diff --git a/.gitignore b/.gitignore index 15e9bfc9..03ef8272 100644 --- a/.gitignore +++ b/.gitignore @@ -1,5 +1,6 @@ # Local Config /public/include/config/global.inc.php +/public/include/config/security.inc.php # Templates /public/templates/compile/*.php diff --git a/cronjobs/shared.inc.php b/cronjobs/shared.inc.php index ecc3da11..b34026df 100644 --- a/cronjobs/shared.inc.php +++ b/cronjobs/shared.inc.php @@ -18,6 +18,21 @@ limitations under the License. */ +define('SECURITY', '*)WT#&YHfd'); +// Whether or not to check SECHASH for validity, still checks if SECURITY defined as before if disabled +define('SECHASH_CHECK', false); + +// Nothing below here to configure, move along... + +// change SECHASH every second, we allow up to 3 sec back for slow servers +if (SECHASH_CHECK) { + function fip($tr=0) { return md5(SECURITY.(time()-$tr).SECURITY); } + define('SECHASH', fip()); + function cfip() { return (fip()==SECHASH||fip(1)==SECHASH||fip(2)==SECHASH) ? 1 : 0; } +} else { + function cfip() { return (@defined('SECURITY')) ? 1 : 0; } +} + // MODIFY THIS // We need to find our include files so set this properly define("BASEPATH", "../public/"); @@ -32,14 +47,15 @@ $dStartTime = microtime(true); // Our cron name $cron_name = basename($_SERVER['PHP_SELF'], '.php'); -// Our security check -define("SECURITY", 1); - // Include our configuration (holding defines for the requires) +require_once(BASEPATH . 'include/config/global.inc.dist.php'); require_once(BASEPATH . 'include/config/global.inc.php'); -// We include all needed files here, even though our templates could load them themself -require_once(INCLUDE_DIR . '/autoloader.inc.php'); +require_once(BASEPATH . 'include/config/security.inc.dist.php'); +@include_once(BASEPATH . 'include/config/security.inc.php'); + +require_once(BASEPATH . 'include/bootstrap.php'); +require_once(BASEPATH . 'include/version.inc.php'); // Command line switches array_shift($argv); diff --git a/public/include/admin_checks.php b/public/include/admin_checks.php new file mode 100644 index 00000000..4935047d --- /dev/null +++ b/public/include/admin_checks.php @@ -0,0 +1,130 @@ +isAdmin(@$_SESSION['USERDATA']['id'])) { + if (!include_once(INCLUDE_DIR . '/lib/jsonRPCClient.php')) die('Unable to load libs'); + $notice = array(); + $enotice = array(); + $error = array(); + + // setup some basic stuff for checking - getuid/getpwuid not available on mac/windows + $apache_user = 'unknown'; + if (substr_count(strtolower(PHP_OS), 'nix') > 0) { + $apache_user = (function_exists('posix_getuid')) ? posix_getuid() : 'unknown'; + $apache_user = (function_exists('posix_getpwuid')) ? posix_getpwuid($apache_user) : $apache_user; + } + + // setup checks + // check if memcache isn't available but enabled in config -> error + if (!class_exists('Memcached') && $config['memcache']['enabled']) { + $error[] = "You have memcache enabled in your config and it's not available. Install the package on your system."; + } + // if it's not enabled, test it if it exists, if it works -> error tell them to enable, -> otherwise notice it's disabled + if (!$config['memcache']['enabled']) { + if (PHP_OS == 'WINNT') { + require_once(CLASS_DIR . 'memcached.class.php'); + } + if (class_exists('Memcached')) { + $memcache_test = @new Memcached(); + $memcache_test_add = @$memcache_test->addServer($config['memcache']['host'], $config['memcache']['port']); + $randmctv = rand(5,10); + $memcache_test_set = @$memcache_test->set('test_mpos_setval', $randmctv); + $memcache_test_get = @$memcache_test->get('test_mpos_setval'); + } + if (class_exists('Memcached') && $memcache_test_get == $randmctv) { + $error[] = "You have memcache disabled in the config and it's available & works! Enable it."; + } else { + $notice[] = "Memcache is disabled; Almost every linux distro has packages for it, you should be using it if you can."; + } + } + // check if htaccess exists + if (!file_exists(BASEPATH.".htaccess")) { + $htaccess_link = ".htaccess"; + $notice[] = "You don't seem to have a .htaccess in your public folder, if you're using apache set it up $htaccess_link"; + } + // check if we can write templates/cache and templates/compile -> error + if (!is_writable(THEME_DIR.'/cache')) { + $error[] = "templates/cache folder is not writable for uid {$apache_user['name']}"; + } + if (!is_writable(THEME_DIR.'/compile')) { + $error[] = "templates/compile folder is not writable for uid {$apache_user['name']}"; + } + // check if we can write the config files, we should NOT be able to -> error + if (is_writable(INCLUDE_DIR.'/config/global.inc.php') || is_writable(INCLUDE_DIR.'/config/global.inc.dist.php') || + is_writable(INCLUDE_DIR.'/config/security.inc.php') || is_writable(INCLUDE_DIR.'/config/security.inc.dist.php')) { + $error[] = "Your config files SHOULD NOT be writable to this user!"; + } + // check if daemon can connect -> error + try { + if ($bitcoin->can_connect() !== true) { + $error[] = "Unable to connect to coin daemon using provided credentials"; + } + } catch (Exception $e) { + } + // if coldwallet is not empty, check if the address is valid -> error + if (!empty($config['coldwallet']['address'])) { + try { + if ($bitcoin->can_connect() == true) { + $validate_cold_address = $bitcoin->validateaddress($config['coldwallet']['address']); + if (!$validate_cold_address['isvalid']) { + $error[] = "Your cold wallet address is SET and INVALID"; + } + } + } catch (Exception $e) { + } + } + // if database connection fails -> error + $db_connect = new mysqli($config['db']['host'], $config['db']['user'], $config['db']['pass'], $config['db']['name'], $config['db']['port']); + if (mysqli_connect_errno() || !array_key_exists('client_info', $db_connect)) { + $error[] = "Unable to connect to mysql using provided credentials"; + } + if ($config['mc_antidos'] && !$config['memcache']['enabled']) { + $error[] = "mc_antidos is enabled and memcache is not, memcache is required to use this"; + } + // poke stratum using gettingstarted details -> enotice + if (substr_count(strtolower(PHP_OS), 'nix') > 0) { + // unix *poke* + $socket = @socket_create(AF_INET, SOCK_STREAM, SOL_TCP); + if ($socket !== false) { + $address = @gethostbyname($config['gettingstarted']['stratumurl']); + $result = @socket_connect($socket, $address, $config['gettingstarted']['stratumport']); + if ($result !== 1) { + $enotice[] = "We tried to poke your Stratum server using config->gettingstarted details but it didn't respond"; + } + $close = @socket_close($socket); + } + } else { + // mac/windows *poke* + if (! $fp = @fsockopen($config['gettingstarted']['stratumurl'],$config['gettingstarted']['stratumport'],$errCode,$errStr,1)) { + $enotice[] = "We tried to poke your Stratum server using config->gettingstarted details but it didn't respond"; + } + @fclose($fp); + } + + // security checks + // salts too short -> notice, salts default -> error + if ((strlen($config['SALT']) < 24) || (strlen($config['SALTY']) < 24) || $config['SALT'] == 'PLEASEMAKEMESOMETHINGRANDOM' || $config['SALTY'] == 'THISSHOULDALSOBERRAANNDDOOM') { + if ($config['SALT'] == 'PLEASEMAKEMESOMETHINGRANDOM' || $config['SALTY'] == 'THISSHOULDALSOBERRAANNDDOOM') { + $error[] = "You absolutely SHOULD NOT leave your SALT or SALTY default changing them will require registering again"; + } else { + $notice[] = "SALT or SALTY is too short, they should be more than 24 characters and changing them will require registering again"; + } + } + + // display the errors + foreach ($enotice as $en) { + $_SESSION['POPUP'][] = array('CONTENT' => $en, 'TYPE' => 'info'); + } + if (!count($notice) && !count($error)) { + $_SESSION['POPUP'][] = array('CONTENT' => 'The config options we checked seem OK', 'TYPE' => 'success'); + } else { + foreach ($notice as $n) { + $_SESSION['POPUP'][] = array('CONTENT' => $n, 'TYPE' => 'warning'); + } + foreach ($error as $e) { + $_SESSION['POPUP'][] = array('CONTENT' => $e, 'TYPE' => 'errormsg'); + } + } +} + +?