0015673_v2_44.patch

Administrator Admin, 2010-09-09 14:39

Download (4.07 KB)

View differences:

t3lib/class.t3lib_userauth.php (Arbeitskopie)
157 157

  
158 158
		// Internals
159 159
	var $id;							// Internal: Will contain session_id (MD5-hash)
160
	protected $idHash;					// Internal: MD5 hash of the session id, used in combination with veriCode (vC)
160 161
	var $cookieId;						// Internal: Will contain the session_id gotten from cookie or GET method. This is used in statistics as a reliable cookie (one which is known to come from $_COOKIE).
161 162
	var $loginFailure = FALSE;			// Indicates if an authentication was started but failed
162 163
	var $loginSessionStarted = FALSE;	// Will be set to true if the login session is actually written during auth-check.
......
774 775
		$dbres = $this->fetchUserSessionFromDB();
775 776

  
776 777
		if ($dbres && $user = $GLOBALS['TYPO3_DB']->sql_fetch_assoc($dbres)) {
778
			if (!$this->id) {
779
				$this->id = $user['ses_id'];
780
			}
781

  
777 782
				// A user was found
778 783
			if (is_string($this->auth_timeout_field))	{
779 784
				$timeout = intval($user[$this->auth_timeout_field]);		// Get timeout-time from usertable
......
893 898
				$dbres = $GLOBALS['TYPO3_DB']->exec_SELECTquery(
894 899
						'*',
895 900
						$this->session_table.','.$this->user_table,
896
						$this->session_table.'.ses_id = '.$GLOBALS['TYPO3_DB']->fullQuoteStr($this->id, $this->session_table).'
901
						'MD5(' . $this->session_table.'.ses_id) = '.$GLOBALS['TYPO3_DB']->fullQuoteStr($this->getIdHash(), $this->session_table).'
897 902
							AND '.$this->session_table.'.ses_name = '.$GLOBALS['TYPO3_DB']->fullQuoteStr($this->name, $this->session_table).'
898 903
							AND '.$this->session_table.'.ses_userid = '.$this->user_table.'.'.$this->userid_column.'
899 904
							'.$this->ipLockClause().'
......
978 983
	 * @return	string
979 984
	 */
980 985
	public function veriCode() {
981
		return substr(md5($this->id . $GLOBALS['TYPO3_CONF_VARS']['SYS']['encryptionKey']), 0, 10);
986
		return substr(md5($this->getIdHash() . $GLOBALS['TYPO3_CONF_VARS']['SYS']['encryptionKey']), 0, 10);
982 987
	}
983 988

  
984 989
	/**
990
	 * Gets the current idHash.
991
	 *
992
	 * @return string
993
	 */
994
	public function getIdHash() {
995
		if (!isset($this->idHash)) {
996
			$idHash = t3lib_div::_GP('idHash');
997
			$this->idHash = ($idHash ? $idHash : md5($this->id));
998
		}
999

  
1000
		return $this->idHash;
1001
	}
1002

  
1003
	/**
985 1004
	 * This returns the where-clause needed to lock a user to a hash integer
986 1005
	 *
987 1006
	 * @return	string
typo3/js/flashupload.js (Arbeitskopie)
280 280
			swfConfig.post_params            = Ext.value(this.uploadPostParams, this.swfDefaultConfig.post_params);
281 281
			// add the veriCode from the backend.php to verify the session with the flash client
282 282
			swfConfig.post_params.vC         = top.TS.veriCode;
283
			swfConfig.post_params.idHash     = top.TS.idHash;
283 284
			swfConfig.file_types_description = Ext.value(this.uploadFileTypesDescription, this.swfDefaultConfig.file_types_description);
284 285
			this.setFileTypeRestrictions(this.uploadFileTypes);
285 286
			return swfConfig;
typo3/backend.php (Arbeitskopie)
386 386
			'inWorkspace' => $GLOBALS['BE_USER']->workspace !== 0 ? 1 : 0,
387 387
			'workspaceFrontendPreviewEnabled' => $GLOBALS['BE_USER']->user['workspace_preview'] ? 1 : 0,
388 388
			'veriCode' => $GLOBALS['BE_USER']->veriCode(),
389
			'idHash' => $GLOBALS['BE_USER']->getIdHash(),
389 390
			'denyFileTypes' => PHP_EXTENSIONS_DEFAULT,
390 391
			'moduleMenuWidth' => $this->menuWidth - 1,
391 392
			'topBarHeight' => (isset($GLOBALS['TBE_STYLES']['dims']['topFrameH']) ? intval($GLOBALS['TBE_STYLES']['dims']['topFrameH']) : 30),
......
477 478
		this.navFrameWidth = 0;
478 479
		this.securityLevel = TYPO3.configuration.securityLevel;
479 480
		this.veriCode = TYPO3.configuration.veriCode;
481
		this.idHash = TYPO3.configuration.idHash;
480 482
		this.denyFileTypes = TYPO3.configuration.denyFileTypes;
481 483
	}
482 484
	var TS = new typoSetup();