Changeset 1622

Timestamp:

Dec 1, 2006, 1:48:49 AM (17 years ago)

Author:

rvelices

Message:

get rid of #users.auto_login_key

Location:

trunk

Files:

• include/functions_user.inc.php (modified) (5 diffs)
• install/db/36-database.php (added)
• install/phpwebgallery_structure.sql (modified) (1 diff)

trunk/include/functions_user.inc.php

@@ -629 +629 @@
 }
 
+/**
+ * returns the auto login key or false on error
+ * @param int user_id
+*/
+function calculate_auto_login_key($user_id)
+{
+  global $conf;
+  $query = '
+SELECT '.$conf['user_fields']['username'].' AS username
+  , '.$conf['user_fields']['password'].' AS password
+FROM '.USERS_TABLE.'
+WHERE '.$conf['user_fields']['id'].' = '.$user_id;
+  $result = pwg_query($query);
+  if (mysql_num_rows($result) > 0)
+  {
+    $row = mysql_fetch_assoc($result);
+    $key = sha1( $row['username'].$row['password'] );
+    return $key;
+  }
+  return false;
+}
+
 /*
  * Performs all required actions for user login
@@ -641 +663 @@
   if ($remember_me)
   {
-    // search for an existing auto_login_key
-    $query = '
-SELECT auto_login_key
-  FROM '.USERS_TABLE.'
-  WHERE '.$conf['user_fields']['id'].' = '.$user_id.'
-;';
-
-    $auto_login_key = current(mysql_fetch_assoc(pwg_query($query)));
-    if (empty($auto_login_key))
-    {
-      $auto_login_key = base64_encode(md5(uniqid(rand(), true)));
-      $query = '
-UPDATE '.USERS_TABLE.'
-  SET auto_login_key=\''.$auto_login_key.'\'
-  WHERE '.$conf['user_fields']['id'].' = '.$user_id.'
-;';
-      pwg_query($query);
-    }
-    $cookie = array('id' => $user_id, 'key' => $auto_login_key);
-    setcookie($conf['remember_me_name'],
-              serialize($cookie),
-              time()+$conf['remember_me_length'],
-              cookie_path()
+    $key = calculate_auto_login_key($user_id);
+    if ($key!==false)
+    {
+      $cookie = array('id' => (int)$user_id, 'key' => $key);
+      setcookie($conf['remember_me_name'],
+                serialize($cookie),
+                time()+$conf['remember_me_length'],
+                cookie_path()
               );
+        }
   }
   else
@@ -671 +679 @@
   }
   if ( session_id()!="" )
-  { // this can happpen when the session is expired and auto_login
+  { // we regenerate the session for security reasons
+    // see http://www.acros.si/papers/session_fixation.pdf
     session_regenerate_id();
   }
@@ -678 +687 @@
     session_start();
   }
-  $_SESSION['pwg_uid'] = $user_id;
+  $_SESSION['pwg_uid'] = (int)$user_id;
 
   $user['id'] = $_SESSION['pwg_uid'];
@@ -692 +701 @@
   if ( isset( $_COOKIE[$conf['remember_me_name']] ) )
   {
-    // must remove slash added in include/common.inc.php
     $cookie = unserialize(stripslashes($_COOKIE[$conf['remember_me_name']]));
-
-    $query = '
-SELECT auto_login_key
-  FROM '.USERS_TABLE.'
-  WHERE '.$conf['user_fields']['id'].' = '.$cookie['id'].'
-;';
-
-    $auto_login_key = current(mysql_fetch_assoc(pwg_query($query)));
-    if ($auto_login_key == $cookie['key'])
-    {
-      log_user($cookie['id'], true);
-      return true;
-    }
-    else
-    {
-      setcookie($conf['remember_me_name'], '', 0, cookie_path());
-    }
+    if ($cookie!==false)
+    {
+      $key = calculate_auto_login_key($cookie['id']);
+      if ($key!==false and $key===$cookie['key'])
+      {
+        log_user($cookie['id'], true);
+        return true;
+      }
+    }
+    setcookie($conf['remember_me_name'], '', 0, cookie_path());
   }
   return false;

trunk/install/phpwebgallery_structure.sql

@@ -360 +360 @@
   `password` varchar(32) default NULL,
   `mail_address` varchar(255) default NULL,
-  `auto_login_key` varchar(64) default NULL,
   PRIMARY KEY  (`id`),
   UNIQUE KEY `users_ui1` (`username`)