Skip to content

Commit fe79382

Browse files
SpudsSpuds
authored
Merge pull request #3780 from Spuds/Fixes
Fixes
2 parents e9f366e + a8a14f7 commit fe79382

26 files changed

+77
-56
lines changed

‎bootstrap.php

+2-1
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@
2323
use ElkArte\Helper\TokenHash;
2424
use ElkArte\Hooks;
2525
use ElkArte\MembersList;
26+
use ElkArte\Request;
2627
use ElkArte\Server;
2728
use ElkArte\Themes\ThemeLoader;
2829
use ElkArte\User;
@@ -446,7 +447,7 @@ public function ssi_main()
446447
}
447448

448449
// We need to set up user agent, and make more checks on the request
449-
$req = request();
450+
$req = Request::instance();
450451

451452
// Make sure they didn't muss around with the settings... but only if it's not cli.
452453
if (isset($_SERVER['REMOTE_ADDR']) && session_id() === '')

‎sources/ElkArte/Controller/Auth.php

+13-7
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@
2424
use ElkArte\Helper\Util;
2525
use ElkArte\Http\Headers;
2626
use ElkArte\Languages\Txt;
27+
use ElkArte\Request;
2728
use ElkArte\User;
2829
use ElkArte\UserSettingsLoader;
2930

@@ -143,7 +144,7 @@ public function action_login2()
143144
}
144145

145146
// Are you guessing with a script?
146-
checkSession('post');
147+
checkSession();
147148
validateToken('login');
148149
spamProtection('login');
149150

@@ -234,7 +235,7 @@ public function action_login2()
234235
$member_found = loadExistingMember($_POST['user']);
235236
$db = database();
236237
$cache = Cache::instance();
237-
$req = request();
238+
$req = Request::instance();
238239

239240
$user = new UserSettingsLoader($db, $cache, $req);
240241
$user->loadUserById($member_found === false ? 0 : $member_found['id_member'], true, '');
@@ -377,10 +378,15 @@ private function _other_passwords($posted_password, $member_name, $passwrd, $pas
377378
$pw_strlen = strlen($passwrd);
378379

379380
// Start off with none, that's safe
380-
$other_passwords = array();
381+
$other_passwords = [];
382+
383+
if (empty($modSettings['enable_password_conversion']))
384+
{
385+
return $other_passwords;
386+
}
381387

382388
// None of the below cases will be used most of the time (because the salt is normally set.)
383-
if (!empty($modSettings['enable_password_conversion']) && $password_salt === '')
389+
if ($password_salt === '')
384390
{
385391
// YaBB SE, Discus, MD5 (used a lot), SHA-1 (used some), SMF 1.0.x, IkonBoard, and none at all.
386392
$other_passwords[] = crypt($posted_password, substr($posted_password, 0, 2));
@@ -415,7 +421,7 @@ private function _other_passwords($posted_password, $member_name, $passwrd, $pas
415421
$other_passwords[] = crypt($posted_password, $passwrd);
416422
}
417423
// The hash should be 40 if it's SHA-1, so we're safe with more here too.
418-
elseif (!empty($modSettings['enable_password_conversion']) && $pw_strlen === 32)
424+
elseif ($pw_strlen === 32)
419425
{
420426
// vBulletin 3 style hashing? Let's welcome them with open arms \o/.
421427
$other_passwords[] = md5(md5($posted_password) . stripslashes($password_salt));
@@ -460,7 +466,7 @@ private function _other_passwords($posted_password, $member_name, $passwrd, $pas
460466
}
461467
}
462468
// SHA-256 will be 64 characters long, lets check some of these possibilities
463-
elseif (!empty($modSettings['enable_password_conversion']) && $pw_strlen === 64)
469+
elseif ($pw_strlen === 64)
464470
{
465471
// PHP-Fusion7
466472
$other_passwords[] = hash_hmac('sha256', $posted_password, $password_salt);
@@ -782,7 +788,7 @@ function doLogin(UserSettingsLoader $user)
782788
}
783789

784790
// You're one of us: need to know all about you now, IP, stuff.
785-
$req = request();
791+
$req = Request::instance();
786792

787793
// You've logged in, haven't you?
788794
require_once(SUBSDIR . '/Members.subs.php');

‎sources/ElkArte/Controller/PersonalMessage.php

+6-6
Original file line numberDiff line numberDiff line change
@@ -1181,13 +1181,13 @@ public function action_send2()
11811181
$bbc_parser = ParserWrapper::instance();
11821182

