merged stable

2013-03-24 23:07:22 +01:00
parent 7eccc1d5d1 a37f20a5e8
commit 2b2619d009
10 changed files with 62 additions and 11 deletions
--- a/htdocs/doc/sql/db-changes.txt
+++ b/htdocs/doc/sql/db-changes.txt
@@ -55,5 +55,6 @@ date         commit ID    change
 2013-03-18   37b5268a     added table 'saved_texts' + triggers
                          added triggers to table 'coordinates'

-2013-03-20                added field caches.listing_last_modified;
+2013-03-20   085c1398     added field caches.listing_last_modified;
                            must be initialized once via Admin / DB Maintenance / sp_updateall_cache_listingdates
+2013-03-24                added table 'pw_dict'
--- a/htdocs/doc/sql/static-data/data.sql
+++ b/htdocs/doc/sql/static-data/data.sql
@@ -2431,6 +2431,8 @@ INSERT INTO `sys_trans` (`id`, `text`, `last_modified`) VALUES ('1967', 'all log
 INSERT INTO `sys_trans` (`id`, `text`, `last_modified`) VALUES ('1968', 'more', '2013-02-23 19:00:04');
 INSERT INTO `sys_trans` (`id`, `text`, `last_modified`) VALUES ('1969', 'Only the <span class=\"public-setting\">green entries</span> are visible to other users.', '2013-02-23 19:00:04');
 INSERT INTO `sys_trans` (`id`, `text`, `last_modified`) VALUES ('1973', 'Generally, spoiler pictures should not be logged. In the case that en exception from this rule makes sense, e.g. to document your finding or problems with the stash, please mark the picture als spoiler so that it won\'t appear in galleries.', '2013-02-23 19:00:04');
+INSERT INTO `sys_trans` (`id`, `text`, `last_modified`) VALUES ('1975', 'Do not use easy-to-guess number and letter sequences like \'123456\' or \'qwerty\'', '2013-02-23 19:00:04');
+INSERT INTO `sys_trans` (`id`, `text`, `last_modified`) VALUES ('1976', 'currently not available', '2013-02-23 19:00:04');