> \ No newline at end of file diff --git a/public/include/autoloader.inc.php b/public/include/autoloader.inc.php index 5bf2652f..6cd887e5 100644 --- a/public/include/autoloader.inc.php +++ b/public/include/autoloader.inc.php @@ -1,7 +1,6 @@ Set a new SECURITY value to continue") : 0; +$defflip = (!cfip()) ? exit(header('HTTP/1.1 401 Unauthorized')) : 1; // SHA/Scrypt check if (empty($config['algorithm']) || $config['algorithm'] == 'scrypt') { @@ -9,9 +8,13 @@ if (empty($config['algorithm']) || $config['algorithm'] == 'scrypt') { } else { $config['target_bits'] = 32; } + // Default classes require_once(CLASS_DIR . '/debug.class.php'); require_once(INCLUDE_DIR . '/lib/KLogger.php'); +if ($config['mysql_filter']) { + require_once(CLASS_DIR . '/strict.class.php'); +} require_once(INCLUDE_DIR . '/database.inc.php'); require_once(INCLUDE_DIR . '/config/memcache_keys.inc.php'); require_once(INCLUDE_DIR . '/config/error_codes.inc.php'); @@ -65,7 +68,4 @@ require_once(CLASS_DIR . '/api.class.php'); require_once(INCLUDE_DIR . '/lib/Michelf/Markdown.php'); require_once(INCLUDE_DIR . '/lib/scrypt.php'); -// Include our versions -require_once(INCLUDE_DIR . '/version.inc.php'); - ?> diff --git a/public/include/bootstrap.php b/public/include/bootstrap.php new file mode 100644 index 00000000..98cf6d55 --- /dev/null +++ b/public/include/bootstrap.php @@ -0,0 +1,28 @@ +Quick Start Guide"; + +// Include our configuration (holding defines for the requires) +if (!include_once(BASEPATH . 'include/config/global.inc.dist.php')) die('Unable to load base global config - '.$quickstartlink); +if (!@include_once(BASEPATH . 'include/config/global.inc.php')) die('Unable to load your global config - '.$quickstartlink); + +// load our security configs +if (!include_once(BASEPATH . 'include/config/security.inc.dist.php')) die('Unable to load base security config - '.$quickstartlink); +if (@file_exists(BASEPATH . 'include/config/security.inc.php')) include_once(BASEPATH . 'include/config/security.inc.php'); + +// Our default template to load, pages can overwrite this later +$master_template = 'master.tpl'; + +// Load Classes, they name defines the $ variable used +// We include all needed files here, even though our templates could load them themself +require_once(INCLUDE_DIR . '/autoloader.inc.php'); + +?> \ No newline at end of file diff --git a/public/include/classes/api.class.php b/public/include/classes/api.class.php index 336ba2bc..be57fbbf 100644 --- a/public/include/classes/api.class.php +++ b/public/include/classes/api.class.php @@ -1,7 +1,5 @@ user = $user; } + public function setSessionManager($session) { + $this->session = $session; + } public function setConfig($config) { $this->config = $config; } diff --git a/public/include/classes/bitcoin.class.php b/public/include/classes/bitcoin.class.php index f1512c70..01b2a71d 100644 --- a/public/include/classes/bitcoin.class.php +++ b/public/include/classes/bitcoin.class.php @@ -1,7 +1,5 @@ setDebug($debug); $csrftoken->setMysql($mysqli); -$csrftoken->setSalt(SALT); -$csrftoken->setSalty(SALTY); +$csrftoken->setSalt($config['SALT']); +$csrftoken->setSalty($config['SALTY']); $csrftoken->setMail($mail); $csrftoken->setUser($user); $csrftoken->setToken($oToken); diff --git a/public/include/classes/debug.class.php b/public/include/classes/debug.class.php index 362a926d..de5c9435 100644 --- a/public/include/classes/debug.class.php +++ b/public/include/classes/debug.class.php @@ -1,8 +1,5 @@ diff --git a/public/include/classes/invitation.class.php b/public/include/classes/invitation.class.php index 40399477..7acbf2ac 100644 --- a/public/include/classes/invitation.class.php +++ b/public/include/classes/invitation.class.php @@ -1,7 +1,5 @@ cache = $memcache; + // set our config options + $userORip = $_SERVER['REMOTE_ADDR'].$_SERVER['HTTP_USER_AGENT']; + // prep stuff we need to check this request + $key_md5 = $config['memcache']['keyprefix'].md5($userORip); + $request_data = $this->cache->get($key_md5); + $now = time(); + $max_req_flush = max(array($config['mc_antidos']['flush_seconds_api'],$config['mc_antidos']['flush_seconds_site'])); + // check the request + if (is_array($request_data)) { + // this request key already exists, update it + $request_data['la'] = $now; + if ($request == 'api') { + $request_data['ha'] += 1; + if ($config['mc_antidos']['ajax_hits_additive']) { + $request_data['hn'] += 1; + } + } else { + $request_data['hn'] += 1; + } + // not rate limited yet, update the rest of the object + if (($request_data['hn'] < $config['mc_antidos']['rate_limit_site']) && ($request_data['ha'] < $config['mc_antidos']['rate_limit_api'])) { + if (((($request_data['hnl'] + $config['mc_antidos']['flush_seconds_site']) <= $now) || ($request_data['hal'] + $config['mc_antidos']['flush_seconds_api']) <= $now) || (($request_data['la'] + $max_req_flush) <= $now)) { + // needs to be flushed & updated + $new = $this->getRequestBase(); + $new['key'] = $key_md5; + $new['la'] = $now; + $new['hal'] = ((($request_data['hal'] + $config['mc_antidos']['flush_seconds_api']) <= $now)) ? $now : 1; + $new['hnl'] = ((($request_data['hnl'] + $config['mc_antidos']['flush_seconds_site']) <= $now)) ? $now : 1; + $this->cache->set($key_md5, $new, $config['memcache']['expiration']); + $this->rate_limit_api_request = ($request_data['ha'] >= $config['mc_antidos']['rate_limit_api']) ? true : false; + $this->rate_limit_site_request = ($request_data['hn'] >= $config['mc_antidos']['rate_limit_site']) ? true : false; + } else { + // no flush, just update + $new = $this->getRequestBase(); + $new['key'] = $request_data['key']; + $new['la'] = time(); + $new['ha'] = $request_data['ha']; + $new['hal'] = $request_data['hal']; + $new['hn'] = $request_data['hn']; + $new['hnl'] = $request_data['hnl']; + $this->cache->set($key_md5, $new, $config['memcache']['expiration']); + $this->rate_limit_api_request = ($request_data['ha'] >= $config['mc_antidos']['rate_limit_api']) ? true : false; + $this->rate_limit_site_request = ($request_data['hn'] >= $config['mc_antidos']['rate_limit_site']) ? true : false; + } + } else { + // too many hits, we should rate limit this + $this->rate_limit_api_request = ($request_data['ha'] >= $config['mc_antidos']['rate_limit_api']) ? true : false; + $this->rate_limit_site_request = ($request_data['hn'] >= $config['mc_antidos']['rate_limit_site']) ? true : false; + } + } else { + // doesn't exist for this request_key, create one + $new = $this->getRequestBase(); + $new['key'] = $config['memcache']['keyprefix'].md5($userORip); + $new['la'] = time(); + if ($request == 'api') { + $new['ha'] += 1; + if ($config['mc_antidos']['ajax_hits_additive']) { + $new['hn'] += 1; + } + } else { + $new['hn'] += 1; + } + $this->cache->set($key_md5, $new, $config['memcache']['expiration']); + $this->rate_limit_api_request = false; + $this->rate_limit_site_request = false; + } + } + public function getRequestBase() { + $new = array('key' => '','la' => 0,'hn' => 0,'hnl' => 0,'ha' => 0,'hal' => 0); + return $new; + } +} + +?