L-electron-Rare/moodle
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

MDL-22739, MDL-23772 improved changeme hack + finally fixing the delayed changeme effect

Browse Source
This commit is contained in:
Petr Skoda
2010-10-11 07:55:24 +00:00
parent fab0a39fe3
commit 22a8fbdcf9
3 changed files with 70 additions and 43 deletions
Download Patch File Download Diff File Expand all files Collapse all files
auth/manual/auth.php
+59 -27
View File
@@ -1,24 +1,40 @@
<?php
// This file is part of Moodle - http://moodle.org/
//
// Moodle is free software: you can redistribute it and/or modify
// it under the terms of the GNU General Public License as published by
// the Free Software Foundation, either version 3 of the License, or
// (at your option) any later version.
//
// Moodle is distributed in the hope that it will be useful,
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
// GNU General Public License for more details.
//
// You should have received a copy of the GNU General Public License
// along with Moodle. If not, see <http://www.gnu.org/licenses/>.
/**
* @author Martin Dougiamas
* @license http://www.gnu.org/copyleft/gpl.html GNU Public License
* @package moodle multiauth
*
* Authentication Plugin: Manual Authentication
*
* Just does a simple check against the moodle database.
*
* 2006-08-28 File created.
* @package auth
* @subpackage manual
* @copyright 1999 onwards Martin Dougiamas (http://dougiamas.com)
* @license http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
*/
if (!defined('MOODLE_INTERNAL')) {
die('Direct access to this script is forbidden.'); /// It must be included from a Moodle page
}
defined('MOODLE_INTERNAL') || die();
require_once($CFG->libdir.'/authlib.php');
/**
* Manual authentication plugin.
*
* @package auth
* @subpackage manual
* @copyright 1999 onwards Martin Dougiamas (http://dougiamas.com)
* @license http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
*/
class auth_plugin_manual extends auth_plugin_base {
@@ -32,30 +48,37 @@ class auth_plugin_manual extends auth_plugin_base {
/**
* Returns true if the username and password work and false if they are
* wrong or don't exist.
*
* @param string $username The username (with system magic quotes)
* @param string $password The password (with system magic quotes)
* wrong or don't exist. (Non-mnet accounts only!)
*
* @param string $username The username
* @param string $password The password
* @return bool Authentication success or failure.
*/
function user_login ($username, $password) {
global $CFG, $DB;
if ($user = $DB->get_record('user', array('username'=>$username, 'mnethostid'=>$CFG->mnet_localhost_id))) {
return validate_internal_user_password($user, $password);
function user_login($username, $password) {
global $CFG, $DB, $USER;
if (!$user = $DB->get_record('user', array('username'=>$username, 'mnethostid'=>$CFG->mnet_localhost_id))) {
return false;
}
return false;
if (!validate_internal_user_password($user, $password)) {
return false;
}
if ($password === 'changeme') {
// force the change - this is deprecated and it makes sense only for manual auth,
// because most other plugins can not change password easily or
// passwords are always specified by users
set_user_preference('auth_forcepasswordchange', true, $user->id);
}
return true;
}
/**
* Updates the user's password.
*
* called when the user password is updated.
* Called when the user password is updated.
*
* @param object $user User table object (with system magic quotes)
* @param string $newpassword Plaintext password (with system magic quotes)
* @param object $user User table object
* @param string $newpassword Plaintext password
* @return boolean result
*
*/
function user_update_password($user, $newpassword) {
$user = get_complete_user_data('id', $user->id);
@@ -110,7 +133,10 @@ class auth_plugin_manual extends auth_plugin_base {
* This function is called from admin/auth.php, and outputs a full page with
* a form for configuring this plugin.
*
* @param array $page An object containing all the data for this page.
* @param array $config An object containing all the data for this page.
* @param string $error
* @param array $user_fields
* @return void
*/
function config_form($config, $err, $user_fields) {
include 'config.html';
@@ -118,16 +144,22 @@ class auth_plugin_manual extends auth_plugin_base {
/**
* Processes and stores configuration data for this authentication plugin.
*
* @param array $config
* @return void
*/
function process_config($config) {
return true;
}
/**
* Confirm the new user as registered. This should normally not be used,
* but it may be necessary if the user auth_method is changed to manual
* before the user is confirmed.
*/
* Confirm the new user as registered. This should normally not be used,
* but it may be necessary if the user auth_method is changed to manual
* before the user is confirmed.
*
* @param string $username
* @param string $confirmsecret
*/
function user_confirm($username, $confirmsecret = null) {
global $DB;
lib/moodlelib.php
+11 -10
View File
@@ -3629,18 +3629,18 @@ function guest_user() {
* log that the user has logged in, and call complete_user_login() to set
* the session up.
*
* @global object
* @global object
* Note: this function works only with non-mnet accounts!
*
* @param string $username User's username
* @param string $password User's password
* @return user|flase A {@link $USER} object or false if error
*/
function authenticate_user_login($username, $password) {
global $CFG, $DB, $OUTPUT;
global $CFG, $DB;
$authsenabled = get_enabled_auth_plugins();
if ($user = get_complete_user_data('username', $username)) {
if ($user = get_complete_user_data('username', $username, $CFG->mnet_localhost_id)) {
$auth = empty($user->auth) ? 'manual' : $user->auth; // use manual if auth not set
if (!empty($user->suspended)) {
add_to_log(0, 'login', 'error', 'index.php', $username);
@@ -3657,13 +3657,14 @@ function authenticate_user_login($username, $password) {
} else {
// check if there's a deleted record (cheaply)
if ($DB->get_field('user', 'id', array('username'=>$username, 'deleted'=>1))) {
error_log('[client '.$_SERVER['REMOTE_ADDR']."] $CFG->wwwroot Deleted Login: $username ".$_SERVER['HTTP_USER_AGENT']);
error_log('[client '.getremoteaddr()."] $CFG->wwwroot Deleted Login: $username ".$_SERVER['HTTP_USER_AGENT']);
return false;
}
// User does not exist
$auths = $authsenabled;
$user = new stdClass();
$user->id = 0; // User does not exist
$user->id = 0;
}
foreach ($auths as $auth) {
@@ -3732,15 +3733,12 @@ function authenticate_user_login($username, $password) {
* NOTE:
* - It will NOT log anything -- up to the caller to decide what to log.
*
* @global object
* @global object
* @global object
* @param object $user
* @param bool $setcookie
* @return object A {@link $USER} object - BC only, do not use
*/
function complete_user_login($user, $setcookie=true) {
global $CFG, $USER, $SESSION;
global $CFG, $USER;
// regenerate session id and delete old session,
// this helps prevent session fixation attacks from the same domain
@@ -3749,6 +3747,9 @@ function complete_user_login($user, $setcookie=true) {
// check enrolments, load caps and setup $USER object
session_set_user($user);
// clear the preferences and invalidate caches too
unset($USER->preference);
update_user_login_times();
set_login_session_preferences();
login/index.php
-6
View File
@@ -172,12 +172,6 @@ if ($frm and isset($frm->username)) { // Login WITH
die;
}
if ($user->auth === 'manual' and $frm->password === 'changeme') {
// force the change - this is deprecated and it makes sense only for manual auth,
// because most other plugins can not change password easily
set_user_preference('auth_forcepasswordchange', true, $user->id);
}
/// Let's get them all set up.
add_to_log(SITEID, 'user', 'login', "view.php?id=$USER->id&course=".SITEID,
$user->id, 0, $user->id);