From f8fbe3793680af1dae2db2829cfc84068831c52f Mon Sep 17 00:00:00 2001 From: rxu Date: Wed, 28 Jun 2017 00:58:03 +0700 Subject: [ticket/14972] replace all occurrences of sizeof() with the count() PHPBB3-14972 --- phpBB/phpbb/auth/auth.php | 10 +++++----- phpBB/phpbb/auth/provider/ldap.php | 4 ++-- phpBB/phpbb/auth/provider/oauth/oauth.php | 2 +- 3 files changed, 8 insertions(+), 8 deletions(-) (limited to 'phpBB/phpbb/auth') diff --git a/phpBB/phpbb/auth/auth.php b/phpBB/phpbb/auth/auth.php index dbd83f1eb0..f46a21a8ae 100644 --- a/phpBB/phpbb/auth/auth.php +++ b/phpBB/phpbb/auth/auth.php @@ -72,8 +72,8 @@ class auth // Verify bitstring length with options provided... $renew = false; - $global_length = sizeof($this->acl_options['global']); - $local_length = sizeof($this->acl_options['local']); + $global_length = count($this->acl_options['global']); + $local_length = count($this->acl_options['local']); // Specify comparing length (bitstring is padded to 31 bits) $global_length = ($global_length % 31) ? ($global_length - ($global_length % 31) + 31) : $global_length; @@ -236,7 +236,7 @@ class auth $sql = 'SELECT forum_id FROM ' . FORUMS_TABLE; - if (sizeof($this->acl)) + if (count($this->acl)) { $sql .= ' WHERE ' . $db->sql_in_set('forum_id', array_keys($this->acl), true); } @@ -278,7 +278,7 @@ class auth } // If we get forum_ids not having this permission, we need to fill the remaining parts - if ($negate && sizeof($this->acl_forum_ids)) + if ($negate && count($this->acl_forum_ids)) { foreach ($this->acl_forum_ids as $f) { @@ -455,7 +455,7 @@ class auth { $hold_str = ''; - if (sizeof($hold_ary)) + if (count($hold_ary)) { ksort($hold_ary); diff --git a/phpBB/phpbb/auth/provider/ldap.php b/phpBB/phpbb/auth/provider/ldap.php index c48b771ab0..0789a6234d 100644 --- a/phpBB/phpbb/auth/provider/ldap.php +++ b/phpBB/phpbb/auth/provider/ldap.php @@ -99,7 +99,7 @@ class ldap extends \phpbb\auth\provider\base @ldap_close($ldap); - if (!is_array($result) || sizeof($result) < 2) + if (!is_array($result) || count($result) < 2) { return sprintf($this->user->lang['LDAP_NO_IDENTITY'], $this->user->data['username']); } @@ -192,7 +192,7 @@ class ldap extends \phpbb\auth\provider\base $ldap_result = @ldap_get_entries($ldap, $search); - if (is_array($ldap_result) && sizeof($ldap_result) > 1) + if (is_array($ldap_result) && count($ldap_result) > 1) { if (@ldap_bind($ldap, $ldap_result[0]['dn'], htmlspecialchars_decode($password))) { diff --git a/phpBB/phpbb/auth/provider/oauth/oauth.php b/phpBB/phpbb/auth/provider/oauth/oauth.php index fdc5f57df0..5587e69d3c 100644 --- a/phpBB/phpbb/auth/provider/oauth/oauth.php +++ b/phpBB/phpbb/auth/provider/oauth/oauth.php @@ -635,7 +635,7 @@ class oauth extends \phpbb\auth\provider\base $oauth_user_ids = array(); - if ($rows !== false && sizeof($rows)) + if ($rows !