diff --git a/security/Member.php b/security/Member.php index 9997a243e..028d38b38 100644 --- a/security/Member.php +++ b/security/Member.php @@ -96,7 +96,6 @@ class Member extends DataObject { $this->NumVisit++; if($remember) { - $token = substr(md5(uniqid(rand(), true)), 0, 49 - strlen($this->ID)); $this->RememberLoginToken = $token; Cookie::set('alc_enc', $this->ID . ':' . $token); @@ -118,21 +117,20 @@ class Member extends DataObject { */ static function autoLogin() { if(strpos(Cookie::get('alc_enc'), ':') && !Session::get("loggedInAs")) { - list($uid, $token) = explode(':', Cookie::get('alc_enc'), 2); $SQL_uid = Convert::raw2sql($uid); - $member = DataObject::get_one( - "Member", "Member.ID = '$SQL_uid'"); + $member = DataObject::get_one("Member", "Member.ID = '$SQL_uid'"); - if($member && $member->RememberLoginToken != $token) $member = null; + if($member && $member->RememberLoginToken != $token) { + $member = null; + } if($member) { session_regenerate_id(true); Session::set("loggedInAs", $member->ID); - $token = substr(md5(uniqid(rand(), true)), - 0, 49 - strlen($member->ID)); + $token = substr(md5(uniqid(rand(), true)), 0, 49 - strlen($member->ID)); $member->RememberLoginToken = $token; Cookie::set('alc_enc', $member->ID . ':' . $token); diff --git a/security/Security.php b/security/Security.php index 4f6da5942..9f5117ae6 100644 --- a/security/Security.php +++ b/security/Security.php @@ -6,12 +6,18 @@ class Security extends Controller { /** - * @var $default_username String Only used in dev-mode by setDefaultAdmin() + * Default user name. Only used in dev-mode by {@link setDefaultAdmin()} + * + * @var string + * @see setDefaultAdmin() */ protected static $default_username; /** - * @var $default_password String Only used in dev-mode by setDefaultAdmin() + * Default password. Only used in dev-mode by {@link setDefaultAdmin()} + * + * @var string + * @see setDefaultAdmin() */ protected static $default_password; @@ -420,6 +426,7 @@ class Security extends Controller { * * @return bool|Member Returns FALSE if authentication fails, otherwise * the member object + * @see setDefaultAdmin() */ public static function authenticate($RAW_email, $RAW_password) { $SQL_email = Convert::raw2sql($RAW_email); @@ -478,17 +485,21 @@ class Security extends Controller { /** + * Set a default admin in dev-mode + * * This will set a static default-admin (e.g. "td") which is not existing * as a database-record. By this workaround we can test pages in dev-mode * with a unified login. Submitted login-credentials are first checked * against this static information in {@authenticate()}. * - * @param $username String - * @param $password String (Cleartext) + * @param string $username The user name + * @param string $password The password in cleartext */ public static function setDefaultAdmin($username, $password) { // don't overwrite if already set - if(self::$default_username || self::$default_password) return false; + if(self::$default_username || self::$default_password) { + return false; + } self::$default_username = $username; self::$default_password = $password;