makary/phpbb
1
0
Fork 0
mirror of https://github.com/phpbb/phpbb.git synced 2025-06-19 09:48:53 +00:00
Code Issues Projects Releases Packages Wiki Activity
19718 commits 18 branches 192 tags 207 MiB
Commit graph

19718 commits

This branch
This branch
All branches
Author SHA1 Message Date
Marc Alexander
ab068799b1 [feature/passwords] Pass phpbb_container to passwords helper 
PHPBB3-11610
 2013-09-14 13:53:31 +02:00
Marc Alexander
e4a5aacf2a [feature/passwords] Use correct prefix for salt in salted_md5 
PHPBB3-11610
 2013-09-14 13:53:26 +02:00
Marc Alexander
857b90057b [feature/passwords] Add method for obtaining the hash settings only 
This is needed for combined hashing of passwords.

PHPBB3-11610
 2013-09-14 13:53:19 +02:00
Marc Alexander
dae4327cfc [feature/passwords] Add schema changes for new hash types 
PHPBB3-11610
 2013-09-14 13:53:14 +02:00
Marc Alexander
4b81b93d10 [feature/passwords] Make sure hash has the required length 
Also added tests to make sure that crypto drivers are enforcing the hash
length.

PHPBB3-11610
 2013-09-14 13:53:08 +02:00
Marc Alexander
7ddf004489 [feature/passwords] Make method get_hashing_algorithm() protected 
There is currently no use for it being public.

PHPBB3-11610
 2013-09-14 13:53:03 +02:00
Marc Alexander
e7b3daeb29 [feature/passwords] Add tests for manager check_hash() method 
Tests cover all supported hashing algorithms.

PHPBB3-11610
 2013-09-14 13:52:57 +02:00
Marc Alexander
13d25e6a32 [feature/passwords] Fix tests for PHP version < 5.3.7 
PHPBB3-11610
 2013-09-14 13:52:52 +02:00
Marc Alexander
3f70699aa3 [feature/passwords] Use common salt generation function for all types 
We will be using the same method inside the driver helper class for all hash
types. This is the same function that has been used for the salted md5 hash
of phpBB 3.0.

PHPBB3-11610
 2013-09-14 13:52:43 +02:00
Marc Alexander
5574b2a8e9 [feature/passwords] Add driver helper class file 
PHPBB3-11610
 2013-09-14 13:52:38 +02:00
Marc Alexander
33725f6e2f [feature/passwords] Include driver helper in manager_test 
PHPBB3-11610
 2013-09-14 13:52:33 +02:00
Marc Alexander
61e98fbd63 [feature/passwords] Add driver helper class for additional functions 
Functions for the helper class might be used in other drivers as well and
therefore shouldn't be limited to just one driver.

PHPBB3-11610
 2013-09-14 13:52:25 +02:00
Marc Alexander
c9fafcefd3 [feature/passwords] Add basic passwords manager test file 
PHPBB3-11610
 2013-09-14 13:52:15 +02:00
Marc Alexander
f8bcf99c7f [feature/passwords] Do not support 8-bit characters with $2a$ bcrypt 
8-bit unicode characters might reduce the security of the password hash
when using the $2a$ bcrypt prefix. Those types of characters are usually
not used in passwords but we should prevent this possible issue anyway.

PHPBB3-11610
 2013-09-14 13:52:09 +02:00
Marc Alexander
8795fe9c77 [feature/passwords] Add convert flag for converting to default 
PHPBB3-11610
 2013-09-14 13:52:04 +02:00
Marc Alexander
d3d317a2de [feature/passwords] Correctly supply hash salt and settings to bcrypt 
PHPBB3-11610
 2013-09-14 13:51:44 +02:00
Marc Alexander
c9afda5a65 [feature/passwords] Use correct prefix for bcrypt type 
PHPBB3-11610
 2013-09-14 13:51:39 +02:00
Marc Alexander
7a526284d3 [feature/passwords] Default to bcrypt with $2y$ prefix if possible 
PHPBB3-11610
 2013-09-14 13:51:31 +02:00
Marc Alexander
78a8369173 [feature/passwords] Add basic bcrypt drivers for $2a$ & $2y$ prefix 
The $2a$ prefix is the basic implementation with the $2y$ prefix extending
that class. However, the default hashes for phpBB should be generated with
$2y$ unless the PHP version is older than 5.3.7.

