phpseclib is now namespaced

Fixed broken links to php.net and redirecting pages to php.net

Merge pull request #1504 from mape2k/authplain_fix_user_cache

Invalidate user session cache after profile data was changed (fix #1117)

removed support for loading authplugins by old name #1535

Invalidate user session cache after profile data was changed

remove unused token login. closes #1376

The token login was introduced for the flash uploader. Since it has been
removed there is no need for this code anymore.

correctly handle usergroups array

Fix scrutinizer issues with auth

Report more meaningful errors when an auth backend fails. closes #1093

Remove error supression for file_exists()

In an older version of PHP a file_exists() call would issue a warning
when the file did not exist. This was fixed in later PHP releases. Since
we require PH

Remove error supression for file_exists()

In an older version of PHP a file_exists() call would issue a warning
when the file did not exist. This was fixed in later PHP releases. Since
we require PHP 5.3 now, there's no need to supress any error here
anymore. This might even give a minor performance boost.

show more ...

Merge remote-tracking branch 'origin/master' into scrutinizerissues

Conflicts:
inc/media.php
inc/plugin.php
inc/template.php
lib/plugins/authplain/_test/escaping.test.php
lib/plugins/syntax.php

do not use Accept-Encoding in browser UID

Since Chrome 37, they send differen accept encodings for POST and GET
requests which will break BrowserUID checks as reported in
cosmocode/dokuwiki-plugin-o

do not use Accept-Encoding in browser UID

Since Chrome 37, they send differen accept encodings for POST and GET
requests which will break BrowserUID checks as reported in
cosmocode/dokuwiki-plugin-oauth/issues/3

See https://code.google.com/p/chromium/issues/detail?id=410559 for
official bug report at Google

show more ...

PHPDocs and some improvements

Many PHPDocs, some unused and dyn declared vars

many PHPDocs
some unused variables
some dynamically declared variables declared

more scrutinizer issue improvements

Merge pull request #868 from splitbrain/authclean

clean user credentials from control chars

Merge remote-tracking branch 'origin/auth_getUserData_improvements'

* origin/auth_getUserData_improvements:
KISS - remove class constants for REQUIRE_GROUPS & IGNORE_GROUPS and replace with boolea

Merge remote-tracking branch 'origin/auth_getUserData_improvements'

* origin/auth_getUserData_improvements:
KISS - remove class constants for REQUIRE_GROUPS & IGNORE_GROUPS and replace with boolean values
use $requireGroups constants in auth classes; comments; code improvements
fix comment errors, sp. & grammar
code styling - add missing braces
Allow user info to be retrieved without groups
Restore correct public interface of getUserData() for authldap plugin

Conflicts:
inc/common.php

show more ...

do not allow empty passwords

When a username but no password is submitted, the login is denied right
away instead of relying on the backend to refuse the login.

clean user credentials from control chars

This is to prevent zero byte attacks on external auth systems as
described in
http://www.freelists.org/post/dokuwiki/Fwd-Dokuwiki-maybe-security-issue-Null-

clean user credentials from control chars

This is to prevent zero byte attacks on external auth systems as
described in
http://www.freelists.org/post/dokuwiki/Fwd-Dokuwiki-maybe-security-issue-Null-byte-poisoning-in-LDAP-authentication

show more ...

Added @ALL handeling in auth_isMember

fix AUTH_USER_CHANGE event in profile updates

the triggered event did not allow event handlers to change the passed
data

KISS - remove class constants for REQUIRE_GROUPS & IGNORE_GROUPS and replace with boolean values

Allow user info to be retrieved without groups

Some parts of dokuwiki (e.g. recent changes, old revisions) can
requests lots of user info (to provide editor names) without
requiring any group inform

Allow user info to be retrieved without groups

Some parts of dokuwiki (e.g. recent changes, old revisions) can
requests lots of user info (to provide editor names) without
requiring any group information.

This change also implements caching of user info by authmysql &
authpgsql plugins to avoid repeated querying of the DB to retrieve
the same user information.

show more ...

amend $_SERVER to $INPUT->server

use isset() + ?: or error suppression where value may not be set