friendica
/
friendica-addons
mirror of https://git.friendi.ca/friendica/friendica-addons.git
1
0
Fork 0
Code Issues Releases Wiki Activity

Use User::authenticate in addons 

- dav
- jappixmini
- windowsphonepush
pull/460/head
Hypolite Petovan 2017-12-01 23:03:49 -05:00
parent 46e09b0544
commit eadf7066e0
3 changed files with 9 additions and 27 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
dav/friendica/dav_friendica_auth.inc.php
View File

@ -80,13 +80,8 @@ class Sabre_DAV_Auth_Backend_Std extends Sabre_DAV_Auth_Backend_AbstractBasic
* @param string $password
* @return bool
*/
protected function validateUserPass($username, $password) {
$encrypted = hash('whirlpool',trim($password));
$r = q("SELECT COUNT(*) anz FROM `user` WHERE `nickname` = '%s' AND `password` = '%s' AND `blocked` = 0 AND `account_expired` = 0 AND `verified` = 1 LIMIT 1",
dbesc(trim($username)),
dbesc($encrypted)
);
return ($r[0]["anz"] == 1);
protected function validateUserPass($username, $password)
{
return User::authenticate($username, $password);
}
}

6
jappixmini/jappixmini.php
View File

@ -429,11 +429,7 @@ function jappixmini_settings_post(App $a, &$b)
if ($encrypt) {
// check that Jabber password was encrypted with correct Friendica password
$friendica_password = trim($b['jappixmini-friendica-password']);
$encrypted = hash('whirlpool',$friendica_password);
$r = q("SELECT * FROM `user` WHERE `uid`=$uid AND `password`='%s'",
dbesc($encrypted)
);
if (!count($r)) {
if (!User::authenticate((int) $uid, $friendica_password)) {
info("Wrong friendica password!");
return;
}

15
windowsphonepush/windowsphonepush.php
View File

@ -455,19 +455,10 @@ function windowsphonepush_login(App $a)
die('This api requires login');
}
$user = $_SERVER['PHP_AUTH_USER'];
$encrypted = hash('whirlpool',trim($_SERVER['PHP_AUTH_PW']));
$user_id = User::authenticate($_SERVER['PHP_AUTH_USER'], trim($_SERVER['PHP_AUTH_PW']));
// check if user specified by app is available in the user table
$r = q("SELECT * FROM `user` WHERE ( `email` = '%s' OR `nickname` = '%s' )
AND `password` = '%s' AND `blocked` = 0 AND `account_expired` = 0 AND `account_removed` = 0 AND `verified` = 1 LIMIT 1",
dbesc(trim($user)),
dbesc(trim($user)),
dbesc($encrypted)
);
if(count($r)){
$record = $r[0];
if ($user_id) {
$record = dba::select('user', [], ['uid' => $user_id], ['limit' => 1]);
} else {
logger('API_login failure: ' . print_r($_SERVER, true), LOGGER_DEBUG);
header('WWW-Authenticate: Basic realm="Friendica"');