PHPBB3-11610
 2013-09-14 13:51:24 +02:00
Marc Alexander
31d2a8ef05 [feature/passwords] Add salted md5 (phpBB3 default) and phpass drivers 
The phpass driver extends the standard salted md5 driver of phpBB3. It will
only support the $P$ prefix that phpass uses.

PHPBB3-11610
 2013-09-14 13:51:16 +02:00
Marc Alexander
4b6646d1be [feature/passwords] Add crypto driver base class and interface 
PHPBB3-11610
 2013-09-14 13:51:10 +02:00
Marc Alexander
fbdbf41dc8 [feature/passwords] Add helper functions, i.e. for combined hashes 
Combined hashes can be used for i.e. converting already existing
password hashes to bcrypt. While this will not provide the same security
a pure bcrypt hash provides, it will still be significantly more secure
than a standard salted md5.
A combined hash will look as follows:
$H\2y${salted_for_H_prefix}${salt_+_settings_for_2y_prefix}${hash}
The prefixes are seperated by a backslash. Individual settings (which
can include either just the salt or a salt and possible additional settings)
are seperated by dollar signs. As backslashes and dollar signs are not
allowed in hashes or salts, they will be used for seperating the settings
from the salt.

Here is an example of a password hash:
$H\2a$9zv1uIaq1$10\1ff4640409fb96a449c1fO$/oN1O0cdUmFSMZT3UZKrgAyalhnt1LC

The 'H' prefix stands for the salted md5 implementation of phpBB 3.0.
Its settings will be parsed as 9zv1uIaq1 resulting in a hash for the check
as follows:
$H$9zv1uIaq1{hash}
Since the password is used for hashing, the {hash} can be left blank and
will basically be filled by the hashing algorithm. The {hash} will then be
used as password for the next hashing algorithm. In this case that would be
the bcrypt algorithm. The settings are set to 10\1ff4640409fb96a449c1fO which
will be transformed to 10$1ff4640409fb96a449c1fO resulting in a hash like
this for the bcrypt hashing function:
$2a$10$1ff4640409fb96a449c1fO{hash}
The {hash} will again be basically filled by the hashing algorithm.
Afterwards, the {hash} will be extracted from the returned hash and put at
the end of the already known hash settings:
$H\2a$9zv1uIaq1$10\1ff4640409fb96a449c1fO$

If the password is correct, the combined hash will of course be the same
as the stored one.

PHPBB3-11610
 2013-09-14 13:50:56 +02:00
Marc Alexander
d66cae7cbc [feature/passwords] Add service collection file crypto.yml 
This will contain definitions of the services and the service collection
that will be passed to the passwords manager.

PHPBB3-11610
 2013-09-14 13:50:42 +02:00
Marc Alexander
3a0dd248d0 [feature/passwords] Add basic implementation of passwords manager 
The passwords manager is capable of checking and hashing passwords.
It will support different hashing algorithms.

PHPBB3-11610
 2013-09-14 13:50:07 +02:00
Vjacheslav Trushkin
d27bc857f3 [ticket/11795] Remove PM popup 
PHPBB3-11795
 2013-09-14 10:10:45 +03:00
Vjacheslav Trushkin
973f4bc887 [ticket/11795] Remove outdated comment from forum_fn.js 
This comment is no longer relevant because function was rewritten

PHPBB3-11795
 2013-09-14 10:10:44 +03:00
Vjacheslav Trushkin
e6d87c5bc0 [ticket/11795] Move find user JS to forum_fn 
Move JavaScript from user search results to forum_fn.js

PHPBB3-11795
 2013-09-14 10:10:44 +03:00
Vjacheslav Trushkin
0a9ba5415c [ticket/11795] Replace TWIG with phpBB syntax in ACP 
PHPBB3-11795
 2013-09-14 10:10:44 +03:00
Vjacheslav Trushkin
4b27ec441a [ticket/11795] Move MSN scripts to forum_fn.js 
Move MSN scripts to forum_fn.js
Rewrite MSN scripts to remove duplicate code

PHPBB3-11795
 2013-09-14 10:10:44 +03:00
Vjacheslav Trushkin
e4874c180a [ticket/11795] Use phpBB template syntax instead of TWIG 
PHPBB3-11795
 2013-09-14 10:10:44 +03:00
Vjacheslav Trushkin
22c8df5403 [ticket/11795] Move PM popup JS to forum_fn.js 
Move PM popup JavaScript from overall_header to forum_fn.js
Use TWIG to escape PM popup URL

PHPBB3-11795
 2013-09-14 10:10:43 +03:00
Vjacheslav Trushkin
4c2aad4ca9 [ticket/11795] Get rid of pagination JS variables 
Move pagination variables to data attributes
Replace A_BASE_URL with BASE_URL and use TWIG to escape it

PHPBB3-11795
 2013-09-14 10:10:43 +03:00
Vjacheslav Trushkin
253890520d [ticket/11795] Get rid of onload_functions 
Get rid of onload_functions and onunload_functions
Scripts should use $(document).ready() instead

PHPBB-11795
 2013-09-14 10:10:42 +03:00
Vjacheslav Trushkin
a92a3cfeb9 [ticket/11795] Use data-reset-on-edit attr to reset elements 
Use data-reset-on-edit attribute to reset other inputs
when editing input with data.