== false && count($rows)) { foreach ($rows as $row) { -- cgit v1.2.1 From 82adb1f4f54fa6d1ab299186956c046b20f7f195 Mon Sep 17 00:00:00 2001 From: Jakub Senko Date: Tue, 23 Jan 2018 11:08:46 +0100 Subject: [ticket/15398] Add core.oauth_login_after_check_if_provider_id_has_match PHPBB3-15398 --- phpBB/phpbb/auth/provider/oauth/oauth.php | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) (limited to 'phpBB/phpbb/auth') diff --git a/phpBB/phpbb/auth/provider/oauth/oauth.php b/phpBB/phpbb/auth/provider/oauth/oauth.php index 5587e69d3c..8809a0c6b4 100644 --- a/phpBB/phpbb/auth/provider/oauth/oauth.php +++ b/phpBB/phpbb/auth/provider/oauth/oauth.php @@ -227,6 +227,22 @@ class oauth extends \phpbb\auth\provider\base $row = $this->db->sql_fetchrow($result); $this->db->sql_freeresult($result); + /** + * Event is triggered before check if provider is already associated with an account + * + * @event core.oauth_login_after_check_if_provider_id_has_match + * @var array row User row + * @var array data Provider data + * @var \OAuth\Common\Service\ServiceInterface service OAuth service + * @since 3.2.3-RC1 + */ + $vars = array( + 'row', + 'data', + 'service', + ); + extract($this->dispatcher->trigger_event('core.oauth_login_after_check_if_provider_id_has_match', compact($vars))); + if (!$row) { // The user does not yet exist, ask to link or create profile -- cgit v1.2.1 From ca7d63d4d76c19125dbbfb53066b77c6149d6dad Mon Sep 17 00:00:00 2001 From: 3D-I Date: Mon, 25 Mar 2019 15:37:48 +0100 Subject: [ticket/16001] Append data to the OAuth's redirect URL PHPBB3-16001 --- phpBB/phpbb/auth/provider/oauth/oauth.php | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-) (limited to 'phpBB/phpbb/auth') diff --git a/phpBB/phpbb/auth/provider/oauth/oauth.php b/phpBB/phpbb/auth/provider/oauth/oauth.php index 8809a0c6b4..73cca3961a 100644 --- a/phpBB/phpbb/auth/provider/oauth/oauth.php +++ b/phpBB/phpbb/auth/provider/oauth/oauth.php @@ -221,24 +221,33 @@ class oauth extends \phpbb\auth\provider\base 'provider' => $service_name_original, 'oauth_provider_id' => $unique_id ); + $sql = 'SELECT user_id FROM ' . $this->auth_provider_oauth_token_account_assoc . ' WHERE ' . $this->db->sql_build_array('SELECT', $data); $result = $this->db->sql_query($sql); $row = $this->db->sql_fetchrow($result); $this->db->sql_freeresult($result); + $redirect_data = array( + 'auth_provider' => 'oauth', + 'login_link_oauth_service' => $service_name_original, + ); + /** * Event is triggered before check if provider is already associated with an account * * @event core.oauth_login_after_check_if_provider_id_has_match - * @var array row User row - * @var array data Provider data - * @var \OAuth\Common\Service\ServiceInterface service OAuth service + * @var array row User row + * @var array data Provider data + * @var array redirect_data Data to be appended to the redirect url + * @var \OAuth\Common\Service\ServiceInterface service OAuth service * @since 3.2.3-RC1 + * @changed 3.2.6-RC1 Added redirect_data */ $vars = array( 'row', 'data', + 'redirect_data', 'service', ); extract($this->dispatcher->trigger_event('core.oauth_login_after_check_if_provider_id_has_match', compact($vars))); @@ -250,10 +259,7 @@ class oauth extends \phpbb\auth\provider\base 'status' => LOGIN_SUCCESS_LINK_PROFILE, 'error_msg' => 'LOGIN_OAUTH_ACCOUNT_NOT_LINKED', 'user_row' => array(), - 'redirect_data' => array( - 'auth_provider' => 'oauth', - 'login_link_oauth_service' => $service_name_original, - ), + 'redirect_data' => $redirect_data, ); } -- cgit v1.2.1 From af994e7a390eea1125d63a6d0e2ef7b945549669 Mon Sep 17 00:00:00 2001 From: mrgoldy Date: Tue, 2 Apr 