 -- Table sys_trans_ref
 SET NAMES 'utf8';
@@ -5434,7 +5436,7 @@ INSERT INTO `sys_trans_text` (`trans_id`, `lang`, `text`, `last_modified`) VALUE
 INSERT INTO `sys_trans_text` (`trans_id`, `lang`, `text`, `last_modified`) VALUES ('847', 'DE', 'Durch diese Regeln ist dein Passwort sicher und kann nicht durch automatisierte Programme oder andere Benutzer erraten werden.', '2010-08-28 11:48:07');
 INSERT INTO `sys_trans_text` (`trans_id`, `lang`, `text`, `last_modified`) VALUES ('848', 'DE', 'a-z A-Z 0-9 und .-_ @\&auml;\&uuml;\&ouml;\&Auml;\&Uuml;\&Ouml;=)(/\\\&amp;*+~# \r\n', '2010-08-28 11:48:07');
 INSERT INTO `sys_trans_text` (`trans_id`, `lang`, `text`, `last_modified`) VALUES ('849', 'DE', 'Es sind nicht alle Sonderzeichen erlaubt. Verwende nur die Folgenden:', '2010-08-28 11:48:07');
-INSERT INTO `sys_trans_text` (`trans_id`, `lang`, `text`, `last_modified`) VALUES ('850', 'DE', 'Verwende keine Wörter aus dem Wörterbuch z.B. \'geheim\'.', '2010-08-28 11:48:07');
+INSERT INTO `sys_trans_text` (`trans_id`, `lang`, `text`, `last_modified`) VALUES ('850', 'DE', 'Verwende keine Wörter aus dem Wörterbuch z.B. &bdquo;geheim&ldquo;.', '2010-08-28 11:48:07');
 INSERT INTO `sys_trans_text` (`trans_id`, `lang`, `text`, `last_modified`) VALUES ('851', 'DE', 'Verwende keine Begriffe aus dem Geocaching.', '2010-08-28 11:48:07');
 INSERT INTO `sys_trans_text` (`trans_id`, `lang`, `text`, `last_modified`) VALUES ('852', 'DE', 'Verwende keine Teile deines Benutzernamen, deines Namens oder deiner E-Mail.', '2010-08-28 11:48:07');
 INSERT INTO `sys_trans_text` (`trans_id`, `lang`, `text`, `last_modified`) VALUES ('853', 'DE', 'zwischen 6 und 60 Zeichen lang', '2010-08-28 11:48:07');
@@ -6139,6 +6141,8 @@ INSERT INTO `sys_trans_text` (`trans_id`, `lang`, `text`, `last_modified`) VALUE
 INSERT INTO `sys_trans_text` (`trans_id`, `lang`, `text`, `last_modified`) VALUES ('1968', 'DE', 'mehr', '2013-02-19 05:48:07');
 INSERT INTO `sys_trans_text` (`trans_id`, `lang`, `text`, `last_modified`) VALUES ('1969', 'DE', 'Nur die <span class=\"public-setting\">grüne Einträge</span> sind für andere Benutzer sichtbar.', '2013-02-19 05:48:07');
 INSERT INTO `sys_trans_text` (`trans_id`, `lang`, `text`, `last_modified`) VALUES ('1973', 'DE', 'Es sollten möglichst keine Spoilerbilder geloggt werden. In Ausnahmefällen, wo es sinnvoll erscheint &ndash; z.B. um den Fund nachzuweisen oder Probleme mit dem Versteck zu dokumentieren &ndash; kennzeichne sie bitte als Spoiler, damit sie nicht in Bildgalerien erscheinen.', '2013-02-19 05:48:07');
+INSERT INTO `sys_trans_text` (`trans_id`, `lang`, `text`, `last_modified`) VALUES ('1975', 'DE', 'Verwende keine einfach erratbaren Ziffern- oder Buchstabenkombinationen wie &bdquo;123456&ldquo; oder &bdquo;qwertz&ldquo;.', '2013-02-19 05:48:07');
+INSERT INTO `sys_trans_text` (`trans_id`, `lang`, `text`, `last_modified`) VALUES ('1976', 'DE', 'zurzeit nicht verfügbar', '2013-02-19 05:48:07');
 INSERT INTO `sys_trans_text` (`trans_id`, `lang`, `text`, `last_modified`) VALUES ('1', 'EN', 'Reorder IDs \r', '2010-09-02 00:15:30');
 INSERT INTO `sys_trans_text` (`trans_id`, `lang`, `text`, `last_modified`) VALUES ('2', 'EN', 'The database could not be reconnected.', '2010-08-28 11:48:07');