Do not unbind event (old code unbound it after one use for
no reason)

PHPBB3-11795
 2013-09-14 10:10:42 +03:00
Vjacheslav Trushkin
605cd0cafb [ticket/11795] Redo form elements auto-focus 
Use data-focus attribute for forms to focus elements
when document is loaded instead of adding JavaScript

PHPBB3-11795
 2013-09-14 10:10:42 +03:00
Nathan Guse
235e3f5595 Merge pull request #1710 from Hardolaf/ticket/11837 
[ticket/11837] Translate UCP_AUTH_LINK_NOT_SUPPORTED
 2013-09-13 15:18:38 -07:00
Nathan Guse
5909d05397 Merge branch 'develop-olympus' into develop 
* develop-olympus:
 2013-09-13 17:17:16 -05:00
Nathan Guse
38f315ed81 Merge remote-tracking branch 'remotes/cyberalien/ticket/develop-2/11811' into develop 
* remotes/cyberalien/ticket/develop-2/11811:
  [ticket/11811] Remove outline on :focus
 2013-09-13 17:16:58 -05:00
Nathan Guse
a5c532979d Merge remote-tracking branch 'remotes/cyberalien/ticket/11811' into develop-olympus 
* remotes/cyberalien/ticket/11811:
  [ticket/11811] Remove outline on :focus
 2013-09-13 17:16:20 -05:00
Vjacheslav Trushkin
f3bbca4fa0 Merge branch 'ticket/11811' into ticket/develop-2/11811 
* ticket/11811:
  [ticket/11811] Remove outline on :focus

Conflicts:
	phpBB/adm/style/admin.css
	phpBB/styles/prosilver/theme/forms.css
 2013-09-14 00:19:48 +03:00
Nathan Guse
b8bb16f8e7 Merge remote-tracking branch 'remotes/upstream/develop-olympus' into develop 
* remotes/upstream/develop-olympus:
  [ticket/11831] getAttribute was replaced with attr
  [ticket/11831] Update fabpot/goutte to 1.0.*

Conflicts:
	phpBB/composer.lock
 2013-09-13 15:56:28 -05:00
Nathan Guse
3918b228f7 Merge pull request #1713 from Hardolaf/ticket/11836 
[ticket/11836] Fix subsilver version of the error
 2013-09-13 13:41:10 -07:00
Vjacheslav Trushkin
3cd445d055 [ticket/11811] Remove outline on :focus 
PHPBB3-11811
 2013-09-13 23:41:07 +03:00
Joseph Warner
c8bd2288d1 [ticket/11836] Fix subsilver fatal error 
PHPBB3-11836
 2013-09-13 16:34:52 -04:00
Joseph Warner
3c6c1ec5f2 [ticket/11837] Replace escaped single quote with utf-8 single quote 
PHPBB3-11837
 2013-09-13 16:26:30 -04:00
Nathan Guse
033ae7edeb Merge pull request #1711 from Hardolaf/ticket/11836 
[ticket/11836] Fix fatal error on unsupported provider for auth link
 2013-09-13 12:39:39 -07:00
Nathan Guse
b4a374dc73 [ticket/11832] Fix INCLUDE(JS/CSS) 
PHPBB3-11832
 2013-09-13 10:58:03 -05:00
Joseph Warner
0737c4bd6d [ticket/11836] Fix fatal error on unsupported provider for auth link 
PHPBB3-11836
 2013-09-13 11:53:10 -04:00
Joseph Warner
b7ab068bbc [ticket/11837] Translate UCP_AUTH_LINK_NOT_SUPPORTED 
PHPBB3-11837
 2013-09-13 11:48:31 -04:00
Nathan Guse
e31082b82c Merge pull request #1675 from marc1706/ticket/11809 
[ticket/11809] Ensure code.js is first script included after jQuery
 2013-09-13 08:12:23 -07:00