2019 10:59:36 +0200 Subject: [ticket/16006] Create unique ID's for OAuth (un)linking PHPBB3-16006 --- phpBB/phpbb/auth/provider/oauth/oauth.php | 1 + 1 file changed, 1 insertion(+) (limited to 'phpBB/phpbb/auth') diff --git a/phpBB/phpbb/auth/provider/oauth/oauth.php b/phpBB/phpbb/auth/provider/oauth/oauth.php index 8809a0c6b4..3e9b424e8d 100644 --- a/phpBB/phpbb/auth/provider/oauth/oauth.php +++ b/phpBB/phpbb/auth/provider/oauth/oauth.php @@ -674,6 +674,7 @@ class oauth extends \phpbb\auth\provider\base 'oauth_service' => $actual_name, ), + 'SERVICE_ID' => $actual_name, 'SERVICE_NAME' => $this->user->lang['AUTH_PROVIDER_OAUTH_SERVICE_' . strtoupper($actual_name)], 'UNIQUE_ID' => (isset($oauth_user_ids[$actual_name])) ? $oauth_user_ids[$actual_name] : null, ); -- cgit v1.2.1 From 68434e6dbc1b87f2bacb246b463d86ebc157473f Mon Sep 17 00:00:00 2001 From: mrgoldy Date: Tue, 2 Apr 2019 15:12:52 +0200 Subject: [ticket/16007] Show ban message for OAuth login PHPBB3-16007 --- phpBB/phpbb/auth/provider/oauth/oauth.php | 31 ++++++++++++++++++++++++++++--- 1 file changed, 28 insertions(+), 3 deletions(-) (limited to 'phpBB/phpbb/auth') diff --git a/phpBB/phpbb/auth/provider/oauth/oauth.php b/phpBB/phpbb/auth/provider/oauth/oauth.php index 8809a0c6b4..28fa7a6be4 100644 --- a/phpBB/phpbb/auth/provider/oauth/oauth.php +++ b/phpBB/phpbb/auth/provider/oauth/oauth.php @@ -191,7 +191,7 @@ class oauth extends \phpbb\auth\provider\base return $provider->login($username, $password); } - // Requst the name of the OAuth service + // Request the name of the OAuth service $service_name_original = $this->request->variable('oauth_service', '', false); $service_name = 'auth.provider.oauth.service.' . strtolower($service_name_original); if ($service_name_original === '' || !array_key_exists($service_name, $this->service_providers)) @@ -270,11 +270,36 @@ class oauth extends \phpbb\auth\provider\base throw new \Exception('AUTH_PROVIDER_OAUTH_ERROR_INVALID_ENTRY'); } + /** + * Check if the user is banned. + * The fourth parameter, return, has to be true, + * otherwise the OAuth login is still called and + * an uncaught exception is thrown as there is no + * token stored in the database. + */ + $ban = $this->user->check_ban($row['user_id'], $row['user_ip'], $row['user_email'], true); + if ($ban !== false) + { + $till_date = !empty($ban['ban_end']) ? $this->user->format_date($ban['ban_end']) : ''; + $message = !empty($ban['ban_end']) ? 'BOARD_BAN_TIME' : 'BOARD_BAN_PERM'; + + $contact_link = phpbb_get_board_contact_link($this->config, $this->phpbb_root_path, $this->php_ext); + $message = $this->user->lang($message, $till_date, '', ''); + $message .= !empty($ban['ban_give_reason']) ? '

' . $this->user->lang('BOARD_BAN_REASON', $ban['ban_give_reason']) : ''; + $message .= !empty($ban['ban_triggered_by']) ? '

