prefer getallheaders() over apache_request_headers()

Merge pull request #2432 from dokuwiki/tokenauth

Implement Token Authentication

Tokenauth: ignore case when gettign auth header from apache

Introduce token authentication #2431

This generates a JWT token for users. This token can be sent in a Bearer
authentication header as a login mechanism. Users can reset their token
in the profile.

Introduce token authentication #2431

This generates a JWT token for users. This token can be sent in a Bearer
authentication header as a login mechanism. Users can reset their token
in the profile.

Note: a previously suggested implementation used a custom token format,
not JWT tokens

show more ...

Fix updateProfile() not checking for removed $changes["pass"]

If the authentication plugin does not support modifying passwords, we
unset($changes['pass']) further above, but then the check for
$cha

Fix updateProfile() not checking for removed $changes["pass"]

If the authentication plugin does not support modifying passwords, we
unset($changes['pass']) further above, but then the check for
$changes['pass'] must also handle the case that we did indeed unset it.

show more ...

remove debug, fix codesniffer

use $auth instanceof AuthPlugin instead of not null check

unused items, phpdocs

code style: line breaks

code style: operator spacing

coding style: control flow line breaks

coding style: control flow whitespaces

recover comments in list

coding style: function call spacing

codestyle adjustments: function declaration braces/spaces

codestyle adjustments: function argument spacing

Apply rector fixes to the rest of inc

add setting to define the samesite cookie policy

As mentioned in
https://github.com/dokuwiki/dokuwiki/pull/3994#pullrequestreview-1473052428
there might be occasions when users might want to change

add setting to define the samesite cookie policy

As mentioned in
https://github.com/dokuwiki/dokuwiki/pull/3994#pullrequestreview-1473052428
there might be occasions when users might want to change the policy to a
stricter one or the somewhat more lenient Lax implementation of current
browsers.

show more ...

use samesite=Lax cookie attribute #2849

Since this has been the default in Chrome for a while, no sideeffects
are to be expected.

Check Basic Auth scheme in Authorization header

Prior to this, auth_setup() would simply assume that the Authorization
header was using the Basic auth scheme, but there are other available
ones, whi

Check Basic Auth scheme in Authorization header

Prior to this, auth_setup() would simply assume that the Authorization
header was using the Basic auth scheme, but there are other available
ones, which could result in incorrect processing of the header's data.

We now specifically check that we have the `Basic` scheme, and only then
perform the base64_decode to get the username and password.

show more ...

Merge pull request #3754 from splitbrain/sexplode

introduce sexplode() as a PHP8 safe explode()

Update core code to make use of sexplode()

This makes use of our own explode mechanism everywhere were we expect a
fixed number of results.

use $INPUT to access authentication environment #3750

This should fix warnings about missing data.

Remove Accept-Encoding from auth_browseruid()

Browsers do not send the same Accept-Encoding header for all requests, so using
it as part of auth_browseruid() can break things. For example, the audi

Remove Accept-Encoding from auth_browseruid()

Browsers do not send the same Accept-Encoding header for all requests, so using
it as part of auth_browseruid() can break things. For example, the audio
CAPTCHA in the official CAPTCHA plugin stopped matching its corresponding
image. Details here:

https://github.com/splitbrain/dokuwiki-plugin-captcha/issues/115#issuecomment-1215007408

show more ...

replace deprecated method calls