From 9ab57de3562a584519485579e85a45bedc9352c6 Mon Sep 17 00:00:00 2001 From: very-ape Date: Thu, 20 May 2021 00:16:08 -0700 Subject: [PATCH 01/24] Bug fix: allow authentication addons to create users again. --- src/Model/User.php | 61 ++++++++++++++++++++++++++++++++++------------ 1 file changed, 45 insertions(+), 16 deletions(-) diff --git a/src/Model/User.php b/src/Model/User.php index 3b11ee6ce8..4b716f2606 100644 --- a/src/Model/User.php +++ b/src/Model/User.php @@ -515,7 +515,20 @@ class User */ public static function getIdFromPasswordAuthentication($user_info, $password, $third_party = false) { - $user = self::getAuthenticationInfo($user_info); + // Addons registered with the "authenticate" hook may create the user on the + // fly. `getAuthenticationInfo` will fail if the user doesn't exist yet. If + // the user doesn't exist, we should give the addons a chance to create the + // user in our database, if applicable, before re-throwing the exception if + // they fail. + try { + $user = self::getAuthenticationInfo($user_info); + } catch (Exception $e) { + if (is_string($user_info)) { + return self::getIdFromAuthenticateHooks($user_info, $password); + } else { + throw $e; + } + } if ($third_party && DI::pConfig()->get($user['uid'], '2fa', 'verified')) { // Third-party apps can't verify two-factor authentication, we use app-specific passwords instead @@ -545,23 +558,39 @@ class User return $user['uid']; } else { - $addon_auth = [ - 'username' => $user['nickname'], - 'password' => $password, - 'authenticated' => 0, - 'user_record' => null - ]; + return self::getIdFromAuthenticateHooks($user['nickname'], $password); // throws + } - /* - * An addon indicates successful login by setting 'authenticated' to non-zero value and returning a user record - * Addons should never set 'authenticated' except to indicate success - as hooks may be chained - * and later addons should not interfere with an earlier one that succeeded. - */ - Hook::callAll('authenticate', $addon_auth); + throw new HTTPException\ForbiddenException(DI::l10n()->t('Login failed')); + } - if ($addon_auth['authenticated'] && $addon_auth['user_record']) { - return $user['uid']; - } + /** + * Try to obtain a user ID via "authenticate" hook addons + * + * Returns the user id associated with a successful password authentication + * + * @param string $username + * @param string $password + * @return int User Id if authentication is successful + * @throws HTTPException\ForbiddenException + */ + public static function getIdFromAuthenticateHooks($username, $password) { + $addon_auth = [ + 'username' => $username, + 'password' => $password, + 'authenticated' => 0, + 'user_record' => null + ]; + + /* + * An addon indicates successful login by setting 'authenticated' to non-zero value and returning a user record + * Addons should never set 'authenticated' except to indicate success - as hooks may be chained + * and later addons should not interfere with an earlier one that succeeded. + */ + Hook::callAll('authenticate', $addon_auth); + + if ($addon_auth['authenticated'] && $addon_auth['user_record']) { + return $user['uid']; } throw new HTTPException\ForbiddenException(DI::l10n()->t('Login failed')); From c89241dbd80b1b0503e239f8b468e6efbcb79802 Mon Sep 17 00:00:00 2001 From: very-ape Date: Thu, 20 May 2021 00:19:09 -0700 Subject: [PATCH 02/24] Bug fix: add missing changes. --- src/Model/User.php | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/src/Model/User.php b/src/Model/User.php index 4b716f2606..8a9f0a9304 100644 --- a/src/Model/User.php +++ b/src/Model/User.php @@ -523,11 +523,19 @@ class User try { $user = self::getAuthenticationInfo($user_info); } catch (Exception $e) { - if (is_string($user_info)) { - return self::getIdFromAuthenticateHooks($user_info, $password); - } else { + // Addons can create users, and creating a numeric username would create + // abiguity with user IDs, possibly opening up an attack vector. + // So let's be very careful about that. + if (is_numeric($user_info) || is_numeric($user_info['nickname'] ?? '')) { throw $e; } + + $username = (is_string($user_info) ? $user_info : $user_info['nickname'] ?? ''); + + if (!