Commit graph

90 commits

Author SHA1 Message Date
Stefan Parviainen
426ac22e12 Redirect to login page on failed login. Fixes #628 2014-12-28 09:26:30 +01:00
Klaus Weidenbach
233903c844 Add security logger to RedDAV.
Some smaller clean ups whitepsaces and tabs, use PHP_EOL, Doxygen, etc.
2014-12-14 01:50:56 +01:00
Habeas Codice
1a5a5c7edb PostgreSQL support initial commit
There were 11 main types of changes:
- UPDATE's and DELETE's sometimes had LIMIT 1 at the end of them. This is not only non-compliant but
it would certainly not do what whoever wrote it thought it would. It is likely this mistake was just
copied from Friendica. All of these instances, the LIMIT 1 was simply removed.
- Bitwise operations (and even some non-zero int checks) erroneously rely on MySQL implicit
integer-boolean conversion in the WHERE clauses. This is non-compliant (and bad programming practice
to boot). Proper explicit boolean conversions were added. New queries should use proper conventions.
- MySQL has a different operator for bitwise XOR than postgres. Rather than add yet another dba_
func, I converted them to "& ~" ("AND NOT") when turning off, and "|" ("OR") when turning on. There
were no true toggles (XOR). New queries should refrain from using XOR when not necessary.
- There are several fields which the schema has marked as NOT NULL, but the inserts don't specify
them. The reason this works is because mysql totally ignores the constraint and adds an empty text
default automatically. Again, non-compliant, obviously. In these cases a default of empty text was
added.
- Several statements rely on a non-standard MySQL feature
(http://dev.mysql.com/doc/refman/5.5/en/group-by-handling.html). These queries can all be rewritten
to be standards compliant. Interestingly enough, the newly rewritten standards compliant queries run
a zillion times faster, even on MySQL.
- A couple of function/operator name translations were needed (RAND/RANDOM, GROUP_CONCAT/STRING_AGG,
UTC_NOW, REGEXP/~, ^/#) -- assist functions added in the dba_
- INTERVALs: postgres requires quotes around the value, mysql requires that there are not quotes
around the value -- assist functions added in the dba_
- NULL_DATE's -- Postgres does not allow the invalid date '0000-00-00 00:00:00' (there is no such
thing as year 0 or month 0 or day 0). We use '0001-01-01 00:00:00' for postgres. Conversions are
handled in Zot/item packets automagically by quoting all dates with dbescdate().
- char(##) specifications in the schema creates fields with blank spaces that aren't trimmed in the
code. MySQL apparently treats char(##) as varchar(##), again, non-compliant. Since postgres works
better with text fields anyway, this ball of bugs was simply side-stepped by using 'text' datatype
for all text fields in the postgres schema. varchar was used in a couple of places where it actually
seemed appropriate (size constraint), but without rigorously vetting that all of the PHP code
actually validates data, new bugs might come out from under the rug.
- postgres doesn't store nul bytes and a few other non-printables in text fields, even when quoted.
bytea fields were used when storing binary data (photo.data, attach.data). A new dbescbin() function
was added to handle this transparently.
- postgres does not support LIMIT #,# syntax. All databases support LIMIT # OFFSET # syntax.
Statements were updated to be standard.

These changes require corresponding changes in the coding standards. Please review those before
adding any code going forward.

