[suspicious - maybe spam] cvs: docweb /include lib_auth.inc.php /templates/all/www login.tpl.php /www login.php /www/rfc rfc-proposal-delete.php rfc-proposal-edit.php rfc-votes-show.php
[email protected] ("Vincent Gevers")
| Newsgroups | php.doc.web |
|---|---|
| Message-ID | <cvsvincent1122889369@cvsserver> |
vincent Mon Aug 1 05:42:49 2005 EDT
Modified files:
/docweb/include lib_auth.inc.php
/docweb/templates/all/www login.tpl.php
/docweb/www login.php
/docweb/www/rfc rfc-proposal-delete.php rfc-proposal-edit.php
rfc-votes-show.php
Log:
o Secure the rfc system from guests
o Make the login form return to the auth requesting page
http://cvs.php.net/diff.php/docweb/include/lib_auth.inc.php?r1=1.11&r2=1.12&ty=u
Index: docweb/include/lib_auth.inc.php
diff -u docweb/include/lib_auth.inc.php:1.11 docweb/include/lib_auth.inc.php:1.12
--- docweb/include/lib_auth.inc.php:1.11 Sun Jul 31 17:48:08 2005
+++ docweb/include/lib_auth.inc.php Mon Aug 1 05:42:48 2005
@@ -17,7 +17,7 @@
* | Nuno Lopes <[email protected]> |
* +----------------------------------------------------------------------+
*
- * $Id: lib_auth.inc.php,v 1.11 2005/07/31 21:48:08 vincent Exp $
+ * $Id: lib_auth.inc.php,v 1.12 2005/08/01 09:42:48 vincent Exp $
*/
require_once 'cvs-auth.inc';
@@ -50,16 +50,17 @@
function auth()
{
global $user, $password;
-
+ $return = $_SERVER['REQUEST_URI'];
+
if (isset($_COOKIE['MAGIC_COOKIE'])) {
if (!verify_password($user, $password)) {
- header ('Location: http://doc.php.net/login.php');
+ header ('Location: http://doc.php.net/login.php?return='.$return);
exit;
}
} elseif (isset($_POST['username']) && isset($_POST['passwd'])) {
if (!verify_password($_POST['username'], $_POST['passwd'])) {
- header ('Location: http://doc.php.net/login.php');
+ header ('Location: http://doc.php.net/login.php?return='.$return);
exit;
}
@@ -71,7 +72,7 @@
'.php.net'
);
} else {
- header ('Location: http://doc.php.net/login.php');
+ header ('Location: http://doc.php.net/login.php?return='.$return);
exit;
}
}
@@ -124,7 +125,7 @@
*/
function master_user_name($nick)
{
- $magic_cookie = (!empty($_COOKIE['MAGIC_COOKIE']) || !ctype_alnum($_COOKIE['MAGIC_COOKIE'])) ?
+ $magic_cookie = (!empty($_COOKIE['MAGIC_COOKIE'])) ?
$_COOKIE['MAGIC_COOKIE'] :
'' ; // need a generic key here!!
http://cvs.php.net/diff.php/docweb/templates/all/www/login.tpl.php?r1=1.1&r2=1.2&ty=u
Index: docweb/templates/all/www/login.tpl.php
diff -u docweb/templates/all/www/login.tpl.php:1.1 docweb/templates/all/www/login.tpl.php:1.2
--- docweb/templates/all/www/login.tpl.php:1.1 Sat Feb 12 19:10:44 2005
+++ docweb/templates/all/www/login.tpl.php Mon Aug 1 05:42:48 2005
@@ -4,6 +4,7 @@
<p>
<form method="post" name="login" action="/login.php">
+<input type="hidden" name="return" value="<?php echo $GLOBALS['return']; ?>" />
<table border="0" cellspacing="2" cellpadding="2">
<tr>
<th>Username</th>
http://cvs.php.net/diff.php/docweb/www/login.php?r1=1.3&r2=1.4&ty=u
Index: docweb/www/login.php
diff -u docweb/www/login.php:1.3 docweb/www/login.php:1.4
--- docweb/www/login.php:1.3 Thu Jul 28 14:05:11 2005
+++ docweb/www/login.php Mon Aug 1 05:42:48 2005
@@ -1,12 +1,15 @@
<?php
-/* $Id: login.php,v 1.3 2005/07/28 18:05:11 nlopess Exp $ */
+/* $Id: login.php,v 1.4 2005/08/01 09:42:48 vincent Exp $ */
include '../include/init.inc.php';
if (isset($_COOKIE['MAGIC_COOKIE']) || !empty($_POST)) {
require_once '../include/lib_auth.inc.php';
