bind non-sticky logins to the session id FS#2202

store session pass as hash

This avoids having the blowfish encrypted pass stored together with the
decryption key on the same server.

improved actionOK and its use

refactored passowrd hashing functions to a class

this splits the long auth_cryptPassword() function into many member
functions of a new class PassHash which should make it more
maintainable and reus

refactored passowrd hashing functions to a class

this splits the long auth_cryptPassword() function into many member
functions of a new class PassHash which should make it more
maintainable and reusable for other projects.

This also adds two new methods djangomd5 and djangosha1 as used by the
popular python framework Django.

Maybe the auth_cryptPassword() and auth_verifyPassword() functions
should be deprecated in favor of using the class directly?

show more ...

Handle renamed authorization variables

Sometimes (when using rewriting with the workaround for CGI mode
described at
http://www.besthostratings.com/articles/http-auth-php-cgi.html) the
HTTP_AUTHORIZ

Handle renamed authorization variables

Sometimes (when using rewriting with the workaround for CGI mode
described at
http://www.besthostratings.com/articles/http-auth-php-cgi.html) the
HTTP_AUTHORIZATION variable is renamed, this change detects this
renaming and uses the renamed variable.

show more ...

Added support for Wordpress' password hashing FS#2134

Merge branch 'master' of github.com:splitbrain/dokuwiki

If cookiedir is configured, use it.

If $conf['cookiedir'] is set, use this setting instead of DOKU_REL.

Fix handling of case in auth_isMember; add and fix test cases

preg_quote namespaces in auth_aclcheck

Like ids namespaces are now preg_quoted in the acl check (and therefore
the escaping of "*" has been removed). When plugins call the ACL check
function with st

preg_quote namespaces in auth_aclcheck

Like ids namespaces are now preg_quoted in the acl check (and therefore
the escaping of "*" has been removed). When plugins call the ACL check
function with strange ids the regex fails otherwise (in the case of the
include plugin errors like "Warning: preg_grep() [function.preg-grep]:
Compilation failed: missing terminating ] for character class at offset
47" have been reported by two users).

I've run the acl tests after this change and everything passes so this
shouldn't break anything but please test this especially with protected
wikis as this change modifies the code that handles namespace
permissions. Furthermore permissions for a namespace foobar are no
longer applied to namespaces with names like foo.ar, I hope nobody has
used that "feature".

When you are using per-user namespaces, user registration is open and
either write or read protection for these namespaces is important to
you this is a security fix for you: When someone wants to get access to
the namespace of a user "foo.bar" he can register as "fooxbar" (where
"x" is an arbitrary character) and will have access to the user
namespace of the user "foo.bar" as when a page in "foo.bar" is checked
it will match the rule for "fooxbar".

show more ...

added auth_isMember()

This function abstracts checking a given user and her groups against a
given member list (as used in the superuser and manager options).

It is also used in auth_isManager() an

added auth_isMember()

This function abstracts checking a given user and her groups against a
given member list (as used in the superuser and manager options).

It is also used in auth_isManager() and auth_isAdmin(), unlike the
previous function, this one skips the nameencode step as it should be
unnessary here (all input is given decoded).

The test cases where extended by some non-ID user and group names.

People with non-plain auth backends should check that their
administrator and manager setups still work as expected

show more ...

tmp

Remove enc=utf-8 in VIM modeline as it is not allowed in VIM 7.3

As of VIM 7.3 it is no longer possible to specify the encoding in the
modeline. This gives an error message whenever such a file is o

Remove enc=utf-8 in VIM modeline as it is not allowed in VIM 7.3

As of VIM 7.3 it is no longer possible to specify the encoding in the
modeline. This gives an error message whenever such a file is opened,
thus this commit removes the enc setting from the modeline.

show more ...

a more correct fix for FS#2039

properly encode user wildcard in ACLs FS#2039

Do not allow empty strings as superuser or manager FS#2009

Use config_cascade for ACLs and plain auth users FS#1677

fixed wildcard handling in ACL manager FS#1955

This patch also removes legacy support for @USER@. Only %USER% is valid
now.

new auth capability 'logout'

This patch implements what Adrian's patch "Hide logout button if auth
backend cannot logout" intended to do.

The 'logoff' capability was used to decide if a special met

new auth capability 'logout'

This patch implements what Adrian's patch "Hide logout button if auth
backend cannot logout" intended to do.

The 'logoff' capability was used to decide if a special method called
$auth->logOff() should be called when the user logs out, not if the
backend supports logouts at all. This was a superflous capability since
an empty logOff() method is implemented in the base class anyway - it
doesn't hurt to always call the method.

The 'logoff' capability is now deprecated. Backends who want to do
actions on logout simply need to overwrite logOff().

A new capability 'logout' was added which defaults to true. Backends
that can't logoff the user (eg. because they use some automatic
login/logoff mechanism) can set this to false.

Probably makes sense to add a 'login' capability as well...

show more ...

Avoid broken ACL check if Auth Backend fails

Fixed selffail.

No warning for an undefined variable

first attempt to centralize all include loading

Classes are loaded throug PHP5's class autoloader, all other
includes are just loaded by default. This skips a lot of
require_once calls.

Parser and

first attempt to centralize all include loading

Classes are loaded throug PHP5's class autoloader, all other
includes are just loaded by default. This skips a lot of
require_once calls.

Parser and Plugin stuff isn't handled by the class loader yet.

show more ...

Provide AFTER event for AUTH_LOGIN_CHECK

Ignore-this: 804d0837b9a04e4f82e6b54765f453cf

darcs-hash:20091215095430-e4919-19c61854c27fdade90caeed035445ee3396b0095.gz

correctly check auth capabilities on update profile FS#1329

Ignore-this: fb853b40911201a41c237d69d91f7d24

darcs-hash:20091128111547-6ad63-0432d3b190946b2b8f7c292119e034cdcdae3a00.gz