> \ No newline at end of file diff --git a/public/include/classes/memcached.class.php b/public/include/classes/memcached.class.php index 2f431337..55a66c67 100644 --- a/public/include/classes/memcached.class.php +++ b/public/include/classes/memcached.class.php @@ -1,7 +1,5 @@ \ No newline at end of file diff --git a/public/include/classes/template.class.php b/public/include/classes/template.class.php index fe03fe7b..b297c528 100644 --- a/public/include/classes/template.class.php +++ b/public/include/classes/template.class.php @@ -1,8 +1,5 @@ fetch_all(MYSQLI_ASSOC); return $this->sqlError(); } + + /** + * Fetch all tokens - used for unit tests + * @param none + * @return array All tokentypes + **/ + public function getAll() { + $stmt = $this->mysqli->prepare("SELECT * FROM $this->table"); + if ($this->checkStmt($stmt) && $stmt->execute() && $result = $stmt->get_result()) + return $result->fetch_all(MYSQLI_ASSOC); + return $this->sqlError(); + } } $tokentype = new Token_Type(); diff --git a/public/include/classes/tools.class.php b/public/include/classes/tools.class.php index 0c573369..e00b370b 100644 --- a/public/include/classes/tools.class.php +++ b/public/include/classes/tools.class.php @@ -1,8 +1,5 @@ getSingle($id, 'loggedIp', 'id'); } + public function getLastLogin($id) { + return $this->getSingle($id, 'last_login', 'id'); + } public function getEmail($email) { return $this->getSingle($email, 'email', 'email', 's'); } @@ -141,9 +141,13 @@ class User extends Base { return false; } if ($this->checkUserPassword($username, $password)) { - $this->updateLoginTimestamp($this->getUserId($username)); - $this->createSession($username); - if ($this->setUserIp($this->getUserId($username), $_SERVER['REMOTE_ADDR'])) { + $uid = $this->getUserId($username); + $lastLoginTime = $this->getLastLogin($uid); + $this->updateLoginTimestamp($uid); + $getIPAddress = $this->getUserIp($uid); + $setIPAddress = $this->setUserIp($uid, $_SERVER['REMOTE_ADDR']); + $this->createSession($username, $getIPAddress, $lastLoginTime); + if ($setIPAddress) { // send a notification if success_login is active $uid = $this->getUserId($username); $notifs = new Notification(); @@ -493,9 +497,12 @@ class User extends Base { * @param username string Username to create session for * @return none **/ - private function createSession($username) { + private function createSession($username, $lastIP='', $lastLoginTime='') { $this->debug->append("STA " . __METHOD__, 4); $this->debug->append("Log in user to _SESSION", 2); + if (!empty($lastIP) && (!empty($lastLoginTime))) { + $_SESSION['last_ip_pop'] = array($lastIP, $lastLoginTime); + } session_regenerate_id(true); $_SESSION['AUTHENTICATED'] = '1'; // $this->user from checkUserPassword @@ -517,7 +524,7 @@ class User extends Base { * @param none * @return true **/ - public function logoutUser($from="") { + public function logoutUser() { $this->debug->append("STA " . __METHOD__, 4); // Unset all of the session variables $_SESSION = array(); @@ -530,10 +537,11 @@ class User extends Base { session_destroy(); // Enforce generation of a new Session ID and delete the old session_regenerate_id(true); + // Enforce a page reload and point towards login with referrer included, if supplied - $port = ($_SERVER["SERVER_PORT"] == "80" or $_SERVER["SERVER_PORT"] == "443") ? "" : (":".$_SERVER["SERVER_PORT"]); - $location = @$_SERVER['HTTPS'] ? 'https://' . $_SERVER['SERVER_NAME'] . $port . $_SERVER['SCRIPT_NAME'] : 'http://' . $_SERVER['SERVER_NAME'] . $port . $_SERVER['SCRIPT_NAME']; - if (!empty($from)) $location .= '?page=login&to=' . urlencode($from); + $port = ($_SERVER["SERVER_PORT"] == "80" || $_SERVER["SERVER_PORT"] == "443") ? "" : (":".$_SERVER["SERVER_PORT"]); + $pushto = $_SERVER['SCRIPT_NAME'].'?page=login'; + $location = (@$_SERVER['HTTPS'] == 'on') ? 'https://' . $_SERVER['SERVER_NAME'] . $port . $pushto : 'http://' . $_SERVER['SERVER_NAME'] . $port . $pushto; // if (!headers_sent()) header('Location: ' . $location); exit(''); } @@ -797,12 +805,12 @@ class User extends Base { * @param none * @return bool **/ - public function isAuthenticated($logout=true) { +public function isAuthenticated($logout=true) { $this->debug->append("STA " . __METHOD__, 4); if (@$_SESSION['AUTHENTICATED'] == true && - !$this->isLocked($_SESSION['USERDATA']['id']) && - $this->getUserIp($_SESSION['USERDATA']['id']) == $_SERVER['REMOTE_ADDR'] - ) return true; + !$this->isLocked($_SESSION['USERDATA']['id']) && + $this->getUserIp($_SESSION['USERDATA']['id']) == $_SERVER['REMOTE_ADDR'] + ) return true; // Catchall if ($logout == true) $this->logoutUser($_SERVER['REQUEST_URI']); return false; @@ -846,7 +854,7 @@ class User extends Base { $user = new User(); $user->setDebug($debug); $user->setMysql($mysqli); -$user->setSalt(SALT); +$user->setSalt($config['SALT']); $user->setSmarty($smarty); $user->setConfig($config); $user->setMail($mail); diff --git a/public/include/classes/worker.class.php b/public/include/classes/worker.class.php index 9076cc3c..b661bd22 100644 --- a/public/include/classes/worker.class.php +++ b/public/include/classes/worker.class.php @@ -1,7 +1,5 @@ getThemes(); diff --git a/public/include/config/error_codes.inc.php b/public/include/config/error_codes.inc.php index 9083cf3d..50c4db24 100644 --- a/public/include/config/error_codes.inc.php +++ b/public/include/config/error_codes.inc.php @@ -1,7 +1,5 @@ + +?> \ No newline at end of file diff --git a/public/include/config/memcache_keys.inc.php b/public/include/config/memcache_keys.inc.php index f9405b0c..1f4e30e7 100644 --- a/public/include/config/memcache_keys.inc.php +++ b/public/include/config/memcache_keys.inc.php @@ -1,7 +1,5 @@ 'error', 'action' => 'ratelimit'); + +/** + * CSRF Protection + * Enable or disable CSRF protection + * https://github.com/MPOS/php-mpos/wiki/Config-Setup#wiki-csrf-protection + */ +$config['csrf']['enabled'] = true; + +/** + * E-mail confirmations for user actions + * Two-factor confirmation for user actions + * https://github.com/MPOS/php-mpos/wiki/Config-Setup#wiki-e-mail-confirmations + */ +$config['twofactor']['enabled'] = true; +$config['twofactor']['options']['details'] = true; +$config['twofactor']['options']['withdraw'] = true; +$config['twofactor']['options']['changepw'] = true; + +/** + * Lock account after X + * Lock accounts after X invalid logins or pins + * https://github.com/MPOS/php-mpos/wiki/Config-Setup#wiki-lock-accounts-after-failed-logins + **/ +$config['maxfailed']['login'] = 3; +$config['maxfailed']['pin'] = 3; + +?> \ No newline at end of file diff --git a/public/include/database.inc.php b/public/include/database.inc.php index edfa8ca5..a65e708b 100644 --- a/public/include/database.inc.php +++ b/public/include/database.inc.php @@ -1,11 +1,12 @@ query('/* MYSQLND_MS_MASTER_SWITCH */SELECT @@global.read_only AS read_only')->fetch_object()->read_only == 1) { @@ -16,4 +17,5 @@ if ($mysqli->query('/* MYSQLND_MS_MASTER_SWITCH */SELECT @@global.read_only AS r if (mysqli_connect_errno()) { die("Failed to connect to database"); } + ?