tonyair/silverstripe-framework
1
0
Fork 0
mirror of https://github.com/silverstripe/silverstripe-framework synced 2024-10-01 13:48:37 +02:00
Code Issues Projects Releases Wiki Activity

BUGFIX Using RandomGenerator class in Member->logIn(), Member->autoLogin() and Member->generateAutologinHash() for better randomization of tokens. Increased VARCHAR length of 'RememberLoginToken' and 'AutoLoginHash' fields to 1024 characters to support longer token strings. (from r114504)

Browse Source 
git-svn-id: svn://svn.silverstripe.com/silverstripe/open/modules/sapphire/branches/2.4@114507 467b73ca-7a2a-4603-9d3b-597d59a354a9
This commit is contained in:
Ingo Schommer 2010-12-05 00:47:12 +00:00 committed by Sam Minnee
parent ae1d8e2e18
commit 310f8f6a03
1 changed files with 9 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
security/Member.php
View File

@ -11,11 +11,11 @@ class Member extends DataObject {
'Surname' => 'Varchar', 'Surname' => 'Varchar',
'Email' => 'Varchar', 'Email' => 'Varchar',
'Password' => 'Varchar(160)', 'Password' => 'Varchar(160)',
'RememberLoginToken' => 'Varchar(50)', 'RememberLoginToken' => 'Varchar(1024)',
'NumVisit' => 'Int', 'NumVisit' => 'Int',
'LastVisited' => 'SS_Datetime', 'LastVisited' => 'SS_Datetime',
'Bounced' => 'Boolean', // Note: This does not seem to be used anywhere. 'Bounced' => 'Boolean', // Note: This does not seem to be used anywhere.
'AutoLoginHash' => 'Varchar(30)', 'AutoLoginHash' => 'Varchar(1024)',
'AutoLoginExpired' => 'SS_Datetime', 'AutoLoginExpired' => 'SS_Datetime',
// This is an arbitrary code pointing to a PasswordEncryptor instance, // This is an arbitrary code pointing to a PasswordEncryptor instance,
// not an actual encryption algorithm. // not an actual encryption algorithm.
@ -327,7 +327,8 @@ class Member extends DataObject {
$this->NumVisit++; $this->NumVisit++;
if($remember) { if($remember) {
$token = substr(md5(uniqid(rand(), true)), 0, 49 - strlen($this->ID)); $generator = new RandomGenerator();
$token = $generator->generateHash('sha1');
$this->RememberLoginToken = $token; $this->RememberLoginToken = $token;
Cookie::set('alc_enc', $this->ID . ':' . $token, 90, null, null, null, true); Cookie::set('alc_enc', $this->ID . ':' . $token, 90, null, null, null, true);
} else { } else {
@ -395,9 +396,9 @@ class Member extends DataObject {
Session::set("loggedInAs", $member->ID); Session::set("loggedInAs", $member->ID);
// This lets apache rules detect whether the user has logged in // This lets apache rules detect whether the user has logged in
if(self::$login_marker_cookie) Cookie::set(self::$login_marker_cookie, 1, 0, null, null, false, true); if(self::$login_marker_cookie) Cookie::set(self::$login_marker_cookie, 1, 0, null, null, false, true);
$token = substr(md5(uniqid(rand(), true)), 0, 49 - strlen($member->ID)); $generator = new RandomGenerator();
$member->RememberLoginToken = $token; $member->RememberLoginToken = $generator->generateHash('sha1');
Cookie::set('alc_enc', $member->ID . ':' . $token, 90, null, null, false, true); Cookie::set('alc_enc', $member->ID . ':' . $token, 90, null, null, false, true);
$member->NumVisit++; $member->NumVisit++;
@ -442,8 +443,8 @@ class Member extends DataObject {
function generateAutologinHash($lifetime = 2) { function generateAutologinHash($lifetime = 2) {
do { do {
$hash = substr(base_convert(md5(uniqid(mt_rand(), true)), 16, 36), $generator = new RandomGenerator();
0, 30); $hash = $generator->generateHash('sha1');
} while(DataObject::get_one('Member', "\"AutoLoginHash\" = '$hash'")); } while(DataObject::get_one('Member', "\"AutoLoginHash\" = '$hash'"));
$this->AutoLoginHash = $hash; $this->AutoLoginHash = $hash;