Changeset 6bd74d8 in github


Ignore:
Timestamp:
Jun 20, 2009 3:28:33 AM (4 years ago)
Author:
alecpl <alec@…>
Branches:
master, HEAD, courier-fix, dev-browser-capabilities, pdo, release-0.6, release-0.7, release-0.8
Children:
e6ee84b
Parents:
2dbc2d7
Message:
  • Password plugin: implemented drivers
  • removed password_sasl plugin
Location:
plugins
Files:
4 added
7 deleted
6 edited

Legend:

Unmodified
Added
Removed

  • plugins/password/localization/en_US.inc

    r004739d r6bd74d8  
    1212$messages['passwordincorrect'] = 'Current password incorrect.'; 
    1313$messages['passwordinconsistency'] = 'Passwords do not match, please try again.'; 
    14 $messages['nocryptfunction'] = 'The server is missing a function to encrypt your password - contact your system adminstrator.'; 
    15 $messages['internalerror'] = 'The server is updated more than one row in the database. This could be bad for all users. Contact your system adminstrator.'; 
    16 $messages['errorsaving'] = 'Could not save your new password to the database. Contact your system adminstrator.'; 
     14$messages['nocryptfunction'] = 'The server is missing a function to encrypt your password. Contact your system adminstrator.'; 
     15$messages['internalerror'] = 'Could not save new password. Contact your system adminstrator.'; 
    1716 
    1817?> 

  • plugins/password/localization/et_EE.inc

    r94115bb r6bd74d8  
    1212$messages['passwordincorrect'] = 'Vana parool on vale.'; 
    1313$messages['passwordinconsistency'] = 'Paroolid ei kattu, palun proovi uuesti.'; 
    14 $messages['nocryptfunction'] = 'Serveris ei ole parooli krÃŒpteerimiseks vajalikku funktsiooni - palun võta oma sÃŒsteemi administraatoriga ÃŒhendust.'; 
    15 $messages['internalerror'] = 'Server uuendas andmebaasis liiga palju ridu. See võib olla halb kõigile kasutajatele. Palun võta oma sÃŒsteemi administraatoriga ÃŒhendust.'; 
    16 $messages['errorsaving'] = 'Uue parooli andmebaasi salvestamine nurjus. Palun võta oma sÃŒsteemi administraatoriga ÃŒhendust.'; 
     14$messages['nocryptfunction'] = 'Serveris ei ole parooli krÃŒpteerimiseks vajalikku funktsiooni. Palun võta oma sÃŒsteemi administraatoriga ÃŒhendust.'; 
     15$messages['internalerror'] = 'Uue parooli andmebaasi salvestamine nurjus. Palun võta oma sÃŒsteemi administraatoriga ÃŒhendust.'; 
    1716 
    1817?> 

  • plugins/password/localization/hu_HU.inc

    ra087085 r6bd74d8  
    1414$messages['nocryptfunction'] = 'Hiba történt a kérés feldolgozása során.'; 
    1515$messages['internalerror'] = 'Hiba történt a kérés feldolgozása során.'; 
    16 $messages['errorsaving'] = 'Hiba történt a kérés feldolgozása során.'; 
    1716 
    1817?> 

  • plugins/password/localization/nl_NL.inc

    r004739d r6bd74d8  
    1212$messages['passwordincorrect'] = 'Huidig wachtwoord is onjuist.'; 
    1313$messages['passwordinconsistency'] = 'Wachtwoorden komen niet overeen, probeer het opnieuw.'; 
    14 $messages['nocryptfunction'] = 'De server mist een functie om uw wachtwoord et beveiligen - neem contact op met uw systeembeheerder.'; 
    15 $messages['internalerror'] = 'De server heeft meer dan 1 regel in de database gewijzigd. Dit kan een probleem opleveren voor alle gebruikers. Neem contact op met uw systeembeheerder.'; 
    16 $messages['errorsaving'] = 'Uw wachtwoord kan niet worden opgeslagen in de database. Neem contact op met uw systeembeheerder.'; 
     14$messages['nocryptfunction'] = 'De server mist een functie om uw wachtwoord et beveiligen. Neem contact op met uw systeembeheerder.'; 
     15$messages['internalerror'] = 'Uw wachtwoord kan niet worden opgeslagen. Neem contact op met uw systeembeheerder.'; 
    1716 
    1817?> 

