svn: /web/ doc/trunk/include/cvs-auth.inc doc/trunk/include/lib_auth.inc.php doc/trunk/www/login.php pecl/trunk/public_html/bugs/bug.php php/trunk/include/shared-manual.inc php-bugs/trunk/include/functions.php php-master/trunk/include/login.inc php-rmtools/trunk/docroot/rm/login.php

Modified: web/doc/trunk/include/cvs-auth.inc
===================================================================
--- web/doc/trunk/include/cvs-auth.inc	2011-03-23 08:59:11 UTC (rev 309586)
+++ web/doc/trunk/include/cvs-auth.inc	2011-03-23 11:59:10 UTC (rev 309587)
@@ -23,53 +23,45 @@

 require_once(dirname(__FILE__) . '/../build-ops.php');

-function auth_vs_cvs($name, $pass)
+function auth_vs_svn($user, $pass, &$errors = null)
 {
-	$cvs_encode = array(
-		32, 120,  53,  35,  36, 109,  72, 108,
-		70,  64,  76,  67, 116,  74,  68,  87,
-		111,  52,  75, 119,  49,  34,  82,  81,
-		95,  65, 112,  86, 118, 110, 122, 105,
-		64,  57,  83,  43,  46, 102,  40,  89,
-		38, 103,  45,  50,  42, 123,  91,  35,
-		125,  55,  54,  66, 124, 126,  59,  47,
-		92,  71, 115,  91,  92,  93,  94,  56,
-		96, 121, 117, 104, 101, 100,  69,  73,
-		99,  63,  94,  93,  39,  37,  61,  48,
-		58, 113,  32,  90,  44,  98,  60,  51,
-		33,  97,  62, 123, 124, 125, 126, 127
-	);
+    $errors = array();

-	$cvsinfo = array('host'=>'cvs.php.net', 'port'=>2401, 'repos'=>'/repository');
+    $post = http_build_query(
+        array(
+            'token' => getenv('AUTH_TOKEN'),
+            'username' => $user,
+            'password' => $pass,
+        )
+    );

-	/* encode the password for cvs */
-	$encpwd = 'A';
-	$l = strlen($pass);
-	for ($i = 0; $i < $l; $i++) {
-		$o = ord($pass{$i});
-		if ($o >= 32 && $o <= 127) {
-			$encpwd .= chr($cvs_encode[$o - 32]);
-		} else {
-			$encpwd .= $pass{$i};
-		}
-	}
+    $opts = array(
+        'method'    => 'POST',
+        'header'    => 'Content-type: application/x-www-form-urlencoded',
+        'content'   => $post,
+    );

-	$cvs = fsockopen($cvsinfo['host'], $cvsinfo['port'], $errno, $errstr);
-	if (!$cvs)
-		return false;
-
-	$pkt = "BEGIN AUTH REQUEST\n$cvsinfo[repos]\n$name\n$encpwd\nEND AUTH REQUEST\n";
-
-	fwrite($cvs, $pkt);
-	$response = fgets($cvs);
-	fclose($cvs);
+    $ctx = stream_context_create(array('http' => $opts));

-	return !strncmp($response, 'I LOVE YOU', 10);
+    $s = file_get_contents('https://master.php.net/fetch/cvsauth.php', false, $ctx);
+
+    $a = @unserialize($s);
+    if (!is_array($a)) {
+        $errors[] = "Failed to get authentication information.\nMaybe master is down?\n";
+        return false;
+    }
+    if (isset($a['errno'])) {
+        $errors[] = "Authentication failed: {$a['errstr']}\n";
+        return false;
+    }
+
+    return true;
 }

+
 /**
  * Check local credential cache before sending extra queries
- * to cvs.php.net
+ * to master.php.net
  */
 function auth_vs_local ($idx, $user, $pass) {

@@ -97,10 +89,7 @@
 function verify_password($user, $pass) {
 	global $idx;

-	/**
-	 * You cannot auth as our [email protected] pseudo user
-	 */
-	if (!$user || !$pass || $user == 'cvsread') {
+	if (!$user || !$pass) {
 		return false;
 	}

@@ -108,9 +97,7 @@
 		return true;
 	}

-	if (auth_vs_cvs($user, $pass)) {
-
-		sqlite_query($idx, "REPLACE INTO auth VALUES ('" . sqlite_escape_string($user) . "', '" . sha1($pass) . "', '" . time() . "')");
+	if (auth_vs_svn($user, $pass)) {
 		return true;
 	}


Modified: web/doc/trunk/include/lib_auth.inc.php
===================================================================
--- web/doc/trunk/include/lib_auth.inc.php	2011-03-23 08:59:11 UTC (rev 309586)
+++ web/doc/trunk/include/lib_auth.inc.php	2011-03-23 11:59:10 UTC (rev 309587)
@@ -40,40 +40,18 @@
     'bjori',
 );