11831183
// Construct the list of recipients.
1184-
$recipientList = array();
1185-
$namedRecipientList = array();
1186-
$namesNotFound = array();
1187-
foreach (array('to', 'bcc') as $recipientType)
1184+
$recipientList = [];
1185+
$namedRecipientList = [];
1186+
$namesNotFound = [];
1187+
foreach (['to', 'bcc'] as $recipientType)
11881188
{
11891189
// First, let's see if there's user ID's given.
1190-
$recipientList[$recipientType] = array();
1190+
$recipientList[$recipientType] = [];
11911191
$type = 'recipient_' . $recipientType;
11921192
if (!empty($this->_req->post->{$type}) && is_array($this->_req->post->{$type}))
11931193
{
@@ -1216,7 +1216,7 @@ public function action_send2()
12161216
}
12171217
}
12181218

1219-
// Now see if we can resolve the entered name to an actual user
1219+
// Now see if we can resolve any entered name (not suggest selected) to an actual user
12201220
if (!empty($namedRecipientList[$recipientType]))
12211221
{
12221222
$foundMembers = findMembers($namedRecipientList[$recipientType]);

‎sources/ElkArte/Controller/Register.php

+2-1
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,7 @@
3030
use ElkArte\Languages\Txt;
3131
use ElkArte\PrivacyPolicy;
3232
use ElkArte\Profile\ProfileOptions;
33+
use ElkArte\Request;
3334

3435
/**
3536
* It registers new members, and it allows the administrator moderate member registration
@@ -523,7 +524,7 @@ public function do_register()
523524
}
524525

525526
// Registration needs to know your IP
526-
$req = request();
527+
$req = Request::instance();
527528

528529
$regOptions['ip'] = $this->user->ip;
529530
$regOptions['ip2'] = $req->ban_ip();

‎sources/ElkArte/Errors/Errors.php

+1-2
Original file line numberDiff line numberDiff line change
@@ -180,7 +180,7 @@ public function log_error($error_message, $error_type = 'general', $file = '', $
180180
$query_string = $this->parseQueryString();
181181

182182
// Make sure the category that was specified is a valid one
183-
$error_type = in_array($error_type, $this->getErrorTypes()) && $error_type !== true ? $error_type : 'general';
183+
$error_type = in_array($error_type, $this->getErrorTypes(), true) && $error_type !== true ? $error_type : 'general';
184184

185185
// Insert the error into the database.
186186
$this->insertLog($query_string, $error_message, $error_type, $file, $line);
@@ -254,7 +254,6 @@ protected function getErrorTypes()
254254
* @param string|bool $error_type
255255
* @param string $file
256256
* @param int $line
257-
* @throws \Exception
258257
*/
259258
private function insertLog($query_string, $error_message, $error_type, $file, $line)
260259
{

‎sources/ElkArte/Languages/Login/English.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@
2121
$txt['need_username'] = 'You need to fill in a username.';
2222
$txt['no_password'] = 'You didn\'t enter your password.';
2323
$txt['improper_password'] = 'The supplied password is too long.';
24-
$txt['incorrect_password'] = 'Password incorrect';
24+
$txt['incorrect_password'] = 'Incorrect Username or Password';
2525
$txt['maintain_mode'] = 'Maintenance Mode';
2626
$txt['registration_successful'] = 'Registration Successful';
2727
$txt['valid_email_needed'] = 'Please enter a valid email address, %1$s.';

‎sources/ElkArte/Mail/Mail.php

+4-4
Original file line numberDiff line numberDiff line change
@@ -101,8 +101,8 @@ public function sendPHP($mail_to_array, $subject, $message, $headers, $message_i
101101
// Keep our post via email log
102102
if ($this->mailList)
103103
{
104-
$this->unqPBEHead[] = time();
105-
$this->unqPBEHead[] = $sendTo;
104+
$this->unqPBEHead[3] = time();
105+
$this->unqPBEHead[4] = $sendTo;
106106
$sent[] = $this->unqPBEHead;
107107
}
108108

@@ -240,8 +240,8 @@ public function SMTP($mail_to_array, $subject, $message, $headers, $message_id =
240240
// Keep our post via email log
241241
if ($this->mailList)
242242
{
243-
$this->unqPBEHead[] = time();
244-
$this->unqPBEHead[] = $mail_to;
243+
$this->unqPBEHead[3] = time();
244+
$this->unqPBEHead[4] = $mail_to;
245245
$sent[] = $this->unqPBEHead;
246246
}
247247

