Dereku/snappymail
1
0
Fork 0
mirror of https://github.com/the-djmaze/snappymail.git synced 2026-09-04 06:57:03 +03:00
Code Issues Projects Releases Packages Wiki Activity Actions

Remove LOGIN parameter (login, ownCloud, sso) (Security fix)

Browse source 
Code refactoring
This commit is contained in:
RainLoop Team 2014-06-26 20:11:49 +04:00
parent cd448ffe91
commit 5d84af4458
22 changed files with 393 additions and 488 deletions
Download patch file Download diff file Expand all files Collapse all files

27
rainloop/v/0.0.0/app/libraries/RainLoop/Api.php
View file

@ -70,19 +70,17 @@ class Api
/**
* @param string $sEmail
* @param string $sPassword
* @param string $sLogin = ''
* @param bool $bUseTimeout = true
*
* @return string
*/
public static function GetUserSsoHash($sEmail, $sPassword, $sLogin = '', $bUseTimeout = true)
public static function GetUserSsoHash($sEmail, $sPassword, $bUseTimeout = true)
{
$sSsoHash = \sha1(\rand(10000, 99999).$sEmail.$sPassword.$sLogin.\microtime(true));
$sSsoHash = \sha1(\rand(10000, 99999).$sEmail.$sPassword.\microtime(true));
return self::Actions()->Cacher()->Set(self::Actions()->BuildSsoCacherKey($sSsoHash), \RainLoop\Utils::EncodeKeyValues(array(
return self::Actions()->Cacher()->Set(\RainLoop\KeyPathHelper::SsoCacherKey($sSsoHash), \RainLoop\Utils::EncodeKeyValues(array(
'Email' => $sEmail,
'Password' => $sPassword,
'Login' => $sLogin,
'Time' => $bUseTimeout ? \time() : 0
))) ? $sSsoHash : '';
}
@ -94,6 +92,23 @@ class Api
*/
public static function ClearUserSsoHash($sSsoHash)
{
return self::Actions()->Delete(self::Actions()->BuildSsoCacherKey($sSsoHash));
return self::Actions()->Cacher()->Delete(\RainLoop\KeyPathHelper::SsoCacherKey($sSsoHash));
}
/**
* @todo
* @param string $sEmail
*
* @return bool
*/
public static function ClearUserDateStorage($sEmail)
{
$sEmail = \MailSo\Base\Utils::IdnToAscii($sEmail);
// TwoFactor Auth User Data
self::Actions()->StorageProvider()->Clear(null,
\RainLoop\Providers\Storage\Enumerations\StorageType::NOBODY,
\RainLoop\KeyPathHelper::TwoFactorAuthUserData($sEmail)
);
}
}