  • plugins/password/localization/pl_PL.inc

    rcf356bc r6bd74d8  
    1515$messages['nocryptfunction'] = 'Brak funkcji kodujÄ 
    1616cej hasło. Skontaktuj się z administratorem.'; 
    17 $messages['internalerror'] = 'Serwer zaktualizował więcej niÅŒ jeden wpis w bazie. To moÅŒe być złe dla innych uÅŒytkowników. Skontaktuj się z administratorem.'; 
    18 $messages['errorsaving'] = 'Nie udało się zapisać nowego hasła. Skontaktuj się z administratorem.'; 
     17$messages['internalerror'] = 'Nie udało się zapisać nowego hasła. Skontaktuj się z administratorem.'; 
    1918 
    2019?> 

  • plugins/password/password.php

    rd257c40 r6bd74d8  
    11<?php 
    22 
    3 /** 
    4  * Change Password 
    5  * 
    6  * Plugin that adds a possibility to change password using a database 
    7  * (Settings -> Password tab) 
    8  * 
    9  * @version 1.1 
    10  * @author Aleksander 'A.L.E.C' Machniak <alec@alec.pl> 
    11  * @editor Daniel Black 
    12  * 
    13  * Configuration Items (config/main.inc.php): 
    14  *   password_confirm_current - boolean to determine whether current password 
    15  *     is required to change password. Defaults to FALSE. 
    16  *   password_db_dsn - is the PEAR database DSN for performing the query. Defaults 
    17  *     to the default databse setting in config/db.inc.php 
    18  *   password_query - the SQL query used to change the password. 
    19  *     If the SQL query is a SELECT it will return an error message in a row if unsuccessful 
    20  *     If the SQL query is a UPDATE it will update a single row only.  
    21  *     An UPDATE where zero rows changed will be inteperated to be a wrong username/password 
    22  *     More than one row changed will be inteperated as an internal error 
    23  *     The query can contain the following macros that will be expanded as follows: 
    24  *       %p is replaced with the plaintext new password 
    25  *       %c is replaced with the crypt version of the new password, MD5 if available 
    26  *         otherwise DES. 
    27  *       %u is replaced with the username (from the session info) 
    28  *       %o is replaced with the password before the change 
    29  *       %h is replaced with the imap host (from the session info) 
    30  *     Escaping of macros is handled by this module. 
    31  *     Defaults to "SELECT update_passwd(%c, %u)"  
    32  *     To use this you need to define the update_passwd function in your 
    33  *     database. 
    34  * 
    35  * Example SQL queries: 
    36  * These will typically need to define a function to change the password: 
    37  *  
    38  * Example implementations of an update_passwd function: 
    39  * 
    40  * This is for use with LMS (http://lms.org.pl) database and postgres: 
    41  * CREATE OR REPLACE FUNCTION update_passwd(hash text, account text) RETURNS integer AS $$ 
    42  * DECLARE 
    43  *         res integer; 
    44  * BEGIN 
    45  *      UPDATE passwd SET password = hash 
    46  *      WHERE login = split_part(account, '@', 1) 
    47  *              AND domainid = (SELECT id FROM domains WHERE name = split_part(account, '@', 2)) 
    48  *      RETURNING id INTO res; 
    49  *      RETURN res; 
    50  * END; 
    51  * $$ LANGUAGE plpgsql SECURITY DEFINER; 
    52  * 
    53  * This is for use with a SELECT update_passwd(%o,%c,%u) query 
    54  * Uupdates the password only when the old password matches the MD5 password in the database 
    55  * CREATE FUNCTION update_password (oldpass text, cryptpass text, user text) RETURNS text 
    56  *        MODIFIES SQL DATA 
    57  * BEGIN 
    58  *   DECLARE currentsalt varchar(20); 
    59  *   DECLARE error text; 
    60  *   SET error = 'incorrect current password'; 
