cvs: php-master-web /fetch cvsauth.php /include cvs-auth.inc

bjori		Sat Mar  1 16:46:38 2008 UTC

  Added files:                 
    /php-master-web/fetch	cvsauth.php 

  Modified files:              
    /php-master-web/include	cvs-auth.inc 
  Log:
  Add central CVS authentication service for php.net sites
  
  
http://cvs.php.net/viewvc.cgi/php-master-web/include/cvs-auth.inc?r1=1.3&r2=1.4&diff_format=u
Index: php-master-web/include/cvs-auth.inc
diff -u php-master-web/include/cvs-auth.inc:1.3 php-master-web/include/cvs-auth.inc:1.4
--- php-master-web/include/cvs-auth.inc:1.3	Thu Jun 10 08:28:47 2004
+++ php-master-web/include/cvs-auth.inc	Sat Mar  1 16:46:38 2008
@@ -1,5 +1,5 @@
 <?php
-/* $Id: cvs-auth.inc,v 1.3 2004/06/10 08:28:47 goba Exp $ */
+/* $Id: cvs-auth.inc,v 1.4 2008/03/01 16:46:38 bjori Exp $ */
 
 define("LOGIN_IGNORE_PWD", FALSE);
 define("LOGIN_PWD_FILE",   "/repository/CVSROOT/passwd");
@@ -25,7 +25,11 @@
 
 function verify_password($user, $pass)
 {
-    $psw = find_password($user);
+    return verify_login(find_password($user), $pass);
+}
+
+function verify_login($psw, $pass)
+{
     if (strlen($psw) > 0) {
         if (LOGIN_IGNORE_PWD || crypt($pass, substr($psw, 0, 2)) == $psw) {
             return TRUE;
@@ -33,3 +37,4 @@
     }
     return FALSE;
 }
+

http://cvs.php.net/viewvc.cgi/php-master-web/fetch/cvsauth.php?view=markup&rev=1.1
Index: php-master-web/fetch/cvsauth.php
+++ php-master-web/fetch/cvsauth.php
<?php
/*
CVS username+password authentication service for .php.net sites.
Usage:
$post = http_build_query(
	array(
		"token" => getenv("TOKEN"),
		"username" => $username,
		"password" => $password,
	)
);

$opts = array(
	"method"  => "POST",
	"header"  => "Content-type: application/x-www-form-urlencoded",
	"content" => $post,
);

$ctx = stream_context_create(array("http" => $opts));

$s = file_get_contents("http://master.php.is/fetch/cvsauth.php", false, $ctx);

$a = @unserialize($s);
if (!is_array($a)) {
	echo "Unknown error\n";
	exit;
}
if (isset($a["errno"])) {
	echo "Authentication failed: ", $a["errstr"], "\n";
	exit;
}

echo $a["SUCCESS"], "\n";
*/

require 'cvs-auth.inc';

# Error constants
define("E_UNKNOWN", 0);
define("E_USERNAME", 1);
define("E_PASSWORD", 2);

function exit_forbidden($why) {
	switch($why) {
	case E_USERNAME:
		echo serialize(array("errstr" => "Incorrect username", "errno" => E_USERNAME));
		break;

	case E_PASSWORD:
		echo serialize(array("errstr" => "Incorrect password", "errno" => E_PASSWORD));
		break;

	case E_UNKNOWN:
	default:
		echo serialize(array("errstr" => "Unknown error", "errno" => E_UNKNOWN));
	}
	exit;
}

function exit_success() {
	echo serialize(array("SUCCESS" => "Username and password OK"));
	exit;
}


$MQ = false;
// FC for PHP5.3 && PHP6
if (function_exists("get_magic_quotes_gpc")) {
	$MQ = (bool) @get_magic_quotes_gpc();
}

// Create required variables and kill MQ
$fields = array("token", "username", "password");
foreach($fields as $field) {
	if (isset($_POST[$field])) {
		$$field = $MQ ? stripslashes($_POST[$field]) : $_POST[$field];
	} else {
		exit_forbidden(E_UNKNOWN);
	}
}

# token required since this should only get accessed from .php.net sites
if (md5($token) != "a37f2f560c173675e839b02a89ce8104") {
	exit_forbidden(E_UNKNOWN);
}

$pass = find_password($username);
if (strlen($pass) < 1) {
	exit_forbidden(E_USERNAME);
}

if (!verify_login($pass, $password)) {
	exit_forbidden(E_PASSWORD);
}

exit_success();