> diff --git a/public/include/pages/about.inc.php b/public/include/pages/about.inc.php index aecab054..ac4117c0 100644 --- a/public/include/pages/about.inc.php +++ b/public/include/pages/about.inc.php @@ -1,8 +1,5 @@ assign("CONTENT", "default.tpl"); diff --git a/public/include/pages/about/api.inc.php b/public/include/pages/about/api.inc.php index d0eb55e7..ac4117c0 100644 --- a/public/include/pages/about/api.inc.php +++ b/public/include/pages/about/api.inc.php @@ -1,7 +1,5 @@ assign("CONTENT", "default.tpl"); diff --git a/public/include/pages/about/donors.inc.php b/public/include/pages/about/donors.inc.php index 0d4213f7..2e20f761 100644 --- a/public/include/pages/about/donors.inc.php +++ b/public/include/pages/about/donors.inc.php @@ -1,7 +1,5 @@ getValue('disable_donors')) { $_SESSION['POPUP'][] = array('CONTENT' => 'Donors are currently disabled. Please try again later.', 'TYPE' => 'errormsg'); diff --git a/public/include/pages/about/pool.inc.php b/public/include/pages/about/pool.inc.php index 20c860f0..0450f7ef 100644 --- a/public/include/pages/about/pool.inc.php +++ b/public/include/pages/about/pool.inc.php @@ -1,8 +1,5 @@ getValue('disable_about')) { $_SESSION['POPUP'][] = array('CONTENT' => 'Donors are currently disabled. Please try again later.', 'TYPE' => 'errormsg'); diff --git a/public/include/pages/about/pplns.inc.php b/public/include/pages/about/pplns.inc.php index aecab054..ac4117c0 100644 --- a/public/include/pages/about/pplns.inc.php +++ b/public/include/pages/about/pplns.inc.php @@ -1,8 +1,5 @@ assign("CONTENT", "default.tpl"); diff --git a/public/include/pages/account.inc.php b/public/include/pages/account.inc.php index 9e43518e..f3ce16c5 100644 --- a/public/include/pages/account.inc.php +++ b/public/include/pages/account.inc.php @@ -1,7 +1,5 @@ isAuthenticated()) { // Tempalte specifics diff --git a/public/include/pages/account/confirm.inc.php b/public/include/pages/account/confirm.inc.php index 829abcb7..6d175281 100644 --- a/public/include/pages/account/confirm.inc.php +++ b/public/include/pages/account/confirm.inc.php @@ -1,7 +1,5 @@ isAuthenticated()) { // 2fa - one last time so we can sync with changes we made during this page -if ($user->isAuthenticated() && $config['twofactor']['enabled']) { +if ($config['twofactor']['enabled'] && $user->isAuthenticated()) { // set the token to be the old token, just in case an error occured $ea_token = (@$oldtoken_ea !== '') ? $oldtoken_ea : @$ea_token; $wf_token = (@$oldtoken_wf !== '') ? $oldtoken_wf : @$wf_token; @@ -178,14 +175,15 @@ if ($user->isAuthenticated() && $config['twofactor']['enabled']) { (!empty($wfprep_sent) && empty($wfprep_edit)) ? $_SESSION['POPUP'][] = array('CONTENT' => $message_tokensent_invalid.$messages_tokensent_status['wf'], 'TYPE' => 'success'):""; (!empty($cpprep_sent) && !empty($cpprep_edit)) ? $_SESSION['POPUP'][] = array('CONTENT' => $cpprep_sent, 'TYPE' => 'success'):""; (!empty($cpprep_sent) && empty($cpprep_edit)) ? $_SESSION['POPUP'][] = array('CONTENT' => $message_tokensent_invalid.$messages_tokensent_status['cp'], 'TYPE' => 'success'):""; + // two-factor stuff + $smarty->assign("CHANGEPASSUNLOCKED", $cp_editable); + $smarty->assign("WITHDRAWUNLOCKED", $wf_editable); + $smarty->assign("DETAILSUNLOCKED", $ea_editable); + $smarty->assign("CHANGEPASSSENT", $cp_sent); + $smarty->assign("WITHDRAWSENT", $wf_sent); + $smarty->assign("DETAILSSENT", $ea_sent); } -// two-factor stuff -$smarty->assign("CHANGEPASSUNLOCKED", $cp_editable); -$smarty->assign("WITHDRAWUNLOCKED", $wf_editable); -$smarty->assign("DETAILSUNLOCKED", $ea_editable); -$smarty->assign("CHANGEPASSSENT", $cp_sent); -$smarty->assign("WITHDRAWSENT", $wf_sent); -$smarty->assign("DETAILSSENT", $ea_sent); + $smarty->assign("DONATE_THRESHOLD", $config['donate_threshold']); // Tempalte specifics diff --git a/public/include/pages/account/invitations.inc.php b/public/include/pages/account/invitations.inc.php index 0ceb15a8..4020cfd1 100644 --- a/public/include/pages/account/invitations.inc.php +++ b/public/include/pages/account/invitations.inc.php @@ -1,7 +1,5 @@ isAuthenticated()) { if (!$setting->getValue('disable_invitations')) { diff --git a/public/include/pages/account/notifications.inc.php b/public/include/pages/account/notifications.inc.php index 0d0fe7e4..4b180f02 100644 --- a/public/include/pages/account/notifications.inc.php +++ b/public/include/pages/account/notifications.inc.php @@ -1,7 +1,6 @@ isAuthenticated()) { if ($setting->getValue('disable_notifications') == 1) { $_SESSION['POPUP'][] = array('CONTENT' => 'Notification system disabled by admin.', 'TYPE' => 'info'); diff --git a/public/include/pages/account/qrcode.inc.php b/public/include/pages/account/qrcode.inc.php index a6543dc5..3171ded7 100644 --- a/public/include/pages/account/qrcode.inc.php +++ b/public/include/pages/account/qrcode.inc.php @@ -1,6 +1,5 @@ isAuthenticated()) $smarty->assign("CONTENT", "default.tpl"); ?> diff --git a/public/include/pages/account/reset_failed.inc.php b/public/include/pages/account/reset_failed.inc.php index 9f19b030..0df25c06 100644 --- a/public/include/pages/account/reset_failed.inc.php +++ b/public/include/pages/account/reset_failed.inc.php @@ -1,7 +1,5 @@ isAuthenticated()) { // Reset failed login counter diff --git a/public/include/pages/account/transactions.inc.php b/public/include/pages/account/transactions.inc.php index 72534881..4509b399 100644 --- a/public/include/pages/account/transactions.inc.php +++ b/public/include/pages/account/transactions.inc.php @@ -1,7 +1,6 @@ isAuthenticated()) { $iLimit = 30; empty($_REQUEST['start']) ? $start = 0 : $start = $_REQUEST['start']; diff --git a/public/include/pages/account/unlock.inc.php b/public/include/pages/account/unlock.inc.php index b9d5763b..71c400d1 100644 --- a/public/include/pages/account/unlock.inc.php +++ b/public/include/pages/account/unlock.inc.php @@ -1,7 +1,5 @@ isAuthenticated()) { switch (@$_REQUEST['do']) { case 'delete': - if (!$config['csrf']['enabled'] || $config['csrf']['enabled'] && $csrftoken->valid) { - if ($worker->deleteWorker($_SESSION['USERDATA']['id'], $_GET['id'])) { - $_SESSION['POPUP'][] = array('CONTENT' => 'Worker removed', 'TYPE' => 'success'); - } else { - $_SESSION['POPUP'][] = array('CONTENT' => $worker->getError(), 'TYPE' => 'errormsg'); - } + if ($worker->deleteWorker($_SESSION['USERDATA']['id'], $_GET['id'])) { + $_SESSION['POPUP'][] = array('CONTENT' => 'Worker removed', 'TYPE' => 'success'); } else { - $_SESSION['POPUP'][] = array('CONTENT' => $csrftoken->getErrorWithDescriptionHTML(), 'TYPE' => 'info'); + $_SESSION['POPUP'][] = array('CONTENT' => $worker->getError(), 'TYPE' => 'errormsg'); } break; diff --git a/public/include/pages/admin.inc.php b/public/include/pages/admin.inc.php index 40abecde..b5067a9f 100644 --- a/public/include/pages/admin.inc.php +++ b/public/include/pages/admin.inc.php @@ -1,7 +1,5 @@ isAuthenticated() || !$user->isAdmin($_SESSION['USERDATA']['id'])) { diff --git a/public/include/pages/admin/dashboard.inc.php b/public/include/pages/admin/dashboard.inc.php index d5de5f7b..572914f9 100644 --- a/public/include/pages/admin/dashboard.inc.php +++ b/public/include/pages/admin/dashboard.inc.php @@ -1,7 +1,5 @@ isAuthenticated() || !$user->isAdmin($_SESSION['USERDATA']['id'])) { diff --git a/public/include/pages/admin/monitoring.inc.php b/public/include/pages/admin/monitoring.inc.php index 08efaee4..e720f776 100644 --- a/public/include/pages/admin/monitoring.inc.php +++ b/public/include/pages/admin/monitoring.inc.php @@ -1,7 +1,5 @@ isAuthenticated() || !$user->isAdmin($_SESSION['USERDATA']['id'])) { diff --git a/public/include/pages/admin/news.inc.php b/public/include/pages/admin/news.inc.php index df0bb2fc..36734294 100644 --- a/public/include/pages/admin/news.inc.php +++ b/public/include/pages/admin/news.inc.php @@ -1,7 +1,5 @@ isAuthenticated() || !$user->isAdmin($_SESSION['USERDATA']['id'])) { diff --git a/public/include/pages/admin/news_edit.inc.php b/public/include/pages/admin/news_edit.inc.php index 81cfcb56..8549533b 100644 --- a/public/include/pages/admin/news_edit.inc.php +++ b/public/include/pages/admin/news_edit.inc.php @@ -1,7 +1,5 @@ isAuthenticated() || !