OpencachingDeutschland/oc-server3
1
0
Fork 0
Code Issues Pull Requests Releases Activity

- session id is now generated from truly random value, previous used mysql UUID() had weak randomness

Browse Source 
- added session id brute force prevention to old template engine (as used in new template engine)
- forced login->verify() in old template engine
- removed unused login/logout related codes from old template engine
- uuid of new database records is now generated in before insert trigger
This commit is contained in:
ocoliver
2012-11-17 18:04:35 +01:00
parent 797fa10e83
commit a4aee625a9
17 changed files with 4048 additions and 4146 deletions
Download Patch File Download Diff File Expand all files Collapse all files
htdocs/lib2/logic/rowEditor.class.php
+8 -6
View File
@@ -58,6 +58,9 @@ class rowEditor
function addPKString($sField, $sDefault, $bNullable, $nInsertFunction=RE_INSERT_NOTHING)
{
if (($nInsertFunction & RE_INSERT_AUTOUUID) == RE_INSERT_AUTOUUID)
die('rowEditor: RE_INSERT_AUTOUUID not supported for primary key fields');
$this->pk[$sField] = array('type' => RE_TYPE_STRING,
'default' => $sDefault,
'nullable' => $bNullable,
@@ -390,6 +393,9 @@ class rowEditor
$this->fields[$this->sAutoIncrementField]['value'] = $nInsertId;
}
/* reload the record to get the actual stored values
* (inserted values maybe truncated by mysql or trigger could modify values)
*/
$pkv = array();
foreach ($this->pk AS $k => $v)
{
@@ -454,9 +460,7 @@ class rowEditor
if ((($field['insertfunction'] & RE_INSERT_OVERWRITE) == RE_INSERT_OVERWRITE) || (($field['changed'] == false) && ($field['insertfunction'] != RE_INSERT_NOTHING)))
{
if (($field['insertfunction'] & RE_INSERT_UUID) == RE_INSERT_UUID)
$sValues[] = 'UUID()';
else if (($field['insertfunction'] & RE_INSERT_NOW) == RE_INSERT_NOW)
if (($field['insertfunction'] & RE_INSERT_NOW) == RE_INSERT_NOW)
$sValues[] = 'NOW()';
else
$sValues[] = 'NULL';
@@ -479,9 +483,7 @@ class rowEditor
if ((($field['insertfunction'] & RE_INSERT_OVERWRITE) == RE_INSERT_OVERWRITE) || (($field['changed'] == false) && ($field['insertfunction'] != RE_INSERT_NOTHING)))
{
if (($field['insertfunction'] & RE_INSERT_UUID) == RE_INSERT_UUID)
$sValues[] = 'UUID()';
else if (($field['insertfunction'] & RE_INSERT_NOW) == RE_INSERT_NOW)
if (($field['insertfunction'] & RE_INSERT_NOW) == RE_INSERT_NOW)
$sValues[] = 'NOW()';
else
$sValues[] = 'NULL';