‎sources/ElkArte/Request.php

+4-4
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@
2727
final class Request
2828
{
2929
/** @var Request Sole private Request instance */
30-
private static $_req;
30+
private static $_instance;
3131

3232
/** @var string Remote IP, if we can know it easily (as found in $_SERVER['REMOTE_ADDR']) */
3333
private $_client_ip;
@@ -210,12 +210,12 @@ private function _getBanIP()
210210
*/
211211
public static function instance()
212212
{
213-
if (self::$_req === null)
213+
if (self::$_instance === null)
214214
{
215-
self::$_req = new Request();
215+
self::$_instance = new Request();
216216
}
217217

218-
return self::$_req;
218+
return self::$_instance;
219219
}
220220

221221
/**

‎sources/ElkArte/SiteDispatcher.php

+1
Original file line numberDiff line numberDiff line change
@@ -239,6 +239,7 @@ protected function determineAction()
239239

240240
// The file and function weren't found yet? Then set a default!
241241
$this->setDefaultActionAndControllerIfEmpty();
242+
242243
$this->handleApiCall();
243244

244245
// Ensure both the controller and action exist and are callable

‎sources/ElkArte/Themes/ThemeLoader.php

+2-1
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@
2121
use ElkArte\Helper\ValuesContainer;
2222
use ElkArte\Hooks;
2323
use ElkArte\Languages\Txt;
24+
use ElkArte\Request;
2425
use ElkArte\User;
2526
use ElkArte\UserInfo;
2627

@@ -608,7 +609,7 @@ private function setupContext()
608609
]);
609610

610611
// Just some mobile-friendly settings
611-
if (strpos(request()->user_agent(), 'Mobi'))
612+
if (strpos(Request::instance()->user_agent(), 'Mobi'))
612613
{
613614
// Disable the search dropdown.
614615
$modSettings['search_dropdown'] = false;

‎sources/ElkArte/User.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,7 @@ public static function load($compat_mode = false)
5050
{
5151
$db = database();
5252
$cache = Cache::instance();
53-
$req = request();
53+
$req = Request::instance();
5454

5555
self::$instance = new UserSettingsLoader($db, $cache, $req);
5656
$already_verified = self::loadFromIntegration();

‎sources/Logging.php

+2-1
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@
1717
use ElkArte\Cache\Cache;
1818
use ElkArte\Helper\FileFunctions;
1919
use ElkArte\Helper\Util;
20+
use ElkArte\Request;
2021
use ElkArte\User;
2122

2223
/**
@@ -124,7 +125,7 @@ function writeLog($force = false)
124125
if (ELK !== 'SSI' && !empty(User::$info->last_login) && User::$info->last_login < time() - 60)
125126
{
126127
// We log IPs the request came with, around here
127-
$req = request();
128+
$req = Request::instance();
128129

129130
// Don't count longer than 15 minutes.
130131
if (time() - $_SESSION['timeOnlineUpdated'] > 60 * 15)

‎sources/Security.php

+7-5
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@
2323
use ElkArte\Helper\Util;
2424
use ElkArte\Http\Headers;
2525
use ElkArte\Languages\Txt;
26+
use ElkArte\Request;
2627
use ElkArte\User;
2728

2829
/**
@@ -765,7 +766,7 @@ function checkSession($type = 'post', $from_action = '', $is_fatal = true)
765766
global $modSettings, $boardurl;
766767

767768
// We'll work out user agent checks
768-
$req = request();
769+
$req = Request::instance();
769770

770771
// Is it in as $_POST['sc']?
771772
if ($type === 'post')
@@ -927,7 +928,7 @@ function createToken($action, $type = 'post')
927928
$token = $tokenizer->generate_hash(32);
928929

929930
// We need user agent and the client IP
930-
$req = request();
931+
$req = Request::instance();
931932
$csrf_hash = hash('sha1', $token . $req->client_ip() . $req->user_agent());
932933

933934
// Save the session token and make it available to the forms
@@ -983,7 +984,7 @@ function validateToken($action, $type = 'post', $reset = true, $fatal = true)
983984
}
984985

985986
// We need the user agent and client IP
986-
$req = request();
987+
$req = Request::instance();
987988