$user->isAdmin($_SESSION['USERDATA']['id'])) { diff --git a/public/include/pages/admin/poolworkers.inc.php b/public/include/pages/admin/poolworkers.inc.php index 814d6c07..24cb675c 100644 --- a/public/include/pages/admin/poolworkers.inc.php +++ b/public/include/pages/admin/poolworkers.inc.php @@ -1,6 +1,5 @@ isAuthenticated() || !$user->isAdmin($_SESSION['USERDATA']['id'])) { diff --git a/public/include/pages/admin/reports.inc.php b/public/include/pages/admin/reports.inc.php index 5225461c..3139234c 100644 --- a/public/include/pages/admin/reports.inc.php +++ b/public/include/pages/admin/reports.inc.php @@ -1,7 +1,5 @@ isAuthenticated() || !$user->isAdmin($_SESSION['USERDATA']['id'])) { diff --git a/public/include/pages/admin/settings.inc.php b/public/include/pages/admin/settings.inc.php index fe9bc380..6fb477ea 100644 --- a/public/include/pages/admin/settings.inc.php +++ b/public/include/pages/admin/settings.inc.php @@ -1,7 +1,5 @@ isAuthenticated() || !$user->isAdmin($_SESSION['USERDATA']['id'])) { diff --git a/public/include/pages/admin/templates.inc.php b/public/include/pages/admin/templates.inc.php index b3c101ea..8f67611d 100644 --- a/public/include/pages/admin/templates.inc.php +++ b/public/include/pages/admin/templates.inc.php @@ -1,7 +1,5 @@ isAuthenticated() || !$user->isAdmin($_SESSION['USERDATA']['id'])) { diff --git a/public/include/pages/admin/transactions.inc.php b/public/include/pages/admin/transactions.inc.php index 7e95092e..37afac7b 100644 --- a/public/include/pages/admin/transactions.inc.php +++ b/public/include/pages/admin/transactions.inc.php @@ -1,7 +1,5 @@ isAuthenticated() || !$user->isAdmin($_SESSION['USERDATA']['id'])) { diff --git a/public/include/pages/admin/user.inc.php b/public/include/pages/admin/user.inc.php index 955d9cd8..5971dc9a 100644 --- a/public/include/pages/admin/user.inc.php +++ b/public/include/pages/admin/user.inc.php @@ -1,7 +1,5 @@ isAuthenticated() || !$user->isAdmin($_SESSION['USERDATA']['id'])) { diff --git a/public/include/pages/admin/wallet.inc.php b/public/include/pages/admin/wallet.inc.php index c7e821c8..909d05ef 100644 --- a/public/include/pages/admin/wallet.inc.php +++ b/public/include/pages/admin/wallet.inc.php @@ -1,7 +1,5 @@ isAuthenticated() || !$user->isAdmin($_SESSION['USERDATA']['id'])) { diff --git a/public/include/pages/api.inc.php b/public/include/pages/api.inc.php index c85ada42..01cd20f5 100644 --- a/public/include/pages/api.inc.php +++ b/public/include/pages/api.inc.php @@ -1,7 +1,5 @@ isActive(); diff --git a/public/include/pages/api/getblockcount.inc.php b/public/include/pages/api/getblockcount.inc.php index 978a7142..5000afdd 100644 --- a/public/include/pages/api/getblockcount.inc.php +++ b/public/include/pages/api/getblockcount.inc.php @@ -1,7 +1,5 @@ isActive(); diff --git a/public/include/pages/api/getblocksfound.inc.php b/public/include/pages/api/getblocksfound.inc.php index de2918f6..d280b266 100644 --- a/public/include/pages/api/getblocksfound.inc.php +++ b/public/include/pages/api/getblocksfound.inc.php @@ -1,7 +1,5 @@ isActive(); diff --git a/public/include/pages/api/getblockstats.inc.php b/public/include/pages/api/getblockstats.inc.php index 9d6200d5..725ad628 100644 --- a/public/include/pages/api/getblockstats.inc.php +++ b/public/include/pages/api/getblockstats.inc.php @@ -1,7 +1,5 @@ isActive(); diff --git a/public/include/pages/api/getcronjobstatus.inc.php b/public/include/pages/api/getcronjobstatus.inc.php index 8dab4f09..b932b8dd 100644 --- a/public/include/pages/api/getcronjobstatus.inc.php +++ b/public/include/pages/api/getcronjobstatus.inc.php @@ -1,7 +1,5 @@ isActive(); diff --git a/public/include/pages/api/getcurrentworkers.inc.php b/public/include/pages/api/getcurrentworkers.inc.php index 837b75ef..4b142822 100644 --- a/public/include/pages/api/getcurrentworkers.inc.php +++ b/public/include/pages/api/getcurrentworkers.inc.php @@ -1,7 +1,5 @@ isActive(); diff --git a/public/include/pages/api/getdashboarddata.inc.php b/public/include/pages/api/getdashboarddata.inc.php index b5a73801..9f7c6844 100644 --- a/public/include/pages/api/getdashboarddata.inc.php +++ b/public/include/pages/api/getdashboarddata.inc.php @@ -1,7 +1,5 @@ getValue('disable_dashboard_api')) { diff --git a/public/include/pages/api/getdifficulty.inc.php b/public/include/pages/api/getdifficulty.inc.php index 95805548..7cc88766 100644 --- a/public/include/pages/api/getdifficulty.inc.php +++ b/public/include/pages/api/getdifficulty.inc.php @@ -1,7 +1,5 @@ isActive(); diff --git a/public/include/pages/api/getestimatedtime.inc.php b/public/include/pages/api/getestimatedtime.inc.php index 91ed811d..5d529545 100644 --- a/public/include/pages/api/getestimatedtime.inc.php +++ b/public/include/pages/api/getestimatedtime.inc.php @@ -1,7 +1,5 @@ isActive(); diff --git a/public/include/pages/api/gethourlyhashrates.inc.php b/public/include/pages/api/gethourlyhashrates.inc.php index d9dfea0a..c6c7f670 100644 --- a/public/include/pages/api/gethourlyhashrates.inc.php +++ b/public/include/pages/api/gethourlyhashrates.inc.php @@ -1,7 +1,5 @@ isActive(); diff --git a/public/include/pages/api/getnavbardata.inc.php b/public/include/pages/api/getnavbardata.inc.php index a412f984..f043a7c1 100644 --- a/public/include/pages/api/getnavbardata.inc.php +++ b/public/include/pages/api/getnavbardata.inc.php @@ -1,7 +1,5 @@ getValue('disable_navbar_api')) { diff --git a/public/include/pages/api/getpoolhashrate.inc.php b/public/include/pages/api/getpoolhashrate.inc.php index a5985d44..bb6fe8ea 100644 --- a/public/include/pages/api/getpoolhashrate.inc.php +++ b/public/include/pages/api/getpoolhashrate.inc.php @@ -1,7 +1,5 @@ isActive(); diff --git a/public/include/pages/api/getpoolinfo.inc.php b/public/include/pages/api/getpoolinfo.inc.php index 66d87004..217a2224 100644 --- a/public/include/pages/api/getpoolinfo.inc.php +++ b/public/include/pages/api/getpoolinfo.inc.php @@ -1,7 +1,5 @@ isActive(); diff --git a/public/include/pages/api/getpoolsharerate.inc.php b/public/include/pages/api/getpoolsharerate.inc.php index a55654be..8b8977e5 100644 --- a/public/include/pages/api/getpoolsharerate.inc.php +++ b/public/include/pages/api/getpoolsharerate.inc.php @@ -1,7 +1,5 @@ isActive(); diff --git a/public/include/pages/api/getpoolstatus.inc.php b/public/include/pages/api/getpoolstatus.inc.php index ea053dcb..a364a45b 100644 --- a/public/include/pages/api/getpoolstatus.inc.php +++ b/public/include/pages/api/getpoolstatus.inc.php @@ -1,7 +1,5 @@ isActive(); diff --git a/public/include/pages/api/gettimesincelastblock.inc.php b/public/include/pages/api/gettimesincelastblock.inc.php index c0de01f8..e586beac 100644 --- a/public/include/pages/api/gettimesincelastblock.inc.php +++ b/public/include/pages/api/gettimesincelastblock.inc.php @@ -1,7 +1,5 @@ isActive(); diff --git a/public/include/pages/api/gettopcontributors.inc.php b/public/include/pages/api/gettopcontributors.inc.php index 0b22faee..e5bc7e6f 100644 --- a/public/include/pages/api/gettopcontributors.inc.php +++ b/public/include/pages/api/gettopcontributors.inc.php @@ -1,7 +1,5 @@ checkAccess($user->checkApiKey($_REQUEST['api_key']), @$_REQUEST['id']); diff --git a/public/include/pages/api/getuserbalance.inc.php b/public/include/pages/api/getuserbalance.inc.php index d91c6865..e46901bb 100644 --- a/public/include/pages/api/getuserbalance.inc.php +++ b/public/include/pages/api/getuserbalance.inc.php @@ -1,7 +1,5 @@ isActive(); diff --git a/public/include/pages/api/getuserhashrate.inc.php b/public/include/pages/api/getuserhashrate.inc.php index 1b1d5250..13f61a8c 100644 --- a/public/include/pages/api/getuserhashrate.inc.php +++ b/public/include/pages/api/getuserhashrate.inc.php @@ -1,7 +1,5 @@ isActive(); diff --git a/public/include/pages/api/getusersharerate.inc.php b/public/include/pages/api/getusersharerate.inc.php index c1edb01e..86b3c762 100644 --- a/public/include/pages/api/getusersharerate.inc.php +++ b/public/include/pages/api/getusersharerate.inc.php @@ -1,7 +1,5 @@ isActive(); diff --git a/public/include/pages/api/getuserstatus.inc.php b/public/include/pages/api/getuserstatus.inc.php index c17bb77f..df514c9a 100644 --- a/public/include/pages/api/getuserstatus.inc.php +++ b/public/include/pages/api/getuserstatus.inc.php @@ -1,7 +1,5 @@ isActive(); diff --git a/public/include/pages/api/getusertransactions.inc.php b/public/include/pages/api/getusertransactions.inc.php index 08517d2d..403ff929 100644 --- a/public/include/pages/api/getusertransactions.inc.php +++ b/public/include/pages/api/getusertransactions.inc.php @@ -1,7 +1,5 @@ isActive(); diff --git a/public/include/pages/api/getuserworkers.inc.php b/public/include/pages/api/getuserworkers.inc.php index 089e227d..69a8122a 100644 --- a/public/include/pages/api/getuserworkers.inc.php +++ b/public/include/pages/api/getuserworkers.inc.php @@ -1,7 +1,5 @@ isActive(); diff --git a/public/include/pages/api/public.inc.php b/public/include/pages/api/public.inc.php index f465d1a8..c6b128d6 100644 --- a/public/include/pages/api/public.inc.php +++ b/public/include/pages/api/public.inc.php @@ -1,7 +1,5 @@ isActive(); diff --git a/public/include/pages/contactform.inc.php b/public/include/pages/contactform.inc.php index b961cfb2..fdbf26da 100644 --- a/public/include/pages/contactform.inc.php +++ b/public/include/pages/contactform.inc.php @@ -1,7 +1,5 @@ getValue('disable_contactform')) { $_SESSION['POPUP'][] = array('CONTENT' => 'Contactform is currently disabled. Please try again later.', 'TYPE' => 'errormsg'); diff --git a/public/include/pages/contactform/contactform.inc.php b/public/include/pages/contactform/contactform.inc.php index 19916321..f0aa6f9f 100644 --- a/public/include/pages/contactform/contactform.inc.php +++ b/public/include/pages/contactform/contactform.inc.php @@ -1,7 +1,5 @@ getValue('recaptcha_enabled')) { // Load re-captcha specific data diff --git a/public/include/pages/dashboard.inc.php b/public/include/pages/dashboard.inc.php index f835f6e7..7047cfb8 100644 --- a/public/include/pages/dashboard.inc.php +++ b/public/include/pages/dashboard.inc.php @@ -1,7 +1,5 @@ isAuthenticated()) { if (! $interval = $setting->getValue('statistics_ajax_data_interval')) $interval = 300; diff --git a/public/include/pages/error.inc.php b/public/include/pages/error.inc.php index aecab054..ac4117c0 100644 --- a/public/include/pages/error.inc.php +++ b/public/include/pages/error.inc.php @@ -1,8 +1,5 @@ assign("CONTENT", "default.tpl"); diff --git a/public/include/pages/error/404.inc.php b/public/include/pages/error/404.inc.php index aecab054..ac4117c0 100644 --- a/public/include/pages/error/404.inc.php +++ b/public/include/pages/error/404.inc.php @@ -1,8 +1,5 @@ assign("CONTENT", "default.tpl"); diff --git a/public/include/pages/error/ratelimit.inc.php b/public/include/pages/error/ratelimit.inc.php new file mode 100644 index 00000000..89cd2920 --- /dev/null +++ b/public/include/pages/error/ratelimit.inc.php @@ -0,0 +1,6 @@ +assign("CONTENT", "default.tpl"); +?> \ No newline at end of file diff --git a/public/include/pages/gettingstarted.inc.php b/public/include/pages/gettingstarted.inc.php index e7de19b8..b6f63bc7 100644 --- a/public/include/pages/gettingstarted.inc.php +++ b/public/include/pages/gettingstarted.inc.php @@ -1,8 +1,5 @@ assign("SITESTRATUMURL", $config['gettingstarted']['stratumurl']); $smarty->assign("SITESTRATUMPORT", $config['gettingstarted']['stratumport']); diff --git a/public/include/pages/home.inc.php b/public/include/pages/home.inc.php index 99c01c04..72a29af7 100644 --- a/public/include/pages/home.inc.php +++ b/public/include/pages/home.inc.php @@ -1,7 +1,5 @@ getValue('recaptcha_enabled') && $setting->getValue('recaptcha_enabled_logins')) { @@ -26,10 +24,12 @@ if ($setting->getValue('maintenance') && !$user->isAdmin($user->getUserIdByEmail // Check if recaptcha is enabled, process form data if valid if (!$setting->getValue('recaptcha_enabled') || !$setting->getValue('recaptcha_enabled_logins') || ($setting->getValue('recaptcha_enabled') && $setting->getValue('recaptcha_enabled_logins') && $rsp->is_valid)) { if (!$config['csrf']['enabled'] || $config['csrf']['enabled'] && $csrftoken->valid) { + // check if login is correct if ($user->checkLogin(@$_POST['username'], @$_POST['password']) ) { - $port = ($_SERVER["SERVER_PORT"] == "80" or $_SERVER["SERVER_PORT"] == "443") ? "" : (":".$_SERVER["SERVER_PORT"]); - $location = @$_SERVER['HTTPS'] ? 'https://' : 'http://'; - $location .= $_SERVER['SERVER_NAME'] . $port . $_SERVER['SCRIPT_NAME'] . '?page=dashboard'; + $port = ($_SERVER["SERVER_PORT"] == "80" || $_SERVER["SERVER_PORT"] == "443") ? "" : (":".$_SERVER["SERVER_PORT"]); + $location = (@$_SERVER['HTTPS'] == "on") ? 'https://' : 'http://'; + $location .= $_SERVER['SERVER_NAME'] . $port . $_SERVER['SCRIPT_NAME']; + $location.= '?page=dashboard'; if (!headers_sent()) header('Location: ' . $location); exit(''); } else { @@ -42,7 +42,7 @@ if ($setting->getValue('maintenance') && !$user->isAdmin($user->getUserIdByEmail $_SESSION['POPUP'][] = array('CONTENT' => 'Invalid Captcha, please try again.', 'TYPE' => 'errormsg'); } } - // Load login template $smarty->assign('CONTENT', 'default.tpl'); + ?> diff --git a/public/include/pages/logout.inc.php b/public/include/pages/logout.inc.php index 30425851..9b6e12a6 100644 --- a/public/include/pages/logout.inc.php +++ b/public/include/pages/logout.inc.php @@ -1,10 +1,7 @@ logoutUser(); + $smarty->assign("CONTENT", "default.tpl"); ?> diff --git a/public/include/pages/news.inc.php b/public/include/pages/news.inc.php index 6e7a90c7..51630e9b 100644 --- a/public/include/pages/news.inc.php +++ b/public/include/pages/news.inc.php @@ -1,7 +1,5 @@ assign("CONTENT", "default.tpl"); diff --git a/public/include/pages/password/change.inc.php b/public/include/pages/password/change.inc.php index f622363b..938ed51b 100644 --- a/public/include/pages/password/change.inc.php +++ b/public/include/pages/password/change.inc.php @@ -1,8 +1,5 @@ valid) { if (isset($_POST['do']) && $_POST['do'] == 'resetPassword') { diff --git a/public/include/pages/password/reset.inc.php b/public/include/pages/password/reset.inc.php index 0fa2303d..c06c21b6 100644 --- a/public/include/pages/password/reset.inc.php +++ b/public/include/pages/password/reset.inc.php @@ -1,7 +1,5 @@ valid) { diff --git a/public/include/pages/register.inc.php b/public/include/pages/register.inc.php index 15d077fe..da9ec064 100644 --- a/public/include/pages/register.inc.php +++ b/public/include/pages/register.inc.php @@ -1,7 +1,5 @@ getValue('lock_registration') && $setting->getValue('disable_invitations')) { $_SESSION['POPUP'][] = array('CONTENT' => 'Account registration is currently disabled. Please try again later.', 'TYPE' => 'errormsg'); diff --git a/public/include/pages/register/register.inc.php b/public/include/pages/register/register.inc.php index 9f2ad8b6..31afe78d 100644 --- a/public/include/pages/register/register.inc.php +++ b/public/include/pages/register/register.inc.php @@ -1,6 +1,5 @@ getValue('recaptcha_enabled') && $setting->getValue('recaptcha_enabled_registrations')) { diff --git a/public/include/pages/statistics.inc.php b/public/include/pages/statistics.inc.php index 3f63e870..ca100ea4 100644 --- a/public/include/pages/statistics.inc.php +++ b/public/include/pages/statistics.inc.php @@ -1,8 +1,5 @@ isCached('master.tpl', $smarty_cache_key)) { $debug->append('No cached version available, fetching from backend', 3); diff --git a/public/include/pages/statistics/blockfinder.inc.php b/public/include/pages/statistics/blockfinder.inc.php index f471afdf..6773e920 100644 --- a/public/include/pages/statistics/blockfinder.inc.php +++ b/public/include/pages/statistics/blockfinder.inc.php @@ -1,7 +1,5 @@ isCached('master.tpl', $smarty_cache_key)) { diff --git a/public/include/pages/statistics/blocks.inc.php b/public/include/pages/statistics/blocks.inc.php index 12f034c0..fb580b8f 100644 --- a/public/include/pages/statistics/blocks.inc.php +++ b/public/include/pages/statistics/blocks.inc.php @@ -1,7 +1,5 @@ isCached('master.tpl', $smarty_cache_key)) { diff --git a/public/include/pages/statistics/graphs.inc.php b/public/include/pages/statistics/graphs.inc.php index 575ce36d..f574c1fc 100644 --- a/public/include/pages/statistics/graphs.inc.php +++ b/public/include/pages/statistics/graphs.inc.php @@ -1,7 +1,5 @@ isCached('master.tpl', $smarty_cache_key)) { $debug->append('No cached version available, fetching from backend', 3); diff --git a/public/include/pages/statistics/pool.inc.php b/public/include/pages/statistics/pool.inc.php index ae42aebc..84fb3546 100644 --- a/public/include/pages/statistics/pool.inc.php +++ b/public/include/pages/statistics/pool.inc.php @@ -1,7 +1,5 @@ can_connect() === true){ diff --git a/public/include/pages/statistics/round.inc.php b/public/include/pages/statistics/round.inc.php index 4e7288d5..064dd3ee 100644 --- a/public/include/pages/statistics/round.inc.php +++ b/public/include/pages/statistics/round.inc.php @@ -1,7 +1,5 @@ isCached('master.tpl', $smarty_cache_key)) { $debug->append('No cached version available, fetching from backend', 3); diff --git a/public/include/pages/statistics/uptime.inc.php b/public/include/pages/statistics/uptime.inc.php index 81a12799..253ab76c 100644 --- a/public/include/pages/statistics/uptime.inc.php +++ b/public/include/pages/statistics/uptime.inc.php @@ -1,7 +1,5 @@ isCached('master.tpl', $smarty_cache_key)) { $debug->append('No cached version available, fetching from backend', 3); diff --git a/public/include/pages/tac.inc.php b/public/include/pages/tac.inc.php index de4542b1..cdd3e92d 100644 --- a/public/include/pages/tac.inc.php +++ b/public/include/pages/tac.inc.php @@ -1,6 +1,5 @@ assign("CONTENT", "default.tpl"); ?> diff --git a/public/include/pages/tacpop.inc.php b/public/include/pages/tacpop.inc.php index 86087ec0..16ae6777 100644 --- a/public/include/pages/tacpop.inc.php +++ b/public/include/pages/tacpop.inc.php @@ -1,6 +1,5 @@ diff --git a/public/include/smarty.inc.php b/public/include/smarty.inc.php index ba549af6..b3aa8e7b 100644 --- a/public/include/smarty.inc.php +++ b/public/include/smarty.inc.php @@ -1,8 +1,5 @@ append('Loading Smarty libraries', 2); define('SMARTY_DIR', INCLUDE_DIR . '/smarty/libs/'); diff --git a/public/include/smarty_globals.inc.php b/public/include/smarty_globals.inc.php index 87dc64e2..b18e5bb4 100644 --- a/public/include/smarty_globals.inc.php +++ b/public/include/smarty_globals.inc.php @@ -1,7 +1,5 @@ append('Global smarty variables', 3); @@ -172,7 +170,7 @@ if ($motd = $setting->getValue('system_motd')) $_SESSION['POPUP'][] = array('CONTENT' => $motd, 'TYPE' => 'info'); // So we can display additional info -$smarty->assign('DEBUG', DEBUG); +$smarty->assign('DEBUG', $config['DEBUG']); // Make it available in Smarty $smarty->assign('PATH', 'site_assets/' . THEME); diff --git a/public/include/version.inc.php b/public/include/version.inc.php index f1fbcf4b..c6204c76 100644 --- a/public/include/version.inc.php +++ b/public/include/version.inc.php @@ -1,22 +1,17 @@ getValue('DB_VERSION'); if ($db_version != DB_VERSION) { // Notify admins via error popup - if (isset($_SESSION['USERDATA']) && $user->isAdmin($_SESSION['USERDATA']['id'])) - $_SESSION['POPUP'][] = array('CONTENT' => 'Database version mismatch (Installed: ' . $db_version . ', Current: ' . DB_VERSION . '). Database update required, please import any new SQL files. Cronjobs have been halted.', 'TYPE' => 'errormsg'); + $_SESSION['POPUP'][] = array('CONTENT' => 'Database version mismatch (Installed: ' . $db_version . ', Current: ' . DB_VERSION . '). Database update required, please import any new SQL files. Cronjobs have been halted.', 'TYPE' => 'errormsg'); } - -if (@$config['version'] != CONFIG_VERSION) { +if (@$config['version'] !== CONFIG_VERSION) { // Notify admins via error popup - if (isset($_SESSION['USERDATA']) && $user->isAdmin($_SESSION['USERDATA']['id'])) - $_SESSION['POPUP'][] = array('CONTENT' => 'Configuration file version mismatch (Installed: ' . @$config['version'] . ', Current: ' . CONFIG_VERSION . '). Configuration update required, please check dist config for changes. Cronjobs have been halted.', 'TYPE' => 'errormsg'); + $_SESSION['POPUP'][] = array('CONTENT' => 'Configuration file version mismatch (Installed: ' . @$config['version'] . ', Current: ' . CONFIG_VERSION . '). Configuration update required, please check dist config for changes. Cronjobs have been halted.', 'TYPE' => 'errormsg'); } diff --git a/public/index.php b/public/index.php index 0c1fbd09..811b9b05 100644 --- a/public/index.php +++ b/public/index.php @@ -1,5 +1,4 @@ addServer($config['memcache']['host'], $config['memcache']['port']); +} + +if ($config['memcache']['enabled'] && $config['mc_antidos']['enabled']) { + require_once(CLASS_DIR . '/memcache_ad.class.php'); +} -// Start a session -session_set_cookie_params(time()+$config['cookie']['duration'], $config['cookie']['path'], $config['cookie']['domain'], $config['cookie']['secure'], $config['cookie']['httponly']); $session_start = @session_start(); +session_set_cookie_params(time()+$config['cookie']['duration'], $config['cookie']['path'], $config['cookie']['domain'], $config['cookie']['secure'], $config['cookie']['httponly']); if (!$session_start) { session_destroy(); session_regenerate_id(true); @@ -44,9 +65,69 @@ if (!$session_start) { } @setcookie(session_name(), session_id(), time()+$config['cookie']['duration'], $config['cookie']['path'], $config['cookie']['domain'], $config['cookie']['secure'], $config['cookie']['httponly']); -// Load Classes, they name defines the $ variable used -// We include all needed files here, even though our templates could load them themself -require_once(INCLUDE_DIR . '/autoloader.inc.php'); +// Rate limiting +if ($config['memcache']['enabled'] && $config['mc_antidos']['enabled']) { + $skip_check = false; + // if this is an api call we need to be careful not to time them out for those calls separately + $per_page = ''; + $ajax_calls = array( + array('api', 'getuserbalance'), + array('api', 'getnavbardata'), + array('api', 'getdashboarddata'), + array('api', 'getuserworkers') + ); + $iac = 0; + foreach ($ajax_calls as $ac) { + $iac = (@$_REQUEST['page'] == $ac[0] && @$_REQUEST['action'] == $ac[1]) ? $iac+=1 : $iac; + } + $is_ajax_call = ($iac > 0) ? true : false; + if ($is_ajax_call && $config['mc_antidos']['protect_ajax']) { + $per_page = 'api'; + } else if ($is_ajax_call && !$config['mc_antidos']['protect_ajax']) { + // protect isn't on, we'll ignore it + $skip_check = true; + } else if ($config['mc_antidos']['ignore_admins'] && isset($_SESSION['USERDATA']['is_admin']) && $_SESSION['USERDATA']['is_admin']) { + $skip_check = true; + } + if (!