Still on my TODO list:
- remove quotes from non-reserved identifiers and make reserved identifiers use dba func for quoting
- Rewrite search queries for better results (both MySQL and Postgres)
2014-11-13 12:21:58 -08:00
Klaus Weidenbach
0875448ab9 Some documentation of include/auth.php. 2014-10-05 14:51:58 +02:00
friendica
5ede60e742 and provide a strong hint by showing the errant account_flags 2014-09-09 18:26:40 -07:00
friendica
c11fc95d97 in case somebody has problems and does an update to try and fix it, put something in the logs to show what's happening. 2014-09-09 18:23:50 -07:00
friendica
dd215607f3 paranoia tweaks 2014-07-21 21:28:45 -07:00
friendica
f65890091e add more control to auth paranoia setting 2014-07-20 00:24:12 -07:00
friendica
83ad5328c8 doco 2014-07-10 19:29:51 -07:00
friendica
fa706c8e86 finish implementing email verification. Currently it only applies if REGISTER_OPEN is in effect. 2014-07-09 21:10:56 -07:00
friendica
ef5ffad690 log IP mis-matches even if paranoia isn't set. 2014-05-11 22:01:53 -07:00
friendica
075b7fa9c8 This should resolve the dav authentication loop (correctly) 2014-02-22 13:33:18 -08:00
friendica
24d119b8c4 introduce a new privacy level "PERMS_AUTHED" to indicate somebody that is able to successfully authenticate (but is not necessarily in this network). 2014-02-18 20:59:25 -08:00
friendica
5747e20e50 some more snakebite and fix up include/account - forgot about that inline array stuff 2014-02-18 16:59:31 -08:00
friendica
d6ab975b18 operation snakebite continued. openid now works for local accounts using the rmagic module and after storing your openid in pconfig. This is just an interesting but trivial (in the bigger scheme of things) side effect of snakebite. The snake hasn't even waken up yet. 2014-02-17 19:48:05 -08:00
friendica
655b6445d5 use profile photo on vcard before reverting to xchan photo 2014-02-11 19:51:43 -08:00
Thomas Willingham
9addc83520 Log failed auth to it's own file so fail2ban doesn't have to parse MB of text 2014-01-15 22:54:51 +00:00
friendica
f57909d190 on successful magic-auth, put remote_service_class and remote_hub into the session 2013-12-03 16:31:05 -08:00
friendica
4ce948731a doc - complete hook list, still need detailed functional descriptions with parameters and examples for each 2013-10-18 15:48:59 -07:00
Christian Vogeley
02fe2d4881 More mobile theme fixes
If user is logged in  personal settings are used else use admin
settings.
Only show toggle link if there is something to switch between.
2013-08-31 18:20:34 +02:00
friendica
a8dd7280b3 get rid of more variables with dashes in the names - use underscore *except* in CSS. These were probably already here, but if you see any - please keep them out of PHP and MySQL where they sometimes get interpreted as a subtraction operation and are a bugger to find. 2013-08-15 22:52:19 -07:00
friendica
f9e61fe075 remote control - if auth'd visitor is in config system remote_admins (array), become superuser. Literally. Full control. Untested. 2013-07-22 14:34:26 -07:00
friendica
5e83c58a95 move new_cookie() to the session driver so we can use it for other purposes besides "normal" web login (for instance magic auth) 2013-05-23 20:35:40 -07:00
friendica
ea3940c4b0 start formatting for Doxygen 2013-02-25 17:09:40 -08:00
friendica
28ab6d5bf5 lostpass fixes and login/logout flow if authenticated but no default channel exists 2013-01-27 01:19:24 -08:00
friendica
c96eb6dc97 make contact_remove sort of work so I can actually get rid of Oliver's and Michael J's dead contacts and not poll them every ten minutes forever 2013-01-25 16:18:35 -08:00
friendica
fb76675a28 now we're into the minor nitty fixes 2013-01-21 19:56:39 -08:00
friendica
5949607d17 magic auth - it's mostly done or at least all the code bits are written and it looks in theory to be pretty secure and it doesn't white screen. Getting it to actually work(?), well we won't know how hard that will be until we get it on a couple of systems and try it. Magic auth on one box is a no-op because you're already authenticated. 2013-01-21 19:16:21 -08:00
friendica
490867ebf7 port "remember me" from Friendica 2013-01-04 21:34:36 -08:00
friendica
87c171030c upstream fixes 2012-10-21 17:23:21 -07:00
friendica
3ebb4a3dc7 updates 2012-09-09 21:17:06 -07:00
friendica
7fad83cea4 Now logging in with Red zaccount/zentity instead of Friendica user. Yay. Most existing Friendica functionality is now stuffed since the Red structures are quite different. 2012-08-27 21:17:46 -07:00
friendica
5ff6e9348b a few minor changes 2012-08-26 23:05:00 -07:00
friendica
08941d4285 handle multiple underscores in D* links 2012-05-26 23:46:42 -07:00
friendica
b43b680802 clear submanage, etc from session on logout 2012-05-22 18:05:58 -07:00
Alexander Kampmann
355c42cb30 Merge branch 'master' of https://github.com/friendica/friendica
Conflicts:
	include/config.php
	update.php
2012-04-05 13:39:15 +02:00
Tobias Diekershoff
17c908973f catch OpenID login errors in cases when the OpenID server does not answers 2012-03-30 15:19:17 +02:00
friendica
5a5aadb743 add IP address to failed login log message 2012-03-19 21:58:21 -07:00
friendica
a156ce196e Merge pull request #150 from fabrixxm/master
Add "logging_out" hook
2012-03-19 15:29:32 -07:00
friendica
9e133d6412 refactor openid logins/registrations 2012-03-19 15:03:09 -07:00
Fabio Comuni
c30342e2f7 add 'loggin_out' hook 2012-03-12 15:58:59 +01:00
friendica
ada2a555dc sql typo in auto-friend with D* 2012-02-15 23:58:28 -08:00
friendica
8aa2552372 add remove_user hook (it looks like dreamhost changed all my file permissions, this will make a nasty commit) 2012-01-18 16:21:30 -08:00
friendica
4b6990e1ff modularise successful authentication 2012-01-12 15:46:39 -08:00
Fabio Comuni
de44072172 works on login form 2011-10-17 16:53:59 +02:00
Friendika
5b3f645939 account expiration structures 2011-09-18 19:53:45 -07:00
Friendika
8f6ae2b660 missing salmon key? report it. 2011-08-24 20:40:08 -07:00
Friendika
2637831d90 some more zot changes migrating back to f9a mainline 2011-08-01 21:02:25 -07:00
Friendika
00c548cc8f new member page 2011-06-03 06:12:34 -07:00
Friendika
78b2db3a98 Merge branch 'fabrixxm-master'
Conflicts:
	boot.php
2011-05-23 18:17:02 -07:00