Home Explore Help
Register Sign In
biotorrents
/
Gazelle
forked from Oppaitime/Gazelle
Watch 2
Star 0
Fork 0
Code Issues 0 Pull Requests 0 Releases 2 Wiki Activity
Browse Source

Account recovery still broken (server sessions?)

biotorrents 4 years ago
parent
12bf8ee2da
commit
443a75e6db
11 changed files with 112 additions and 30 deletions
Split View Show Diff Stats
  1. 1
    1
      classes/config.template
  2. 44
    0
      classes/input.class.php
  3. 2
    1
      classes/mysql.class.php
  4. 0
    3
      sections/login/index.php
  5. 1
    2
      sections/login/login.php
  6. 7
    4
      sections/login/recover_step2.php
  7. 1
    1
      sections/register/step1.php
  8. 16
    15
      sections/torrents/download.php
  9. 4
    1
      sections/upload/upload_handle.php
  10. 1
    1
      sections/user/edit.php
  11. 35
    1
      static/functions/password_validate.js

+ 1
- 1
classes/config.template View File 

@@ -421,7 +421,7 @@ ENV::setPub('BLOCK_OPERA_MINI', true);
421 421 
 # Misc stuff like generic reusable snippets
422 422 
 # Example of a variable using heredoc syntax
423 423 
 ENV::setPub(
424 
-    'PASSWORD_ADVICE',
424 
+    'PW_ADVICE',
425 425 
     <<<HTML
426 426 
     <p>
427 427 
       Any password 15 characters or longer is accepted, but a strong password

+ 44
- 0
classes/input.class.php View File 

@@ -0,0 +1,44 @@
1 
+<?php
2 
+declare(strict_types=1);
3 
+
4 
+/**
5 
+ * Input class
6 
+ *
7 
+ * An attempt to normalize and secure form inputs.
8 
+ */
9 
+
10 
+class Input {
11 
+
12 
+    /**
13 
+     * passphrase
14 
+     */
15 
+    function passphrase(
16 
+        string $Name = 'password',
17 
+        string $ID = 'password',
18 
+        string $Placeholder = 'Passphrase',
19 
+        bool $Advice = false) {
20 
+        $ENV = ENV::go();
21 
+
22 
+        # Input validation
23 
+        if (!is_string($Name) || empty($Name)) {
24 
+            error("Expected non-empty string, got \$Name = $Name in Input::passphrase.");
25 
+        }
26 
+
27 
+        if (!empty($Advice) && $Advice !== true || $Advice !== false) {
28 
+            error("Expected true|false, got \$Advice = $Advice in Input::passphrase.");
29 
+        }
30 
+
31 
+        $Field = <<<HTML
32 
+        <input type="password" name="$Name" id="$ID" placeholder="$Placeholder"
33 
+          minlength="$ENV->PW_MIN" maxlength="$ENV->PW_MAX"
34 
+          class="inputtext" autocomplete="off" required="required" />
35 
+HTML;
36 
+
37 
+if ($Advice) {
38 
+    return $Field . $ENV->PW_ADVICE;
39 
+} else {
40 
+    return $Field;
41 
+}
42 
+
43 
+    }
44 
+}

+ 2
- 1
classes/mysql.class.php View File 

@@ -270,6 +270,7 @@ class DB_MYSQL
270 270 
                 $this->Database,
271 271 
                 $this->Port,
272 272 
                 $this->Socket,
273 
+                # Needed for self-signed certs
273 274 
                 MYSQLI_CLIENT_SSL_DONT_VERIFY_SERVER_CERT
274 275 
             );
275 276 
 
@@ -289,8 +290,8 @@ class DB_MYSQL
289 290 
     public function prepare_query($Query, &...$BindVars)
290 291 
     {
291 292 
         $this->connect();
292 
-
293 293 
         $this->StatementID = mysqli_prepare($this->LinkID, $Query);
294 
+
294 295 
         if (!empty($BindVars)) {
295 296 
             $Types = '';
296 297 
             $TypeMap = ['string'=>'s', 'double'=>'d', 'integer'=>'i', 'boolean'=>'i'];

+ 0
- 3
sections/login/index.php View File 

@@ -1,8 +1,6 @@
1 1 
 <?php
2 2 
 #declare(strict_types=1);
3 3
4 
-# Unsure if require_once is needed here
5 
-require_once 'classes/env.class.php';
6 4 
 $ENV = ENV::go();
7 5
8 6 
 /*-- todo ---------------------------//
 