' . $this->user->lang('BAN_TRIGGERED_BY_' . strtoupper($ban['ban_triggered_by'])) . '' : ''; + + return array( + 'status' => LOGIN_BREAK, + 'error_msg' => $message, + 'user_row' => $row, + ); + } + // Update token storage to store the user_id $storage->set_user_id($row['user_id']); /** - * Event is triggered after user is successfuly logged in via OAuth. + * Event is triggered after user is successfully logged in via OAuth. * * @event core.auth_oauth_login_after * @var array row User row @@ -707,7 +732,7 @@ class oauth extends \phpbb\auth\provider\base AND user_id = " . (int) $user_id; $this->db->sql_query($sql); - // Clear all tokens belonging to the user on this servce + // Clear all tokens belonging to the user on this service $service_name = 'auth.provider.oauth.service.' . strtolower($link_data['oauth_service']); $storage = new \phpbb\auth\provider\oauth\token_storage($this->db, $this->user, $this->auth_provider_oauth_token_storage_table, $this->auth_provider_oauth_state_table); $storage->clearToken($service_name); -- cgit v1.2.1 From fc625387332c50bc92253a1822ad0607594af736 Mon Sep 17 00:00:00 2001 From: mrgoldy Date: Tue, 2 Apr 2019 17:25:00 +0200 Subject: [ticket/16007] No strict comparison against "false" PHPBB3-16007 --- phpBB/phpbb/auth/provider/oauth/oauth.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'phpBB/phpbb/auth') diff --git a/phpBB/phpbb/auth/provider/oauth/oauth.php b/phpBB/phpbb/auth/provider/oauth/oauth.php index 28fa7a6be4..f3dfd07ae8 100644 --- a/phpBB/phpbb/auth/provider/oauth/oauth.php +++ b/phpBB/phpbb/auth/provider/oauth/oauth.php @@ -278,7 +278,7 @@ class oauth extends \phpbb\auth\provider\base * token stored in the database. */ $ban = $this->user->check_ban($row['user_id'], $row['user_ip'], $row['user_email'], true); - if ($ban !== false) + if (!empty($ban)) { $till_date = !empty($ban['ban_end']) ? $this->user->format_date($ban['ban_end']) : ''; $message = !empty($ban['ban_end']) ? 'BOARD_BAN_TIME' : 'BOARD_BAN_PERM'; -- cgit v1.2.1 From 72be8e08705fa103adc6482af9712077cdceb8cc Mon Sep 17 00:00:00 2001 From: 3D-I Date: Thu, 16 May 2019 21:53:20 +0200 Subject: [ticket/16055] Fix Oauth's redirects Via forum, memberlist, topic or post etc.. PHPBB3-16055 --- phpBB/phpbb/auth/provider/oauth/oauth.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'phpBB/phpbb/auth') diff --git a/phpBB/phpbb/auth/provider/oauth/oauth.php b/phpBB/phpbb/auth/provider/oauth/oauth.php index 93419d2915..5e8cb3dea8 100644 --- a/phpBB/phpbb/auth/provider/oauth/oauth.php +++ b/phpBB/phpbb/auth/provider/oauth/oauth.php @@ -423,7 +423,7 @@ class oauth extends \phpbb\auth\provider\base if ($credentials['key'] && $credentials['secret']) { $actual_name = str_replace('auth.provider.oauth.service.', '', $service_name); - $redirect_url = build_url(false) . '&login=external&oauth_service=' . $actual_name; + $redirect_url = generate_board_url() . '/ucp.' . $this->php_ext . '?mode=login&login=external&oauth_service=' . $actual_name; $login_data['BLOCK_VARS'][$service_name] = array( 'REDIRECT_URL' => redirect($redirect_url, true), 'SERVICE_NAME' => $this->user->lang['AUTH_PROVIDER_OAUTH_SERVICE_' . strtoupper($actual_name)], -- cgit v1.2.1 From bba9de8c9cdcb612936e165150e1440c188c8d3e Mon Sep 17 00:00:00 2001 From: Jakub Senko Date: Thu, 23 May 2019 09:14:45 +0200 Subject: [ticket/16065] Add user_ip to SQL query PHPBB3-16065 --- phpBB/phpbb/auth/provider/oauth/oauth.