Auth/Mailer: properly handle usernames including a comma

Prevent splitting of e-mail addresses at the wrong point by enclosing a username in '"'.
The "To" e-mail address in the notification mail was

Auth/Mailer: properly handle usernames including a comma

Prevent splitting of e-mail addresses at the wrong point by enclosing a username in '"'.
The "To" e-mail address in the notification mail was malformed if a new user was added
and included a ',' in it's name. Fixes #1569.

show more ...

remove DOKU_INC checks

There is no need for this check, since these files should not have any
main code that is executed on direct call.

Fixes PSR1.Files.SideEffects.FoundWithSymbols

tests: use non-empty string for static salt

As pointed out by @klap-in, an empty string may evaluate to false in
some circumstances. This is something we may not want. Using a string
like 'test' sho

tests: use non-empty string for static salt

As pointed out by @klap-in, an empty string may evaluate to false in
some circumstances. This is something we may not want. Using a string
like 'test' should therefore be more robust.

show more ...

feat: make auth salt static in test environments

There are circumstances where we may want to test generated content that
uses the auth salt, for example when one tests the rendering of external
ima

feat: make auth salt static in test environments

There are circumstances where we may want to test generated content that
uses the auth salt, for example when one tests the rendering of external
images where the url contains a token from media_get_token

show more ...

use 403 response on bad logins. closes #1937

Merge branch 'master' into phpseclib

* master: (54 commits)
updated geshi
authpdo - use type safe comparison on passwords. fixes #1765
removed unneeded files from random_compat
Use cryptogra

Merge branch 'master' into phpseclib

* master: (54 commits)
updated geshi
authpdo - use type safe comparison on passwords. fixes #1765
removed unneeded files from random_compat
Use cryptographically secure pseudo random number generator (CSPRNG)
translation update
translation update
translation update
translation update
translation update
or maybe I only now figured out the right travis config :-/
disable 7.1 testing completely
allow 7.1 failures until it's released #1682
DE translation for key 'protected'
Use 'Benachrichtigung' instead of 'Notifikation'
Fix spelling of some terms (lower to upper case)
DE translation for key: addUser_error_missing_pass
DE translation for keys: update_name, update_mail
translation update
translation update
Implemented interwiki substitution for external images (issue #1614).
...

show more ...

Use cryptographically secure pseudo random number generator (CSPRNG)

Uses paragonie/random_compat instead of insecure home-brewed code.

It's NEVER fine to fall back to mt_rand() for secure random.

Use cryptographically secure pseudo random number generator (CSPRNG)

Uses paragonie/random_compat instead of insecure home-brewed code.

It's NEVER fine to fall back to mt_rand() for secure random.

Fixes #1760.

show more ...

phpseclib is now namespaced

Fixed broken links to php.net and redirecting pages to php.net

Merge pull request #1504 from mape2k/authplain_fix_user_cache

Invalidate user session cache after profile data was changed (fix #1117)

removed support for loading authplugins by old name #1535

Invalidate user session cache after profile data was changed

remove unused token login. closes #1376

The token login was introduced for the flash uploader. Since it has been
removed there is no need for this code anymore.

correctly handle usergroups array

Fix scrutinizer issues with auth

Report more meaningful errors when an auth backend fails. closes #1093

Remove error supression for file_exists()

In an older version of PHP a file_exists() call would issue a warning
when the file did not exist. This was fixed in later PHP releases. Since
we require PH

Remove error supression for file_exists()

In an older version of PHP a file_exists() call would issue a warning
when the file did not exist. This was fixed in later PHP releases. Since
we require PHP 5.3 now, there's no need to supress any error here
anymore. This might even give a minor performance boost.

show more ...

Merge remote-tracking branch 'origin/master' into scrutinizerissues

Conflicts:
inc/media.php
inc/plugin.php
inc/template.php
lib/plugins/authplain/_test/escaping.test.php
lib/plugins/syntax.php

do not use Accept-Encoding in browser UID

Since Chrome 37, they send differen accept encodings for POST and GET
requests which will break BrowserUID checks as reported in
cosmocode/dokuwiki-plugin-o

do not use Accept-Encoding in browser UID

Since Chrome 37, they send differen accept encodings for POST and GET
requests which will break BrowserUID checks as reported in
cosmocode/dokuwiki-plugin-oauth/issues/3

See https://code.google.com/p/chromium/issues/detail?id=410559 for
official bug report at Google

show more ...

PHPDocs and some improvements

Many PHPDocs, some unused and dyn declared vars

many PHPDocs
some unused variables
some dynamically declared variables declared

more scrutinizer issue improvements

Merge pull request #868 from splitbrain/authclean

clean user credentials from control chars

Merge remote-tracking branch 'origin/auth_getUserData_improvements'

* origin/auth_getUserData_improvements:
KISS - remove class constants for REQUIRE_GROUPS & IGNORE_GROUPS and replace with boolea

Merge remote-tracking branch 'origin/auth_getUserData_improvements'

* origin/auth_getUserData_improvements:
KISS - remove class constants for REQUIRE_GROUPS & IGNORE_GROUPS and replace with boolean values
use $requireGroups constants in auth classes; comments; code improvements
fix comment errors, sp. & grammar
code styling - add missing braces
Allow user info to be retrieved without groups
Restore correct public interface of getUserData() for authldap plugin

Conflicts:
inc/common.php

show more ...

do not allow empty passwords

When a username but no password is submitted, the login is denied right
away instead of relying on the backend to refuse the login.