$username) { + throw $e; + } + return self::getIdFromAuthenticateHooks($user_info, $password); } if ($third_party && DI::pConfig()->get($user['uid'], '2fa', 'verified')) { @@ -590,7 +598,7 @@ class User Hook::callAll('authenticate', $addon_auth); if ($addon_auth['authenticated'] && $addon_auth['user_record']) { - return $user['uid']; + return $addon_auth['user_record']['uid']; } throw new HTTPException\ForbiddenException(DI::l10n()->t('Login failed')); From 8e005f7de2bc8fa9e82d7ae666b9b3b94f2a8cf4 Mon Sep 17 00:00:00 2001 From: Hypolite Petovan Date: Wed, 19 May 2021 17:47:15 -0400 Subject: [PATCH 03/24] Remove whitespace from opening HTML tag ending --- view/templates/admin/features.tpl | 2 +- view/templates/album_edit.tpl | 8 ++-- view/templates/birthdays_reminder.tpl | 2 +- view/templates/comment_item.tpl | 6 +-- view/templates/contact/advanced.tpl | 2 +- view/templates/contact_edit.tpl | 10 ++--- view/templates/contact_template.tpl | 20 ++++----- view/templates/contacts-template.tpl | 2 +- view/templates/conversation.tpl | 4 +- view/templates/dfrn_req_confirm.tpl | 4 +- view/templates/directory_header.tpl | 4 +- view/templates/directory_item.tpl | 8 ++-- view/templates/event.tpl | 2 +- view/templates/event_form.tpl | 2 +- view/templates/events.tpl | 6 +-- view/templates/events_js.tpl | 2 +- view/templates/events_reminder.tpl | 2 +- view/templates/field_combobox.tpl | 4 +- view/templates/filebrowser.tpl | 2 +- view/templates/filer_dialog.tpl | 2 +- view/templates/group_drop.tpl | 2 +- view/templates/group_edit.tpl | 10 ++--- view/templates/group_selection.tpl | 4 +- view/templates/head.tpl | 16 +++---- view/templates/hovercard.tpl | 2 +- view/templates/invite.tpl | 2 +- view/templates/jot-header.tpl | 2 +- view/templates/jot.tpl | 30 ++++++------- view/templates/login.tpl | 6 +-- view/templates/logout.tpl | 2 +- view/templates/lostpass.tpl | 4 +- view/templates/mail_conv.tpl | 10 ++--- view/templates/mail_list.tpl | 10 ++--- view/templates/micropro_img.tpl | 6 +-- view/templates/msg-header.tpl | 2 +- view/templates/nav.tpl | 34 +++++++-------- view/templates/notifications/intros.tpl | 8 ++-- view/templates/notifications/netfriend.tpl | 2 +- view/templates/notifications/suggestions.tpl | 8 ++-- view/templates/oembed_video.tpl | 6 +-- view/templates/photo_album.tpl | 4 +- view/templates/photo_albums.tpl | 4 +- view/templates/photo_edit.tpl | 8 ++-- view/templates/photo_top.tpl | 2 +- .../photos_default_uploader_submit.tpl | 2 +- view/templates/photos_upload.tpl | 16 +++---- view/templates/profile/publish.tpl | 2 +- view/templates/prv_message.tpl | 16 +++---- view/templates/register.tpl | 42 +++++++++---------- view/templates/removeme.tpl | 2 +- view/templates/settings/nick_set.tpl | 2 +- view/templates/settings/oauth_edit.tpl | 2 +- .../templates/settings/profile/index_head.tpl | 2 +- .../templates/settings/profile/photo/crop.tpl | 2 +- .../templates/settings/twofactor/recovery.tpl | 2 +- view/templates/settings/twofactor/verify.tpl | 2 +- view/templates/threaded_conversation.tpl | 4 +- view/templates/uimport.tpl | 26 ++++++------ view/templates/wallmessage.tpl | 