$skip_check) { + $mcad = new MemcacheAntiDos($config, $memcache, $per_page); + if ($config['mc_antidos']['protect_ajax'] && $is_ajax_call && $mcad->rate_limit_api_request) { + exit(header('HTTP/1.1 401 Unauthorized')); + } + $error_page = $config['mc_antidos']['error_push_page']; + if ($mcad->rate_limit_site_request) { + if (!is_array($error_page) || count($error_page) < 1 || (empty($error_page['page']) && empty($error_page['action']))) { + die("You are sending too many requests too fast!"); + } else { + $_REQUEST['page'] = $error_page['page']; + $_REQUEST['action'] = (isset($error_page['action']) && !empty($error_page['action'])) ? $error_page['action'] : $_REQUEST['action']; + } + } + } +} + +// Got past rate limiter and session manager +// show last logged in popup if it's still set +if (@$_GET['clp'] == 1 && @$_SESSION['last_ip_pop']) unset($_SESSION['last_ip_pop']); +if (count(@$_SESSION['last_ip_pop']) == 2) { + $data = $_SESSION['last_ip_pop']; + $ip = filter_var($data[0], FILTER_VALIDATE_IP); + $time = date("l, F jS \a\\t g:i a", $data[1]); + $closelink = "Close"; + if (@$_SESSION['AUTHENTICATED'] && $_SESSION['last_ip_pop'][0] !== $_SERVER['REMOTE_ADDR']) { + $_SESSION['POPUP'][] = array('CONTENT' => "You last logged in from $ip on $time $closelink", 'TYPE' => 'warning'); + } else { + $_SESSION['POPUP'][] = array('CONTENT' => "You last logged in from $ip on $time $closelink", 'TYPE' => 'info'); + } +} + +// version check and config check if not disabled +if (@$_SESSION['USERDATA']['is_admin'] && $user->isAdmin(@$_SESSION['USERDATA']['id'])) { + require_once(INCLUDE_DIR . '/version.inc.php'); + if (!@$config['skip_config_tests']) { + require_once(INCLUDE_DIR . '/admin_checks.php'); + } +} // Create our pages array from existing files if (is_dir(INCLUDE_DIR . '/pages/')) { @@ -83,7 +164,7 @@ $action = (isset($_REQUEST['action']) && !is_array($_REQUEST['action'])) && isse // Check csrf token validity if necessary if ($config['csrf']['enabled'] && isset($_POST['ctoken']) && !empty($_POST['ctoken']) && !is_array($_POST['ctoken'])) { $csrftoken->valid = ($csrftoken->checkBasic($user->getCurrentIP(), $arrPages[$page], $_POST['ctoken'])) ? 1 : 0; -} else if ($config['csrf']['enabled'] && (!@$_POST['ctoken'] || empty($_POST['ctoken']) || is_array($_POST['ctoken']))) { +} else if ($config['csrf']['enabled'] && (!@$_POST['ctoken'] || empty($_POST['ctoken']))) { $csrftoken->valid = 0; } if ($config['csrf']['enabled']) $smarty->assign('CTOKEN', $csrftoken->getBasic($user->getCurrentIP(), $arrPages[$page])); diff --git a/public/templates/mobile/login/default.tpl b/public/templates/mobile/login/default.tpl index 42df1902..d179f023 100644 --- a/public/templates/mobile/login/default.tpl +++ b/public/templates/mobile/login/default.tpl @@ -1,5 +1,4 @@
-

diff --git a/public/templates/mpos/error/ratelimit/default.tpl b/public/templates/mpos/error/ratelimit/default.tpl new file mode 100644 index 00000000..7ab5c72b --- /dev/null +++ b/public/templates/mpos/error/ratelimit/default.tpl @@ -0,0 +1,6 @@ +
+

Request rate limit exceeded

+
+

You're sending too many requests too fast!

+
+
\ No newline at end of file diff --git a/public/templates/mpos/login/default.tpl b/public/templates/mpos/login/default.tpl index b9c8ef56..b407e2a1 100644 --- a/public/templates/mpos/login/default.tpl +++ b/public/templates/mpos/login/default.tpl @@ -1,6 +1,5 @@
-

Login with existing account

diff --git a/public/templates/mpos/login/small.tpl b/public/templates/mpos/login/small.tpl index 7ed9b55c..32b61fe5 100644 --- a/public/templates/mpos/login/small.tpl +++ b/public/templates/mpos/login/small.tpl @@ -3,7 +3,6 @@ - diff --git a/tests/bootstrap.php b/tests/bootstrap.php new file mode 100644 index 00000000..b11e7c48 --- /dev/null +++ b/tests/bootstrap.php @@ -0,0 +1,38 @@ + \ No newline at end of file diff --git a/tests/config.dist.php b/tests/config.dist.php new file mode 100644 index 00000000..21da7475 --- /dev/null +++ b/tests/config.dist.php @@ -0,0 +1,10 @@ + \ No newline at end of file diff --git a/tests/config.php b/tests/config.php new file mode 100644 index 00000000..82f2ef67 --- /dev/null +++ b/tests/config.php @@ -0,0 +1,13 @@ + \ No newline at end of file diff --git a/tests/phpunit.xml b/tests/phpunit.xml index 6cafbdac..5a0c3765 100644 --- a/tests/phpunit.xml +++ b/tests/phpunit.xml @@ -1,5 +1,16 @@ + - - unit/config - - \ No newline at end of file + + unit/config + + + unit/securityregress/Security_CSRFToken.php + + + unit/securityregress/Security_Sessions.php + + + unit/securityregress/Security_Tokens.php + + + \ No newline at end of file diff --git a/tests/unit/config/SampleTest.php b/tests/unit/config/SampleTest.php index 9b445a57..ae788a29 100644 --- a/tests/unit/config/SampleTest.php +++ b/tests/unit/config/SampleTest.php @@ -2,19 +2,14 @@ // these are ONLY here because we're checking config options // these should NOT be in a normal unit test -define('SECURITY', 'so we can check config options'); -define("BASEPATH", "./"); - -require_once(BASEPATH.'public/include/config/global.inc.dist.php'); -require_once("PHPUnit/Autoload.php"); class TestDistConfig extends PHPUnit_Framework_Testcase { /** -* Test to make sure SALT is sane -*/ - function testSalt() { - $this->assertNotEmpty(SALT); - $this->assertGreaterThan(1, strlen(SALT)); + * Test to make sure SALT is sane + */ + function testSaltLength() { + $this->assertNotEmpty($config['SALT']); + $this->assertGreaterThan(1, strlen($config['SALTY'])); } } diff --git a/tests/unit/securityregress/Security_CSRFToken.php b/tests/unit/securityregress/Security_CSRFToken.php new file mode 100644 index 00000000..a3a0d7f5 --- /dev/null +++ b/tests/unit/securityregress/Security_CSRFToken.php @@ -0,0 +1,45 @@ +getBasic($user->getCurrentIP(), 'test-token'); + $test_token = $csrftoken->checkBasic($user->getCurrentIP(), 'test-token', $created_token); + $this->assertTrue($test_token); + } + + /** + * Tests if a CSRF token correctly fails + */ + function testCSRFToken_fail() { + global $config; + global $user; + global $csrftoken; + + // differing user + $created_token = $csrftoken->getBasic('not the same', 'test-token'); + $test_token = $csrftoken->checkBasic($user->getCurrentIP(), 'test-token', $created_token); + $this->assertFalse($test_token); + + // differing type + $created_token2 = $csrftoken->getBasic($user->getCurrentIP(), 'not the same'); + $test_token2 = $csrftoken->checkBasic($user->getCurrentIP(), 'test-token', $created_token2); + $this->assertFalse($test_token2); + + // token slightly shortened + $created_token3 = $csrftoken->getBasic($user->getCurrentIP(), 'test-token'); + $created_token3 = substr($created_token3, 0, (strlen($created_token3)-1)); + $test_token3 = $csrftoken->checkBasic($user->getCurrentIP(), 'test-token', $created_token3); + $this->assertFalse($test_token3); + } +} + +?> \ No newline at end of file diff --git a/tests/unit/securityregress/Security_Sessions.php b/tests/unit/securityregress/Security_Sessions.php new file mode 100644 index 00000000..5813f5a1 --- /dev/null +++ b/tests/unit/securityregress/Security_Sessions.php @@ -0,0 +1,30 @@ +assertNotEquals($mid, session_id()); + } + } +} + +?> \ No newline at end of file diff --git a/tests/unit/securityregress/Security_Tokens.php b/tests/unit/securityregress/Security_Tokens.php new file mode 100644 index 00000000..4ff8d967 --- /dev/null +++ b/tests/unit/securityregress/Security_Tokens.php @@ -0,0 +1,25 @@ +getAll(); + + foreach ($token_types as $tt) { + // create + $create_token = $oToken->createToken($tt['name'], 1); + $this->assertStringMatchesFormat('%x', $create_token); + $this->assertGreaterThan(16, strlen($create_token)); + } + } +} + +?> \ No newline at end of file