification to subscription class
fixed merge error in inc/auth.php
consolidate more notification code in subscription class
minor cleanup
initialize new subscriptions with current time
fixed subscription management
correctly check if subscriptions are enabled
...

show more ...

Made auth_aclcheck always return int

The returned type is important in particular when we deal with xmlrpc. Indeed,
this value is directly returned to the client eg when the wiki.getAllPages method

Made auth_aclcheck always return int

The returned type is important in particular when we deal with xmlrpc. Indeed,
this value is directly returned to the client eg when the wiki.getAllPages method
is queried.

Currently the 'perms' attribute may be either an int or a string, and its up to
the xmlrpc client to resolve it (although Dokuwiki's documentation only tells it
can be an int).

This patch makes sure we'll always return perms as int.

show more ...

moved registration notification to subscription class

fixed merge error in inc/auth.php

merged the wrong change here