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'phpBB/phpbb/auth') diff --git a/phpBB/phpbb/auth/provider/oauth/oauth.php b/phpBB/phpbb/auth/provider/oauth/oauth.php index 93419d2915..b16e74ad34 100644 --- a/phpBB/phpbb/auth/provider/oauth/oauth.php +++ b/phpBB/phpbb/auth/provider/oauth/oauth.php @@ -264,7 +264,7 @@ class oauth extends \phpbb\auth\provider\base } // Retrieve the user's account - $sql = 'SELECT user_id, username, user_password, user_passchg, user_email, user_type, user_login_attempts + $sql = 'SELECT user_id, username, user_password, user_passchg, user_email, user_ip, user_type, user_login_attempts FROM ' . $this->users_table . ' WHERE user_id = ' . (int) $row['user_id']; $result = $this->db->sql_query($sql); -- cgit v1.2.1 From c01e604998a42ebf7ee6fb3f81db6599157cc9d9 Mon Sep 17 00:00:00 2001 From: mrgoldy Date: Fri, 24 May 2019 14:43:10 +0200 Subject: [ticket/16068] Adjust DocBlock @param's PHPBB3-16068 --- phpBB/phpbb/auth/provider/provider_interface.php | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) (limited to 'phpBB/phpbb/auth') diff --git a/phpBB/phpbb/auth/provider/provider_interface.php b/phpBB/phpbb/auth/provider/provider_interface.php index 35e0f559a1..463324ff46 100644 --- a/phpBB/phpbb/auth/provider/provider_interface.php +++ b/phpBB/phpbb/auth/provider/provider_interface.php @@ -71,9 +71,10 @@ interface provider_interface * options with whatever configuraton values are passed to it as an array. * It then returns the name of the acp file related to this authentication * provider. - * @param array $new_config Contains the new configuration values that - * have been set in acp_board. - * @return array|null Returns null if not implemented or an array with + * + * @param \phpbb\config\config $new_config Contains the new configuration values + * that have been set in acp_board. + * @return array|null Returns null if not implemented or an array with * the template file name and an array of the vars * that the template needs that must conform to the * following example: -- cgit v1.2.1 From ecb39bc435946afc930ef68c86bb5ec441e9e3c0 Mon Sep 17 00:00:00 2001 From: rubencm Date: Wed, 14 Aug 2019 06:48:11 +0000 Subject: [ticket/13175] Check if account is already linked when using OAuth PHPBB3-13175 --- phpBB/phpbb/auth/provider/oauth/oauth.php | 15 +++++++++++++++ 1 file changed, 15 insertions(+) (limited to 'phpBB/phpbb/auth') diff --git a/phpBB/phpbb/auth/provider/oauth/oauth.php b/phpBB/phpbb/auth/provider/oauth/oauth.php index 1a3083d42e..0d94acfbca 100644 --- a/phpBB/phpbb/auth/provider/oauth/oauth.php +++ b/phpBB/phpbb/auth/provider/oauth/oauth.php @@ -634,6 +634,21 @@ class oauth extends \phpbb\auth\provider\base */ protected function link_account_perform_link(array $data) { + // Check if the external account is already associated with other user + $sql = 'SELECT user_id + FROM ' . $this->auth_provider_oauth_token_account_assoc . " + WHERE provider = '" . $this->db->sql_escape($data['provider']) . "' + AND oauth_provider_id = '" . $this->db->sql_escape($data['oauth_provider_id']) . "'"; + $result = $this->db->sql_query($sql); + $row = $this->db->sql_fetchrow($result); + $this->db->sql_freeresult($result); + + if ($row) + { + trigger_error('AUTH_PROVIDER_OAUTH_ERROR_ALREADY_LINKED'); + } + + // Link account $sql = 'INSERT INTO ' . $this->auth_provider_oauth_token_account_assoc . ' ' . $this->db->sql_build_array('INSERT', $data); $this->db->sql_query($sql); -- cgit v1.2.1