 INSERT INTO `sys_trans_text` (`trans_id`, `lang`, `text`, `last_modified`) VALUES ('3', 'EN', 'Testing – please do not login', '2010-08-28 11:48:07');
@@ -7634,6 +7638,8 @@ INSERT INTO `sys_trans_text` (`trans_id`, `lang`, `text`, `last_modified`) VALUE
 INSERT INTO `sys_trans_text` (`trans_id`, `lang`, `text`, `last_modified`) VALUES ('1968', 'EN', 'more', '2013-02-19 05:48:07');
 INSERT INTO `sys_trans_text` (`trans_id`, `lang`, `text`, `last_modified`) VALUES ('1969', 'EN', 'Only the <span class=\"public-setting\">green entries</span> are visible to other users.', '2013-02-19 05:48:07');
 INSERT INTO `sys_trans_text` (`trans_id`, `lang`, `text`, `last_modified`) VALUES ('1973', 'EN', 'Generally, spoiler pictures should not be logged. In the case that en exception from this rule makes sense, e.g. to document your finding or problems with the stash, please mark the picture als spoiler so that it won\'t appear in galleries.', '2013-02-19 05:48:07');
+INSERT INTO `sys_trans_text` (`trans_id`, `lang`, `text`, `last_modified`) VALUES ('1975', 'EN', 'Do not use easy-to-guess number and letter sequences like \'123456\' or \'qwerty\'.', '2013-02-19 05:48:07');
+INSERT INTO `sys_trans_text` (`trans_id`, `lang`, `text`, `last_modified`) VALUES ('1976', 'EN', 'currently not available', '2013-02-19 05:48:07');
 INSERT INTO `sys_trans_text` (`trans_id`, `lang`, `text`, `last_modified`) VALUES ('1', 'ES', 'Reordenar ID', '2010-12-09 00:17:55');
 INSERT INTO `sys_trans_text` (`trans_id`, `lang`, `text`, `last_modified`) VALUES ('2', 'ES', 'La base de datos no se pudo conectar.', '2010-12-09 00:17:55');
 INSERT INTO `sys_trans_text` (`trans_id`, `lang`, `text`, `last_modified`) VALUES ('3', 'ES', 'En pruebas - por favor, no entre.', '2010-12-09 00:17:55');
--- a/htdocs/doc/sql/static-data/pwlist.php
+++ b/htdocs/doc/sql/static-data/pwlist.php
@@ -0,0 +1,32 @@
+<?php
+/***************************************************************************
+ *  For license information see doc/license.txt
+ *
+ *  Unicode Reminder メモ
+ *
+ *  Read anti-cracking password list into database
+ ***************************************************************************/
+
+	$opt['rootpath'] = '../../../';
+	require($opt['rootpath'] . 'lib2/web.inc.php');
+
+	$pwf = @fopen('pw_dict', 'r');
+	if ($pwf)
+	{
+		// sql("TRUNCATE TABLE `pw_dict`");
+		$n = 0;
+
+		while (!feof($pwf))
+		{
+			$pw = fgets($pwf);
+			sql("INSERT IGNORE INTO `pw_dict` (`pw`) VALUES ('&1')", trim($pw));
+			++$n;
+		}
+		fclose($pwf);
+
+		echo "inserted " . $n . " passwords\n";
+	}
+	else
+		echo "could not open pw_dict\n";
+
+?>
--- a/htdocs/doc/sql/tables/pw_dict.sql
+++ b/htdocs/doc/sql/tables/pw_dict.sql
@@ -0,0 +1,6 @@
+SET NAMES 'utf8';
+DROP TABLE IF EXISTS `pw_dict`;
+CREATE TABLE `pw_dict` (
+  `pw` varchar(40) NOT NULL,
+  UNIQUE KEY `pw` (`pw`)
+) ENGINE=MyISAM DEFAULT CHARSET=utf8;
--- a/htdocs/lib2/RSSParser.class.php
+++ b/htdocs/lib2/RSSParser.class.php
@@ -11,6 +11,7 @@ class RSSParser {
 	 * @return string $item feeditems as HTML-string
 	 */
 	public static function parse($items,$url) {
+		global $translate;
 		
