Commit graph

127 commits

Author SHA1 Message Date
Mike Macgirvin
6c29d57a4c refactor datetime part1 2024-03-10 13:40:50 +11:00
Mike Macgirvin
d9e1de7832 fixes mfa escape from form 2023-03-08 22:33:33 +11:00
Mike Macgirvin
269de39e5e mfa cont. 2023-03-05 23:06:33 +11:00
Mike Macgirvin
5bc2dfb513 mfa cont. 2023-03-05 21:12:42 +11:00
Mike Macgirvin
c1c529ca14 cleanup 2022-10-25 19:03:44 +11:00
Mike Macgirvin
9b4585a13c cleanup 2022-10-21 20:37:20 +11:00
Mike Macgirvin
593bf652d6 Remove dead code and move account queries to Account class. 2022-06-21 19:59:37 -07:00
Mike Macgirvin
35e02f25d6 begin hubloc refactor 2022-06-16 19:46:54 -07:00
nobody
68e87cf3a1 Merge branch 'dev' of ../unfediverse.com into dev 2022-03-15 01:44:14 -07:00
nobody
7cab493e6c php 8.1 changes 2022-03-15 01:42:34 -07:00
nobody
9fcb326d78 change authentication plugin workflow so that username is not required 2022-03-13 12:58:26 -07:00
nobody
a8e96322f0 it's done 2022-02-15 20:08:28 -08:00
nobody
4dd986a2db This checkin is surely broken, but I need to commit it because it represents a fair bit of work. 2022-02-12 00:50:48 -08:00
nobody
ad52373312 move account and channel to zlib 2022-01-24 17:26:12 -08:00
nobody
d46dd6aeb8 psr12 rewrites, continued 2021-12-03 14:01:39 +11:00
zotlabs
1d982fb5b5 implement sudo 2020-02-23 18:10:44 -08:00
zotlabs
cd4e19f1e7 use zot6 xchan if available for visitors with more than one matching id. 2019-03-17 16:29:38 -07:00
zotlabs
46152cc56b ensure all password checking goes through the authenticate plugin hook (for instance in mod_removeme) 2018-05-14 20:17:00 -07:00
zotlabs
2fa9645dfc channel delegation: push current identity and pop it on logout from the delegated channel. This fixes the known issue of being forced to log back in after leaving the delegated channel. 2018-04-11 17:40:04 -07:00
zotlabs
cd485b0fdf hubzilla issue #1015 - login with unicode domain name 2018-03-28 19:25:11 -07:00
zotlabs
8d479aa1c7 redirect to the email_validation page if login was attempted after account creation but prior to successful verification. This presents the link to resend the verification email and/or allows you to enter it. 2018-01-29 16:58:55 -08:00
zotlabs
1a7ccc462b on failed auth due to unverified email, tell the person why and remind them to check their email. 2017-10-10 19:45:11 -07:00
zotlabs
28f0833237 fix immediate issue with multiple login forms until I can figure out an elegant way to "popup" the modal login form already on the page. We still may need this fix for the actual login module which should always be callable and present a login form even if the nav is completely borked. 2017-02-08 11:24:21 -08:00
redmatrix
3a7d3e3a54 This checkin should make all permission modes work correctly with atokens (they should be able to post content if allowed to). It also removes the strict linkage between permissions and connections so any individual permission can be set for any xchan; even those for which you have no connections. 2016-08-01 20:12:52 -07:00
redmatrix
bc46f70a90 zat URL auth updated to match changes to the atoken_login interface 2016-07-21 20:04:30 -07:00
redmatrix
3affb2e817 sort out some of the authentication mess - with luck this may fix the DAV auth issue which I simply could not duplicate or find a reason for. 2016-07-20 17:55:40 -07:00
redmatrix
e6c8614801 first cut at zot access tokens 2016-07-14 19:24:15 -07:00
redmatrix
2dcedd6951 more work on sessions and cookies, as some anomalies appeared in caldav and firefox which suggested deeper issues 2016-05-16 17:07:39 -07:00
redmatrix
d1a2aecfa0 move more session related stuff such as paranoia handling (IP address changes) into the session object and extend remember_me cookies once a day so that they will never expire (theoretically). The DB session driver will extend its expiration on every session write (in the case of persistent sessions). 2016-04-10 19:20:41 -07:00
redmatrix
abfbe9c937 a few issues: block public not blocking mod_cal, typo in sql for one clone file sync operation, fix_system_urls not catching cached contact photos, extend sessionhandler expiration when remember_me is enabled as the stored session is expiring long before the browser session. 2016-04-10 16:56:08 -07:00
redmatrix
9b66b5eee3 objectify all the session management stuff 2016-04-08 04:44:10 -07:00
redmatrix
a703835b5c Bug: "remember me" doesn't 2016-04-03 17:38:17 -07:00
redmatrix
9abd95fad3 static App 2016-03-31 16:06:03 -07:00
redmatrix
cc29e27acc issue #320 - regression, after removing channel attached to an authenticated session the session was not completely cleared. 2016-03-12 19:53:07 -08:00
ken restivo
ddce0412ac Move api_auth() out to a file that can be included from plugins/modules to allow them to expose their own programmatic API. 2015-11-10 22:50:18 -08:00
friendica
d32f63df82 explicitly unset delegate session vars on logout 2015-03-23 17:51:43 -07:00
friendica
a496036066 local_user => local_channel 2015-01-28 20:56:04 -08:00
Stefan Parviainen
426ac22e12 Redirect to login page on failed login. Fixes #628 2014-12-28 09:26:30 +01:00
Klaus Weidenbach
233903c844 Add security logger to RedDAV.
Some smaller clean ups whitepsaces and tabs, use PHP_EOL, Doxygen, etc.
2014-12-14 01:50:56 +01:00
Habeas Codice
1a5a5c7edb PostgreSQL support initial commit
There were 11 main types of changes:
- UPDATE's and DELETE's sometimes had LIMIT 1 at the end of them. This is not only non-compliant but
it would certainly not do what whoever wrote it thought it would. It is likely this mistake was just
copied from Friendica. All of these instances, the LIMIT 1 was simply removed.
- Bitwise operations (and even some non-zero int checks) erroneously rely on MySQL implicit
integer-boolean conversion in the WHERE clauses. This is non-compliant (and bad programming practice
to boot). Proper explicit boolean conversions were added. New queries should use proper conventions.
- MySQL has a different operator for bitwise XOR than postgres. Rather than add yet another dba_
func, I converted them to "& ~" ("AND NOT") when turning off, and "|" ("OR") when turning on. There
were no true toggles (XOR). New queries should refrain from using XOR when not necessary.
- There are several fields which the schema has marked as NOT NULL, but the inserts don't specify
them. The reason this works is because mysql totally ignores the constraint and adds an empty text
default automatically. Again, non-compliant, obviously. In these cases a default of empty text was
added.
- Several statements rely on a non-standard MySQL feature
(http://dev.mysql.com/doc/refman/5.5/en/group-by-handling.html). These queries can all be rewritten
to be standards compliant. Interestingly enough, the newly rewritten standards compliant queries run
a zillion times faster, even on MySQL.
- A couple of function/operator name translations were needed (RAND/RANDOM, GROUP_CONCAT/STRING_AGG,
UTC_NOW, REGEXP/~, ^/#) -- assist functions added in the dba_
- INTERVALs: postgres requires quotes around the value, mysql requires that there are not quotes
around the value -- assist functions added in the dba_
- NULL_DATE's -- Postgres does not allow the invalid date '0000-00-00 00:00:00' (there is no such
thing as year 0 or month 0 or day 0). We use '0001-01-01 00:00:00' for postgres. Conversions are
handled in Zot/item packets automagically by quoting all dates with dbescdate().
- char(##) specifications in the schema creates fields with blank spaces that aren't trimmed in the
code. MySQL apparently treats char(##) as varchar(##), again, non-compliant. Since postgres works
better with text fields anyway, this ball of bugs was simply side-stepped by using 'text' datatype
for all text fields in the postgres schema. varchar was used in a couple of places where it actually
seemed appropriate (size constraint), but without rigorously vetting that all of the PHP code
actually validates data, new bugs might come out from under the rug.
- postgres doesn't store nul bytes and a few other non-printables in text fields, even when quoted.
bytea fields were used when storing binary data (photo.data, attach.data). A new dbescbin() function
was added to handle this transparently.
- postgres does not support LIMIT #,# syntax. All databases support LIMIT # OFFSET # syntax.
Statements were updated to be standard.