-$user = $password = false;
-
-// make the username & password global
-if (isset($_COOKIE['MAGIC_COOKIE'])) {
-    list($user, $password) = explode(':', base64_decode(@$_COOKIE['MAGIC_COOKIE']), 2);
-}
-
 /**
  * Credential checking of the $_COOKIE['MAGIC_COOKIE']
  */
 function auth()
 {
-    global $user, $password;
     $return = urlencode($_SERVER['REQUEST_URI']);
-
-    if (isset($_COOKIE['MAGIC_COOKIE'])) {

-        if (!verify_password($user, $password)) {
-            header ('Location: http://doc.php.net/login.php?return='.$return);
-            exit;
-        }
-    } elseif (isset($_POST['username']) && isset($_POST['passwd'])) {
+    if (isset($_POST['username']) && isset($_POST['passwd'])) {
         if (!verify_password($_POST['username'], $_POST['passwd'])) {
             header ('Location: http://doc.php.net/login.php?return='.$return);
             exit;
         }
-
-        setcookie(
-            'MAGIC_COOKIE',
-            base64_encode("{$_POST['username']}:{$_POST['passwd']}"),
-            time()+3600*24*12,
-            '/',
-            '.php.net'
-        );
     } else {
         header ('Location: http://doc.php.net/login.php?return='.$return);
         exit;
@@ -128,6 +106,8 @@
  */
 function master_user_name($nick)
 {
+    // LOGINFIXME: Do this query through the proper API
+    return "unknown";
     $magic_cookie = (!empty($_COOKIE['MAGIC_COOKIE'])) ?
             $_COOKIE['MAGIC_COOKIE'] :
                         '' ; // need a generic key here!!

Modified: web/doc/trunk/www/login.php
===================================================================
--- web/doc/trunk/www/login.php	2011-03-23 08:59:11 UTC (rev 309586)
+++ web/doc/trunk/www/login.php	2011-03-23 11:59:10 UTC (rev 309587)
@@ -3,7 +3,8 @@

 include '../include/init.inc.php';

-if (isset($_COOKIE['MAGIC_COOKIE']) || !empty($_POST)) {
+// FIXME: MAGIC_COKIE disabled
+if (!empty($_POST)) {
     require_once '../include/lib_auth.inc.php';
     auth();


Modified: web/pecl/trunk/public_html/bugs/bug.php
===================================================================
--- web/pecl/trunk/public_html/bugs/bug.php	2011-03-23 08:59:11 UTC (rev 309586)
+++ web/pecl/trunk/public_html/bugs/bug.php	2011-03-23 11:59:10 UTC (rev 309587)
@@ -68,7 +68,8 @@
     $pw   = rinse($_COOKIE['PEAR_PW']);
 } elseif (isset($_COOKIE['MAGIC_COOKIE'])) {
     @list($user, $pw) = explode(':', base64_decode($_COOKIE['MAGIC_COOKIE']));
-    $user = rinse($user);
+	// FIXME: Disabled php.net login via magic cookie
+    $user = NULL;
     if ($pw === null) {
         $pw = '';
     }

Modified: web/php/trunk/include/shared-manual.inc
===================================================================
--- web/php/trunk/include/shared-manual.inc	2011-03-23 08:59:11 UTC (rev 309586)
+++ web/php/trunk/include/shared-manual.inc	2011-03-23 11:59:10 UTC (rev 309587)
@@ -455,7 +455,7 @@
     $text    = clean_note($text);

     // If the viewer is logged in, show admin options
-    if (isset($_COOKIE['MAGIC_COOKIE']) && $id) {
+    if (isset($_COOKIE['IS_DEV']) && $id) {

         $admin = "\n  <span class=\"admin\">\n   " .


Modified: web/php-bugs/trunk/include/functions.php
===================================================================
--- web/php-bugs/trunk/include/functions.php	2011-03-23 08:59:11 UTC (rev 309586)
+++ web/php-bugs/trunk/include/functions.php	2011-03-23 11:59:10 UTC (rev 309587)
@@ -141,19 +141,20 @@
 		}
 		$pw = $_POST['pw'];