12 +++--- view/templates/widget/events.tpl | 4 +- view/templates/widget/follow.tpl | 2 +- view/templates/widget/peoplefind.tpl | 12 +++--- view/templates/widget_forumlist.tpl | 4 +- view/theme/duepuntozero/templates/nav.tpl | 34 +++++++-------- .../frio/templates/admin/users/deleted.tpl | 2 +- view/theme/frio/templates/album_edit.tpl | 4 +- view/theme/frio/templates/confirm.tpl | 2 +- .../theme/frio/templates/contact/advanced.tpl | 4 +- view/theme/frio/templates/contact_edit.tpl | 10 ++--- .../theme/frio/templates/contact_template.tpl | 20 ++++----- .../frio/templates/contacts-template.tpl | 2 +- .../theme/frio/templates/directory_header.tpl | 4 +- view/theme/frio/templates/event.tpl | 4 +- view/theme/frio/templates/event_form.tpl | 4 +- .../frio/templates/field_themeselect.tpl | 2 +- view/theme/frio/templates/group_edit.tpl | 2 +- view/theme/frio/templates/invite.tpl | 2 +- view/theme/frio/templates/jot.tpl | 2 +- view/theme/frio/templates/login.tpl | 6 +-- view/theme/frio/templates/mail_conv.tpl | 2 +- .../frio/templates/notifications/intros.tpl | 14 +++---- view/theme/frio/templates/photo_albums.tpl | 2 +- view/theme/frio/templates/photos_upload.tpl | 6 +-- view/theme/frio/templates/prv_message.tpl | 2 +- view/theme/frio/templates/register.tpl | 24 +++++------ view/theme/frio/templates/removeme.tpl | 4 +- .../frio/templates/settings/connectors.tpl | 2 +- .../theme/frio/templates/settings/display.tpl | 2 +- .../frio/templates/settings/oauth_edit.tpl | 2 +- view/theme/frio/templates/theme_settings.tpl | 2 +- view/theme/frio/templates/wall_thread.tpl | 2 +- .../frio/templates/widget/peoplefind.tpl | 12 +++--- .../quattro/templates/contact_template.tpl | 20 ++++----- view/theme/quattro/templates/event_form.tpl | 4 +- view/theme/quattro/templates/events-js.tpl | 2 +- view/theme/quattro/templates/events.tpl | 6 +-- view/theme/quattro/templates/jot.tpl | 2 +- view/theme/quattro/templates/mail_conv.tpl | 10 ++--- view/theme/quattro/templates/nav.tpl | 30 ++++++------- view/theme/quattro/templates/photo_item.tpl | 2 +- .../theme/quattro/templates/profile/vcard.tpl | 2 +- .../theme/quattro/templates/wall_item_tag.tpl | 4 +- .../quattro/templates/widget_forumlist.tpl | 4 +- view/theme/smoothly/templates/jot-header.tpl | 2 +- view/theme/smoothly/templates/jot.tpl | 28 ++++++------- view/theme/smoothly/templates/nav.tpl | 2 +- view/theme/smoothly/templates/tools.tpl | 4 +- .../smoothly/templates/widget/follow.tpl | 2 +- .../vier/templates/ch_directory_item.tpl | 8 ++-- view/theme/vier/templates/contact_edit.tpl | 10 ++--- .../theme/vier/templates/contact_template.tpl | 22 +++++----- view/theme/vier/templates/event_form.tpl | 2 +- view/theme/vier/templates/nav.tpl | 40 +++++++++--------- view/theme/vier/templates/wall_item_tag.tpl | 4 +- view/theme/vier/templates/wall_thread.tpl | 2 +- .../vier/templates/widget_forumlist_right.tpl | 4 +- 116 files changed, 415 insertions(+), 415 deletions(-) diff --git a/view/templates/admin/features.tpl b/view/templates/admin/features.tpl index 46a7abea26..42058d5caf 100644 --- a/view/templates/admin/features.tpl +++ b/view/templates/admin/features.tpl @@ -15,7 +15,7 @@ {{/foreach}} -
+
diff --git a/view/templates/album_edit.tpl b/view/templates/album_edit.tpl index b6f24ec3b2..dd4459fe9e 100644 --- a/view/templates/album_edit.tpl +++ b/view/templates/album_edit.tpl @@ -1,10 +1,10 @@
-
+ - - + +
@@ -12,4 +12,4 @@
-
+
diff --git a/view/templates/birthdays_reminder.tpl b/view/templates/birthdays_reminder.tpl index 6aa51d4702..5fb75a993d 100644 --- a/view/templates/birthdays_reminder.tpl +++ b/view/templates/birthdays_reminder.tpl @@ -1,7 +1,7 @@ {{if $count}} -