    if ($items <= 0)
      return '';
@@ -28,7 +29,7 @@ class RSSParser {
 			$html .= '<div class="newsblock">';
 			
 			// get xml-data
-			$data = file_get_contents($url);
+			$data = @file_get_contents($url);
 			
 			// check data
 			if($data === false || strpos($data, 'rss version=') === false) {
@@ -75,7 +76,7 @@ class RSSParser {
 		if(!$error) {
 			return $html;
 		} else {
-			return '';
+			return '<p><em>' . $translate->t('currently not available','','',0) . '</em></p>';
 		}
 	}
 }
--- a/htdocs/lib2/logic/cracklib.inc.php
+++ b/htdocs/lib2/logic/cracklib.inc.php
@@ -70,14 +70,18 @@ function cracklib_checkpw($pw, $addwords)

 	// $pw may not contain one of $addwords[]
 	foreach ($wordlist AS $v)
-		if (mb_strpos($pw_lc, $v) !== false)
+		if (mb_stripos($pw_lc, $v) !== false)
 			return false;

 	// one of $addwords[] may not contain $pw
 	foreach ($wordlist AS $v)
-		if (mb_strpos($v, $pw_lc) !== false)
+		if (mb_stripos($v, $pw_lc) !== false)
 			return false;

+	// words from pw library are not allowed
+	if (sql_value("SELECT COUNT(*) FROM `pw_dict` WHERE `pw`='&1'", 0, $pw))
+		return false;
+
 	if ($opt['logic']['cracklib'] == true)
 	{
 		// load cracklib
--- a/htdocs/lib2/logic/user.class.php
+++ b/htdocs/lib2/logic/user.class.php
@@ -157,7 +157,7 @@ class user
 		if (!mb_ereg_match(REGEX_PASSWORD, $value))
 			return false;

-		if (cracklib_checkPW($value, array('open', 'caching', $this->getUsername(), $this->getFirstName(), $this->getLastName())) == false)
+		if (cracklib_checkPW($value, array('open', 'caching', 'cache', $this->getUsername(), $this->getFirstName(), $this->getLastName())) == false)
 			return false;

 		$pwmd5 = md5($value);
--- a/htdocs/templates2/ocstyle/articles/DE/contact.tpl
+++ b/htdocs/templates2/ocstyle/articles/DE/contact.tpl
@@ -20,7 +20,7 @@
 			<br />
 			<br />
 			Wenn du ein spezielles Problem hast und darauf keine Antwort findest, 
-			kannst du dir unter <a href="http://forum.geocaching-network.com/">forum.geocaching-network.com</a>
+			kannst du dir unter <a href="http://forum.opencaching-network.org/">forum.opencaching-network.org</a>
 			ein passendes Forum raussuchen und dich dort erkundigen.<br />
 			&nbsp;
 		</td>
@@ -34,7 +34,7 @@
 	<tr>
 		<td>
 			Hierfür gibt es ein eigenes Unterforum auf 
-			<a href="http://forum.geocaching-network.com/index.php?board=33.0">forum.geocaching-network.com</a>.
+			<a href="http://forum.opencaching-network.org/index.php?board=33.0">forum.opencaching-network.org</a>.
 			Dort findest du auch weitere Informationen, falls du in unserem Team mitmachen möchtest.
 			<br />
 			&nbsp;
--- a/htdocs/templates2/ocstyle/articles/EN/contact.tpl
+++ b/htdocs/templates2/ocstyle/articles/EN/contact.tpl
@@ -19,7 +19,7 @@
 		  For general questions, you will find lots of information at the German websites <a href="http://wiki.opencaching.de">wiki.opencaching.de</a> and <a href="http://www.geocaching.de">www.geocaching.de</a>.
 			<br />
 			<br />
-			If you encounter a special problem, you may ask your questions in one of the German or international discussion boards at <a href="http://forum.geocaching-network.com/">forum.geocaching-network.com</a>.<br />
+			If you encounter a special problem, you may ask your questions in one of the German or international discussion boards at <a href="http://forum.opencaching-network.org/">forum.opencaching-network.org</a>.<br />
 			&nbsp;
 		</td>
 	</tr>
@@ -32,7 +32,7 @@
 	<tr>
 		<td>
 		  There is a board for this purpose at  
-			<a href="http://forum.geocaching-network.com/index.php?board=33.0">forum.geocaching-network.com</a> (<em>Opencaching 3.0 &ndash; Ideen und Gedanken</em>). It also conatains (German) information on joining our team.
+			<a href="http://forum.opencaching-network.org/index.php?board=33.0">forum.opencaching-network.org</a> (<em>Opencaching 3.0 &ndash; Ideen und Gedanken</em>). It also conatains (German) information on joining our team.
 			<br />
 			&nbsp;
 		</td>
--- a/htdocs/templates2/ocstyle/res_passworderror.tpl
+++ b/htdocs/templates2/ocstyle/res_passworderror.tpl
@@ -7,6 +7,7 @@
 		<li>{t}Do not use parts of your username, name or email{/t}</li>
 		<li>{t}Do not use common geocaching words{/t}</li>
 		<li>{t}Do not use dictionary words like 'master'{/t}</li>
+		<li>{t}Do not use easy-to-guess number and letter sequences like '123456' or 'qwerty'{/t}</i>
 		<li>{t}Not all special characters are allowed. You may only use{/t}<br />
 		    {t}a-z A-Z 0-9 and .-_ @&auml;&uuml;&ouml;&Auml;&Uuml;&Ouml;=)(/\&amp;*+~#{/t}</li>
 	</ul>