-		// Remember password / user next time
-		if (isset($_POST['save'])) { # non-developers don't have $user set
+		// FIXME: Remember password / user next time
+		if (false && isset($_POST['save'])) { # non-developers don't have $user set
 			if (DEVBOX) {
 				$domain = null;
 			} else {
 				$domain = '.php.net';
 			}
-			setcookie('MAGIC_COOKIE', base64_encode("{$user}:{$pw}"), time() + 3600 * 24 * 12, '/', $domain);
+            //setcookie(".....");
 		}
 	} elseif (isset($auth_user) && is_object($auth_user) && $auth_user->handle) {
 		$user = $auth_user->handle;
 		$pw = $auth_user->password;
-	} elseif (isset($_COOKIE['MAGIC_COOKIE'])) {
+    // FIXME: Killed magic cookie login..
+	} elseif (false && isset($_COOKIE['MAGIC_COOKIE'])) {
 		@list($user, $pw) = explode(':', base64_decode($_COOKIE['MAGIC_COOKIE']), 2);
 		if ($pw === null) {
 			$pw = '';

Modified: web/php-master/trunk/include/login.inc
===================================================================
--- web/php-master/trunk/include/login.inc	2011-03-23 08:59:11 UTC (rev 309586)
+++ web/php-master/trunk/include/login.inc	2011-03-23 11:59:10 UTC (rev 309587)
@@ -1,4 +1,5 @@
 <?php
+session_start();
 /* $Id$ */

 require 'cvs-auth.inc';
@@ -7,27 +8,20 @@
 // User not logged in
 $user = $pw = FALSE;

-// Set magic cookie if login information is available
-if (isset($_POST['save']) && isset($_POST['user']) && isset($_POST['pw'])) {
-    setcookie(
-        "MAGIC_COOKIE",
-        base64_encode("{$_POST['user']}:{$_POST['pw']}"),
-        time()+3600*24*12,
-        '/',
-        '.php.net',
-        false, // Secure
-        true   // HTTP Only
-    );
+if (isset($_POST["user"], $_POST["pw"])) {
     list($user, $pw) = array($_POST['user'], $_POST['pw']);
-}
-
-// Preserve information previously set in magic cookie if available
-if (isset($_COOKIE['MAGIC_COOKIE']) && !isset($_POST['user']) && !isset($_POST['pw'])) {
+} elseif (isset($_SESSION["credentials"])) {
+    list($user, $pw) = $_SERVER["credentials"];
+} elseif (isset($_COOKIE['MAGIC_COOKIE'])) {
     list($user, $pw) = explode(":", base64_decode($_COOKIE['MAGIC_COOKIE']), 2);
 }

 // Login form, if the user is not yet logged in
-if (!$user || !$pw || !verify_password($user,$pw)) { ?>
+if (!$user || !$pw || !verify_password($user,$pw)) {
+    $_SESSION["credentials"] = array();
+    session_destroy();
+?>
+
 <html>
 <head>
  <title>You must log in!</title>
@@ -56,6 +50,18 @@
   exit;
 }

+// At this point, we have logged in successfully
+$_SESSION["credentials"] = array($user, $pw);
+
+// Killing magic cookie
+setcookie("MAGIC_COOKIE","",time()-3600,'/','.php.net');
+setcookie("MAGIC_COOKIE","",time()-3600,'/');
+
+// Set a cookie to tell various .php.net services that the user is probably loggedin
+setcookie("IS_DEV", 1, time()+3600*24*12, '/', '.php.net', false, true);
+
+
+
 // ----------------------------------------------------------------------------------

 function query_string()

Modified: web/php-rmtools/trunk/docroot/rm/login.php
===================================================================
--- web/php-rmtools/trunk/docroot/rm/login.php	2011-03-23 08:59:11 UTC (rev 309586)
+++ web/php-rmtools/trunk/docroot/rm/login.php	2011-03-23 11:59:10 UTC (rev 309587)
@@ -12,7 +12,7 @@
 		$username = filter_input(INPUT_POST, 'username', FILTER_SANITIZE_STRING, FILTER_FLAG_STRIP_LOW|FILTER_FLAG_STRIP_HIGH);
 		$password = filter_input(INPUT_POST, 'password', FILTER_SANITIZE_STRING, FILTER_FLAG_STRIP_LOW|FILTER_FLAG_STRIP_HIGH);
 		// Set magic cookie if login information is available
-	} else {
+	} elseif(false) { // FIXME: Disabled magic cookie :]
 		// Preserve information previously set in magic cookie if available
 		if (isset($_COOKIE['MAGIC_COOKIE']) && !isset($_POST['user']) && !isset($_POST['pw'])) {
 			list($user, $password) = explode(":", base64_decode($_COOKIE['MAGIC_COOKIE']), 2);
@@ -31,7 +31,8 @@
 	$_SESSION['username'] = $username;
 	$_SESSION['time'] = time();

-	if ($password && $username) {
+    // FIXME: Disabled magic cookie session
+	if (false && $password && $username) {
 		setcookie(
 			"MAGIC_COOKIE",
 			base64_encode("$username:$password"),