These changes require corresponding changes in the coding standards. Please review those before
adding any code going forward.

Still on my TODO list:
- remove quotes from non-reserved identifiers and make reserved identifiers use dba func for quoting
- Rewrite search queries for better results (both MySQL and Postgres)
2014-11-13 12:21:58 -08:00
Klaus Weidenbach
0875448ab9 Some documentation of include/auth.php. 2014-10-05 14:51:58 +02:00
friendica
5ede60e742 and provide a strong hint by showing the errant account_flags 2014-09-09 18:26:40 -07:00
friendica
c11fc95d97 in case somebody has problems and does an update to try and fix it, put something in the logs to show what's happening. 2014-09-09 18:23:50 -07:00
friendica
dd215607f3 paranoia tweaks 2014-07-21 21:28:45 -07:00
friendica
f65890091e add more control to auth paranoia setting 2014-07-20 00:24:12 -07:00
friendica
83ad5328c8 doco 2014-07-10 19:29:51 -07:00
friendica
fa706c8e86 finish implementing email verification. Currently it only applies if REGISTER_OPEN is in effect. 2014-07-09 21:10:56 -07:00
friendica
ef5ffad690 log IP mis-matches even if paranoia isn't set. 2014-05-11 22:01:53 -07:00
friendica
075b7fa9c8 This should resolve the dav authentication loop (correctly) 2014-02-22 13:33:18 -08:00
friendica
24d119b8c4 introduce a new privacy level "PERMS_AUTHED" to indicate somebody that is able to successfully authenticate (but is not necessarily in this network). 2014-02-18 20:59:25 -08:00