    61  *   SELECT substring_index(substr(user.password,4),_latin1'$',1) INTO currentsalt FROM users WHERE username=user; 
    62  *   SELECT '' INTO error FROM users WHERE username=user AND password=ENCRYPT(oldpass,currentsalt); 
    63  *   UPDATE users SET password=cryptpass WHERE username=user AND password=ENCRYPT(oldpass,currentsalt); 
    64  *   RETURN error; 
    65  * END 
    66  * 
    67  * Example SQL UPDATEs: 
    68  *  
    69  *   Plain text passwords: 
    70  *   UPDATE users SET password=%p WHERE username=%u AND password=%o AND domain=%h LIMIT 1 
    71  *  
    72  *   Crypt text passwords: 
    73  *   UPDATE users SET password=%c WHERE username=%u LIMIT 1 
    74  * 
    75  *   Use a MYSQL crypt function (*nix only) with random 8 character salt 
    76  *   UPDATE users SET password=ENCRYPT(%p,concat(_utf8'$1$',right(md5(rand()),8),_utf8'$')) WHERE username=%u LIMIT 1 
    77  *  
    78  *   MD5 stored passwords: 
    79  *   UPDATE users SET password=MD5(%p) WHERE username=%u AND password=MD5(%o) LIMIT 1 
    80  *  
    81  */ 
     3/* 
     4 +-------------------------------------------------------------------------+ 
     5 | Password Plugin for Roundcube                                           | 
     6 | Version 1.2                                                             | 
     7 |                                                                         | 
     8 | Copyright (C) 2009, RoundCube Dev. - Switzerland                        | 
     9 |                                                                         | 
     10 | This program is free software; you can redistribute it and/or modify    | 
     11 | it under the terms of the GNU General Public License version 2          | 
     12 | as published by the Free Software Foundation.                           | 
     13 |                                                                         | 
     14 | This program is distributed in the hope that it will be useful,         | 
     15 | but WITHOUT ANY WARRANTY; without even the implied warranty of          | 
     16 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the           | 
     17 | GNU General Public License for more details.                            | 
     18 |                                                                         | 
     19 | You should have received a copy of the GNU General Public License along | 
     20 | with this program; if not, write to the Free Software Foundation, Inc., | 
     21 | 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.             | 
     22 |                                                                         | 
     23 +-------------------------------------------------------------------------+ 
     24 | Author: Aleksander Machniak <alec@alec.pl>                              | 
     25 +-------------------------------------------------------------------------+ 
     26 
     27 $Id: index.php 2645 2009-06-15 07:01:36Z alec $ 
     28 
     29*/ 
     30 
     31define('PASSWORD_CRYPT_ERROR', 1); 
     32define('PASSWORD_ERROR', 2); 
     33define('PASSWORD_SUCCESS', 0); 
     34 
    8235class password extends rcube_plugin 
    8336{ 
    … …  
    10760  { 
    10861    $rcmail = rcmail::get_instance(); 
     62    $this->load_config(); 
    10963 
    11064    $this->add_texts('localization/'); 
    … …  
    13690  { 
    13791    $rcmail = rcmail::get_instance(); 
    138  
    139     $confirm = $rcmail->config->get('password_confirm_current'); 
     92    $this->load_config(); 
     93 
    14094    // add some labels to client 
    14195    $rcmail->output->add_label( 
    … …  
    153107    $out = '<table' . $attrib_str . ">\n\n"; 