988989
// Shortcut
989990
$passed_token_var = $GLOBALS['_' . strtoupper($type)][$_SESSION['token'][$token_index][0]] ?? null;
@@ -1943,7 +1944,7 @@ function validLoginUrl($url, $match_board = false)
19431944
return false;
19441945
}
19451946

1946-
if (substr($url, 0, 7) !== 'http://' && substr($url, 0, 8) !== 'https://')
1947+
if (strpos($url, 'http://') !== 0 && strpos($url, 'https://') !== 0)
19471948
{
19481949
return false;
19491950
}
@@ -1953,7 +1954,8 @@ function validLoginUrl($url, $match_board = false)
19531954

19541955
foreach ($invalid_strings as $invalid_string => $valid_match)
19551956
{
1956-
if (strpos($url, $invalid_string) !== false || ($match_board === true && !empty($valid_match) && preg_match($valid_match, $url) == 0))
1957+
if (strpos($url, $invalid_string) !== false
1958+
|| ($match_board === true && !empty($valid_match) && preg_match($valid_match, $url) !== 1))
19571959
{
19581960
return false;
19591961
}

‎sources/Subs.php

+4-3
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@
2525
use ElkArte\Http\Headers;
2626
use ElkArte\Languages\Loader;
2727
use ElkArte\Notifications\Notifications;
28+
use ElkArte\Request;
2829
use ElkArte\Search\Search;
2930
use ElkArte\UrlGenerator\UrlGenerator;
3031
use ElkArte\User;
@@ -684,7 +685,7 @@ function obExit($header = null, $do_footer = null, $from_index = false, $from_fa
684685
}
685686

686687
// Need user agent
687-
$req = request();
688+
$req = Request::instance();
688689

689690
setOldUrl();
690691

@@ -705,7 +706,7 @@ function obExit($header = null, $do_footer = null, $from_index = false, $from_fa
705706
}
706707

707708
/**
708-
* Takes care of a few dynamic maintenance items Maintenance
709+
* Takes care of a few dynamic maintenance items
709710
*/
710711
function handleMaintenance()
711712
{
@@ -1617,7 +1618,7 @@ function createList($listOptions)
16171618
*/
16181619
function request()
16191620
{
1620-
return ElkArte\Request::instance();
1621+
return Request::instance();
16211622
}
16221623

16231624
/**

‎sources/subs/Admin.subs.php

+2-1
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@
1818

1919
use ElkArte\Cache\Cache;
2020
use ElkArte\Languages\Txt;
21+
use ElkArte\Request;
2122
use ElkArte\User;
2223

2324
/**
@@ -99,7 +100,7 @@ function getServerVersions($checkFor)
99100
// Server info
100101
if (in_array('server', $checkFor))
101102
{
102-
$req = request();
103+
$req = Request::instance();
103104
$versions['server_header'] = ['header' => $txt['admin_server_settings']];
104105
$versions['server'] = ['title' => $txt['support_versions_server'], 'version' => $req->server_software()];
105106

‎sources/subs/Auth.subs.php

+6-1
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@
1818
use ElkArte\Helper\TokenHash;
1919
use ElkArte\Helper\Util;
2020
use ElkArte\Languages\Txt;
21+
use ElkArte\Request;
2122
use ElkArte\User;
2223

2324
/**
@@ -124,6 +125,10 @@ function setLoginCookie($cookie_length, $id, $password = '')
124125

125126
// Get a new session id, and load it with the data
126127
session_regenerate_id();
128+
129+
// If we generated new session values, be sure to use them as well
130+
$oldSessionData['session_value'] = $_SESSION['session_value'] ?? $oldSessionData['session_value'];
131+
$oldSessionData['session_var'] = $_SESSION['session_var'] ?? $oldSessionData['session_var'];
127132
$_SESSION = $oldSessionData;
128133

129134
$_SESSION['login_' . $cookiename] = $data;
@@ -212,7 +217,7 @@ function adminLogin($type = 'admin')
212217
if (isset($_POST[$type . '_hash_pass']) || isset($_POST[$type . '_pass']))
213218
{
214219
// log some info along with it! referer, user agent
215-
$req = request();
220+
$req = Request::instance();
216221
$txt['security_wrong'] = sprintf($txt['security_wrong'], $_SERVER['HTTP_REFERER'] ?? $txt['unknown'], $req->user_agent(), User::$info->ip);
217222
\ElkArte\Errors\Errors::instance()->log_error($txt['security_wrong'], 'critical');
218223

0 commit comments

Comments
 (0)