@@ -33,7 +31,6 @@ $Validate = new Validate;
33 31 
 $TwoFA = new TwoFactorAuth($ENV->SITE_NAME);
34 32 
 $U2F = new u2f\U2F('https://'.SITE_DOMAIN);
35 33
36 
-# todo: Test strict equality very gently here
37 34 
 if (array_key_exists('action', $_GET) && $_GET['action'] === 'disabled') {
38 35 
     require('disabled.php');
39 36 
     error();

+ 1
- 2
sections/login/login.php View File 

@@ -47,8 +47,7 @@ if (!$Banned) { ?>
47 47
48 48 
     <tr>
49 49 
       <td>
50 
-        <input type="password" minlength="15" name="password" id="password" class="inputtext" required="required"
51 
-          maxlength="307200" pattern=".{15,307200}" placeholder="Password" autocomplete="current-password" />
50 
+        <?= Input::passphrase() ?>
52 51 
       </td>
53 52
54 53 
       <td>

+ 7
- 4
sections/login/recover_step2.php View File 

@@ -9,10 +9,7 @@ echo '<h2>Reset your password</h2>';
9 9 
 if (empty($PassWasReset)) {
10 10 
     if (!empty($Err)) { ?>
11 11 
 <strong class="important_text"><?=display_str($Err)?></strong><br /><br />
12 
-<?php
13 
-}
14 
-
15 
-    echo $ENV->PASSWORD_ADVICE; ?>
12 
+<?php } ?>
16 13
17 14 
 <form class="auth_form" name="recovery" id="recoverform" method="post" action="" onsubmit="return formVal();">
18 15 
   <input type="hidden" name="key"
 
@@ -25,8 +22,11 @@ if (empty($PassWasReset)) {
25 22 
       </td>
26 23
27 24 
       <td>
25 
+        <?= Input::passphrase($Name = 'password', $ID='new_pass_1', $Placeholder = 'New passphrase') ?>
26 
+        <!--
28 27 
         <input type="password" minlength="15" name="password" id="new_pass_1" class="inputtext" size="40"
29 28 
           placeholder="New Password" pattern=".{15,307200}" required style="width: 250px !important;">
29 
+        -->
30 30 
       </td>
31 31 
     </tr>
32 32 
 
@@ -35,8 +35,11 @@ if (empty($PassWasReset)) {
35 35 
         <strong id="pass_match"></strong>
36 36 
       </td>
37 37 
       <td>
38 
+        <?= Input::passphrase($Name = 'verifypassword', $ID='new_pass_2', $Placeholder = 'Confirm passphrase') ?>
39 
+        <!--
38 40 
         <input type="password" minlength="15" name="verifypassword" id="new_pass_2" class="inputtext" size="40"
39 41 
           placeholder="Confirm Password" pattern=".{15,307200}" required style="width: 250px !important;">
42 
+        -->
40 43 
       </td>
41 44 
     </tr>
42 45

+ 1
- 1
sections/register/step1.php View File 

@@ -65,7 +65,7 @@ if (empty($Sent)) { ?>
65 65 
         <input type="password" minlength="15" name="confirm_password" id="new_pass_2" class="inputtext"
66 66 
           placeholder="Confirm Password" />
67 67 
         <strong id="pass_match"></strong>
68 
-        <?= $ENV->PASSWORD_ADVICE ?>
68 
+        <?= $ENV->PW_ADVICE ?>
69 69 
       </td>
70 70 
     </tr>
71 71

+ 16
- 15
sections/torrents/download.php View File 

@@ -67,22 +67,23 @@ if (Misc::in_array_partial($_SERVER['HTTP_USER_AGENT'], $ScriptUAs)) {
67 67
68 68 
 $Info = $Cache->get_value('torrent_download_'.$TorrentID);
69 69 
 if (!is_array($Info) || !array_key_exists('PlainArtists', $Info) || empty($Info[10])) {
70 
-    $DB->query("
70 
+    $DB->prepare_query("
71 71 
       SELECT
72 
-        t.Media,
73 
-        t.Version,
74 
-        t.Codec,
75 
-        tg.Year,
76 
-        tg.ID AS GroupID,
77 
-        COALESCE(NULLIF(tg.Name,''), NULLIF(tg.Title2,''), tg.NameJP) AS Name,
78 
-        tg.WikiImage,
79 
-        tg.CategoryID,
80 
-        t.Size,
81 
-        t.FreeTorrent,
82 
-        HEX(t.info_hash)
83 
-      FROM torrents AS t
84 
-        INNER JOIN torrents_group AS tg ON tg.ID = t.GroupID
85 
-      WHERE t.ID = '".db_string($TorrentID)."'");
72 
+        t.`Media`,
73 
+        t.`Version`,
74 
+        t.`Codec`,
75 
+        tg.`year`,
76 
+        tg.`id` AS GroupID,
77 
+        COALESCE(NULLIF(tg.`title`,''), NULLIF(tg.`subject`,''), tg.`object`) AS Name,
78 
+        tg.`picture`,
79 
+        tg.`category_id`,
80 
+        t.`Size`,
81 
+        t.`FreeTorrent`,
82 
+        HEX(t.`info_hash`)
83 
+      FROM `torrents` AS t
84 
+        INNER JOIN `torrents_group` AS tg ON tg.`id` = t.`GroupID`
85 
+      WHERE t.`ID` = '".db_string($TorrentID)."'");
86 
+      $DB->exec_prepared_query();
86 87
87 88 
     if (!$DB->has_results()) {
88 89 
         error(404);