    154108 
    155     if ($confirm) { 
     109    if ($rcmail->config->get('password_confirm_current')) { 
    156110      // show current password selection 
    157111      $field_id = 'curpasswd'; 
    … …  
    206160  } 
    207161 
    208   private function _save($curpass,$passwd) 
    209   { 
    210     $cfg = rcmail::get_instance()->config; 
    211  
    212     if (!($sql = $cfg->get('password_query'))) 
    213       $sql = "SELECT update_passwd(%c, %u)"; 
    214  
    215     if ($dsn = $cfg->get('password_db_dsn')) { 
    216       $db = new rcube_mdb2($dsn, '', FALSE); 
    217       $db->set_debug((bool)$cfg->get('sql_debug')); 
    218       $db->db_connect('w'); 
    219     } else { 
    220       $db = rcmail::get_instance()->get_dbh(); 
    221     } 
    222  
    223     if ($err = $db->is_error()) 
    224       return $err; 
     162  private function _save($curpass, $passwd) 
     163  { 
     164    $config = rcmail::get_instance()->config; 
     165    $driver = $this->home.'/drivers/'.$config->get('password_driver', 'sql').'.php'; 
    225166     
    226     if (strpos($sql,'%c') !== FALSE) { 
    227       $salt = ''; 
    228       if (CRYPT_MD5) {  
    229         $len = rand(3,CRYPT_SALT_LENGTH); 
    230       } else if (CRYPT_STD_DES) { 
    231         $len = 2; 
    232       } else { 
     167    if (!is_readable($driver)) { 
     168      raise_error(array( 
     169        'code' => 600, 
     170        'type' => 'php', 
     171        'file' => __FILE__, 
     172        'message' => "Password plugin: Unable to open driver file $driver" 
     173        ), true, false); 
     174      return $this->gettext('internalerror'); 
     175    } 
     176     
     177    include($driver); 
     178 
     179    if (!function_exists('password_save')) { 
     180      raise_error(array( 
     181        'code' => 600, 
     182        'type' => 'php', 
     183        'file' => __FILE__, 
     184        'message' => "Password plugin: Broken driver: $driver" 
     185        ), true, false); 
     186      return $this->gettext('internalerror'); 
     187    } 
     188 
     189    $result = password_save($curpass, $passwd); 
     190 
     191    switch ($result) { 
     192      case PASSWORD_SUCCESS: 
     193        return; 
     194      case PASSWORD_CRYPT_ERROR; 
    233195        return $this->gettext('nocryptfunction'); 
    234       } 
    235       for ($i = 0; $i < $len ; $i++) { 
    236         $salt .= chr(rand(ord('.'),ord('z'))); 
    237       } 
    238       $sql = str_replace('%c',  $db->quote(crypt($passwd, CRYPT_MD5 ? '$1$'.$salt.'$' : $salt)), $sql); 
    239     } 
    240     $sql = str_replace('%u', $db->quote($_SESSION['username'],'text'), $sql); 
    241     $sql = str_replace('%p', $db->quote($passwd,'text'), $sql); 
    242     $sql = str_replace('%o', $db->quote($curpass,'text'), $sql); 
    243     $sql = str_replace('%h', $db->quote($_SESSION['imap_host'],'text'), $sql); 
    244  
    245     $res = $db->query($sql); 
    246     if ($err = $db->is_error()) 
    247       return $err; 
    248     if (strtolower(substr(trim($query),0,6))=='select') { 
    249       return $db->fetch_array($res); 
    250     } else {  
    251       $res = $db->affected_rows($res); 
    252       if ($res == 0) return $this->gettext('errorsaving'); 
    253       if ($res == 1) return FALSE; // THis is the good case - 1 row updated 
    254       return $this->gettext('internalerror'); 
    255     } 
    256  
     196      case PASSWORD_ERROR: 
     197      default: 
     198        return $this->gettext('internalerror'); 
     199    } 
    257200  } 
    258201 
Note: See TracChangeset for help on using the changeset viewer.