auth();
-
+
+ if (isset($_REQUEST['return']) && !empty($_REQUEST['return'])) {
+ header('Location: http://'.$_SERVER['HTTP_HOST'].$_REQUEST['return']);
+ }
echo 'You are logged in';
echo is_admin() ? ' <strong>with admin rights</strong>.' : '.';
} else {
http://cvs.php.net/diff.php/docweb/www/rfc/rfc-proposal-delete.php?r1=1.5&r2=1.6&ty=u
Index: docweb/www/rfc/rfc-proposal-delete.php
diff -u docweb/www/rfc/rfc-proposal-delete.php:1.5 docweb/www/rfc/rfc-proposal-delete.php:1.6
--- docweb/www/rfc/rfc-proposal-delete.php:1.5 Fri Jul 29 08:47:14 2005
+++ docweb/www/rfc/rfc-proposal-delete.php Mon Aug 1 05:42:48 2005
@@ -19,7 +19,7 @@
* @author Daniel Convissor <[email protected]>
* @copyright Copyright (c) 1997-2004 The PHP Group
* @license http://www.php.net/license/3_0.txt PHP License
- * @version $Id: rfc-proposal-delete.php,v 1.5 2005/07/29 12:47:14 vincent Exp $
+ * @version $Id: rfc-proposal-delete.php,v 1.6 2005/08/01 09:42:48 vincent Exp $
*/
/**
@@ -28,6 +28,7 @@
$path = realpath(dirname(__FILE__));
require_once $path . '/../../include/rfc/rfc.php';
+auth();
if (!empty($_GET['isDeleted'])) {
echo site_header('RFC :: Delete');
http://cvs.php.net/diff.php/docweb/www/rfc/rfc-proposal-edit.php?r1=1.15&r2=1.16&ty=u
Index: docweb/www/rfc/rfc-proposal-edit.php
diff -u docweb/www/rfc/rfc-proposal-edit.php:1.15 docweb/www/rfc/rfc-proposal-edit.php:1.16
--- docweb/www/rfc/rfc-proposal-edit.php:1.15 Sat Jul 30 12:17:19 2005
+++ docweb/www/rfc/rfc-proposal-edit.php Mon Aug 1 05:42:48 2005
@@ -22,7 +22,7 @@
* @author Daniel Convissor <[email protected]>
* @copyright Copyright (c) 1997-2004 The PHP Group
* @license http://www.php.net/license/3_0.txt PHP License
- * @version $Id: rfc-proposal-edit.php,v 1.15 2005/07/30 16:17:19 vincent Exp $
+ * @version $Id: rfc-proposal-edit.php,v 1.16 2005/08/01 09:42:48 vincent Exp $
*/
/**
@@ -30,6 +30,9 @@
*/
$path = realpath(dirname(__FILE__));
require_once $path . '/../../include/rfc/rfc.php';
+
+auth();
+
/**
* Obtain code for Bulletin Board markup.
*/
http://cvs.php.net/diff.php/docweb/www/rfc/rfc-votes-show.php?r1=1.8&r2=1.9&ty=u
Index: docweb/www/rfc/rfc-votes-show.php
diff -u docweb/www/rfc/rfc-votes-show.php:1.8 docweb/www/rfc/rfc-votes-show.php:1.9
--- docweb/www/rfc/rfc-votes-show.php:1.8 Sat Jul 30 10:42:36 2005
+++ docweb/www/rfc/rfc-votes-show.php Mon Aug 1 05:42:48 2005
@@ -19,7 +19,7 @@
* @author Daniel Convissor <[email protected]>
* @copyright Copyright (c) 1997-2004 The PHP Group
* @license http://www.php.net/license/3_0.txt PHP License
- * @version $Id: rfc-votes-show.php,v 1.8 2005/07/30 14:42:36 vincent Exp $
+ * @version $Id: rfc-votes-show.php,v 1.9 2005/08/01 09:42:48 vincent Exp $
*/
/**
@@ -40,7 +40,7 @@
echo site_header('RFC :: Votes :: ' . htmlspecialchars($proposal->pkg_name));
echo '<h1>Proposal Votes for ' . htmlspecialchars($proposal->pkg_name) . "</h1>\n";
-if ($proposal->mayVote($dbh, @$docwebUser)) {
+if (isset($docwebUser) && $proposal->mayVote($dbh, $docwebUser)) {
$form =& new HTML_QuickForm('vote', 'post',
'rfc-votes-show.php?id=' . $proposal->id);
@@ -212,7 +212,7 @@
<td class="ulcell" valign="top">
<ul>
<li>You must be a full-featured PEAR developer.</li>
- <li>You must be logged in.</li>
+ <li>You must be <a href="/login.php?return=<?php echo $_SERVER['REQUEST_URI']; ?>">logged in</a>.</li>
<li>Only one vote can be cast.</li>
<li>Proposers can not vote on their own package.</li>
</ul>