+ 4
- 1
sections/upload/upload_handle.php View File 

@@ -793,7 +793,10 @@ if ($T['FreeLeechType'] === 3) {
793 793 
 //******************************************************************************//
794 794 
 //--------------- Write torrent file -------------------------------------------//
795 795
796 
-file_put_contents(TORRENT_STORE.$TorrentID.'.torrent', $Tor->encode());
796 
+$FileName = "$ENV->TORRENT_STORE/$TorrentID.torrent";
797 
+file_put_contents($FileName, $Tor->encode());
798 
+chmod($FileName, 0400);
799 
+
797 800 
 Misc::write_log("Torrent $TorrentID ($LogName) (".number_format($TotalSize / (1024 * 1024), 2).' MB) was uploaded by ' . $LoggedUser['Username']);
798 801 
 Torrents::write_group_log($GroupID, $TorrentID, $LoggedUser['ID'], 'uploaded ('.number_format($TotalSize / (1024 * 1024), 2).' MB)', 0);
799 802

+ 1
- 1
sections/user/edit.php View File 

@@ -1398,7 +1398,7 @@ list($ArtistsAdded) = $DB->next_record();
1398 1398 
             </div>
1399 1399
1400 1400 
             <p class="setting_description">
1401 
-              <?= $ENV->PASSWORD_ADVICE ?>
1401 
+              <?= $ENV->PW_ADVICE ?>
1402 1402 
             </p>
1403 1403 
           </td>
1404 1404 
         </tr>

+ 35
- 1
static/functions/password_validate.js View File 

@@ -57,6 +57,10 @@
57 57
58 58 
   });
59 59
60 
+
61 
+  /**
62 
+   * calculateComplexity
63 
+   */
60 64 
   function calculateComplexity(password) {
61 65 
     var length = password.length;
62 66 
     var username;
 
@@ -103,10 +107,20 @@
103 107 
     }
104 108 
   }
105 109
110 
+
111 
+  /**
112 
+   * isStrongPassword
113 
+   *
114 
+   * $ENV-PW_MIN is still harcoded here.
115 
+   */
106 116 
   function isStrongPassword(password) {
107 
-    return /(?=^.{6,}$).*$/.test(password);
117 
+    return /(?=^.{15,}$).*$/.test(password);
108 118 
   }
109 119
120 
+
121 
+  /**
122 
+   * checkMatching
123 
+   */
110 124 
   function checkMatching(password1, password2) {
111 125 
     if (password2.length > 0) {
112 126 
       if (password1 == password2 && getStrong() == true) {
 
@@ -124,10 +138,18 @@
124 138 
     }
125 139 
   }
126 140
141 
+
142 
+  /**
143 
+   * getStrong
144 
+   */
127 145 
   function getStrong() {
128 146 
     return $("#pass_strength").text() == "Strong";
129 147 
   }
130 148
149 
+
150 
+  /**
151 
+   * setStatus
152 
+   */
131 153 
   function setStatus(strength) {
132 154 
     if (strength == WEAK) {
133 155 
       disableSubmit();
 
@@ -164,14 +186,26 @@
164 186 
     }
165 187 
   }
166 188
189 
+
190 
+  /**
191 
+   * disableSubmit
192 
+   */
167 193 
   function disableSubmit() {
168 194 
     $('input[type="submit"]').attr('disabled', 'disabled');
169 195 
   }
170 196
197 
+
198 
+  /**
199 
+   * enableSubmit
200 
+   */
171 201 
   function enableSubmit() {
172 202 
     $('input[type="submit"]').removeAttr('disabled');
173 203 
   }
174 204
205 
+
206 
+  /**
207 
+   * isUserPage
208 
+   */
175 209 
   function isUserPage() {
176 210 
     return window.location.pathname.indexOf(USER_PATH) != -1;
177 211 
   }

Write Preview
Loading…
Cancel
Save