Dereku/snappymail
1
0
Fork 0
mirror of https://github.com/the-djmaze/snappymail.git synced 2026-09-03 22:47:03 +03:00
Code Issues Projects Releases Packages Wiki Activity Actions

Remove LOGIN parameter (login, ownCloud, sso) (Security fix)

Browse source 
Code refactoring
This commit is contained in:
RainLoop Team 2014-06-26 20:11:49 +04:00
parent cd448ffe91
commit 5d84af4458
22 changed files with 393 additions and 488 deletions
Download patch file Download diff file Expand all files Collapse all files

10
build/owncloud/rainloop-app/ajax/personal.php
View file

@ -20,27 +20,25 @@ if (isset($_POST['appname'], $_POST['rainloop-password'], $_POST['rainloop-email
$sUser = OCP\User::getUser();
$sPostEmail = $_POST['rainloop-email'];
$sPostLogin = isset($_POST['rainloop-login']) ? $_POST['rainloop-login'] : '';
OCP\Config::setUserValue($sUser, 'rainloop', 'rainloop-email', $sPostEmail);
OCP\Config::setUserValue($sUser, 'rainloop', 'rainloop-login', $sPostLogin);
$sPass = $_POST['rainloop-password'];
if ('******' !== $sPass && '' !== $sPass)
{
include_once OC_App::getAppPath('rainloop').'/lib/RainLoopHelper.php';
OCP\Config::setUserValue($sUser, 'rainloop', 'rainloop-password',
OC_RainLoop_Helper::encodePassword($sPass, md5($sPostEmail.$sPostLogin)));
OC_RainLoop_Helper::encodePassword($sPass, md5($sPostEmail)));
}
$sEmail = OCP\Config::getUserValue($sUser, 'rainloop', 'rainloop-email', '');
$sLogin = OCP\Config::getUserValue($sUser, 'rainloop', 'rainloop-login', '');
}
else
{
OC_JSON::error(array('Message' => 'Invalid argument(s)', 'Email' => $sEmail, 'Login' => $sLogin));
OC_JSON::error(array('Message' => 'Invalid argument(s)', 'Email' => $sEmail));
return false;
}
OCP\JSON::success(array('Message' => 'Saved successfully', 'Email' => $sEmail, 'Login' => $sLogin));
OCP\JSON::success(array('Message' => 'Saved successfully', 'Email' => $sEmail));
return true;

5
build/owncloud/rainloop-app/lib/RainLoopHelper.php
View file

@ -2,7 +2,7 @@
class OC_RainLoop_Helper
{
public static function getSsoHash($sUrl, $sSsoKey, $sEmail, $sPassword, $sLogin = '')
public static function getSsoHash($sUrl, $sSsoKey, $sEmail, $sPassword)
{
if (!function_exists('curl_init'))
{
@ -21,8 +21,7 @@ class OC_RainLoop_Helper
CURLOPT_POSTFIELDS => http_build_query(array(
'SsoKey' => $sSsoKey,
'Email' => $sEmail,
'Password' => $sPassword,
'Login' => $sLogin
'Password' => $sPassword
), '', '&'),
CURLOPT_TIMEOUT => 5
));

1
build/owncloud/rainloop-app/personal.php
View file

@ -30,7 +30,6 @@ else
$sEmail = OCP\Config::getUserValue($sUser, 'rainloop', 'rainloop-email', '');
$oTemplate->assign('rainloop-email', $sEmail);
$oTemplate->assign('rainloop-login', OCP\Config::getUserValue($sUser, 'rainloop', 'rainloop-login', ''));
$sPass = OCP\Config::getUserValue($sUser, 'rainloop', 'rainloop-password', '');
$oTemplate->assign('rainloop-password', 0 === strlen($sPass) && 0 === strlen($sEmail) ? '' : '******');

3
build/owncloud/rainloop-app/templates/personal.php
View file

@ -8,9 +8,6 @@
<input type="text" id="rainloop-email" name="rainloop-email"
value="<?php echo $_['rainloop-email']; ?>" placeholder="<?php p($l->t('Email')); ?>" />
<input type="text" id="rainloop-email" name="rainloop-login"
value="<?php echo $_['rainloop-login']; ?>" placeholder="<?php p($l->t('Login (optional)')); ?>" />
<input type="password" id="rainloop-password" name="rainloop-password"
value="<?php echo $_['rainloop-password']; ?>" placeholder="<?php p($l->t('Password')); ?>" />