RanchiMall/php-mpos
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
2,597 Commits 4 Branches 11 Tags 14 MiB
2d960cd0fb
Commit Graph

1165 Commits

Author SHA1 Message Date
Sebastian Grewe
43e1c44def Merge pull request #1646 from xisi/security-logging 
[ADDITION] Basic security logging
 2014-02-04 08:05:13 -08:00
Sebastian Grewe
c677295447 [FIX] Network hashrate in khash before checks 2014-02-03 08:20:42 +01:00
Sebastian Grewe
d61e6a7243 [FIX] Cron compile folder permission issue 2014-02-03 07:58:06 +01:00
xisi
18c7565e5c cleanup 2014-02-02 13:34:41 -05:00
xisi
ca1ae6ba2c wrapped KLogger 2014-02-02 11:57:06 -05:00
Sebastian Grewe
9da7af8a5e [FIX] 24 Hour Account Graphs 2014-02-02 11:35:08 +01:00
Sebastian Grewe
656a92d286 Merge pull request #1651 from rog1121/patch-4 
Locked Account Message
 2014-02-01 13:14:22 -08:00
rog1121
07d49b0956 Locked Account Message 2014-02-01 12:35:48 -07:00
xisi
cf8a8cc4d8 fixes #1639 2014-01-31 17:34:48 -05:00
xisi
e7bace5550 basic logging, adds logs folder to root dir 
htaccess to block access to the logs
by default, only log warnings
simple config check to see if that folder is writable

warning if changeNoFee is used
warning if setLocked is used
warning if changeAdmin is used
warning if when logging in that IP is different than saved IP
info if a login fails with bad user or password
warning if a user is locked via failed logins
info if an update/etc fails with bad pin
warning if a user is locked via failed pins
info when a pin request is sent
warning when a pin request email doesn't send
warning when trying to request pin reset and incorrect password
info when a twofactor token sent
warning if twofactor email doesn't send
warning when a user tries to request multiple of the same type of token
info when a twofactor token is deleted
warning if a twofactor token fails to delete
warning when an invalid change password token is used
info on successful account update
warning when reset password is called and IP doesn't match saved IP, info otherwise
warning if isAuthenticated falls through and kills a session
 2014-01-31 13:11:38 -05:00
Sebastian Grewe
255b9e1f56 [FIX] API Timeout added 
Fixes #1643
 2014-01-31 16:27:03 +01:00
Sebastian Grewe
319d9439a4 Merge pull request #1621 from xisi/sessions-mclimiter-fixes 
[UPDATE] Security updates and fixes
 2014-01-31 05:55:09 -08:00
xisi
afdf3abb29 ripped out all the memcache session stuff, not worth it with the side effects of caching things 
cleaned up config/checks
 2014-01-30 18:41:56 -05:00
xisi
8487a8d462 respect client validation settings for failures 2014-01-30 09:38:41 -05:00
xisi
3d414e9ffa I think this is a good midway between hardcoding it in and allowing configurability 2014-01-29 23:35:07 -05:00
xisi
0643cf4b87 fixed crons, tested on 2 boxes 2014-01-29 18:33:34 -05:00
xisi
53a8b4adf1 .htaccess check for @ahmedbodi 2014-01-29 15:43:09 -05:00
xisi
51818421d8 weird problem, strict for isAuthenticated 2014-01-29 14:46:21 -05:00
xisi
5d017f60c3 how this worked before is beyond me 2014-01-29 13:28:38 -05:00
xisi
ae47437ab7 fixed worker delete csrf thing I stubbed earlier 
took to field out of the rest of the login forms
 2014-01-29 09:41:50 -05:00
xisi
f298c60260 little more cleanup 
put version check/config check after sessions/rate limiter so it works correctly & only uses 1 db hit
 2014-01-29 09:16:03 -05:00
xisi
568445845a changes DEBUG SALT and SALTY from defines to variables 
switched that in all places used (class loads mostly)
moved all includes at the beginning of index into bootstrap
moves *_PATH defines from config to bootstrap
config now uses defaults first, then user config
 2014-01-29 07:34:50 -05:00
xisi
c2b1c68699 added check if we can write config files to admin_checks, we shouldnt be able to 2014-01-29 05:20:06 -05:00
Sebastian Grewe
923795c23b [FIX] Ignore AP for empty/NULL addresses 2014-01-29 09:58:18 +01:00
xisi
56ad9266d3 last login time not this login time 2014-01-29 03:55:51 -05:00
Sebastian Grewe
d84018763d [FIX] Admin Panel Users: Show user shares 
Fixes #1624
 2014-01-29 09:27:34 +01:00
Sebastian Grewe
d007358710 [FIX] Ignore missing HTTP_REFERRER 
Fixes #1626
 2014-01-29 08:52:12 +01:00
xisi
74dec2796d Added last login time/ip address popup on login w/ close button 
Info/blue if your ip matches, warning/yellow if not
 2014-01-28 15:45:24 -05:00
xisi
3efe979ae3 Switch config over to wiki, yay 2014-01-28 14:24:48 -05:00
xisi
614b5b1dbb of all the pages to miss it on 2014-01-28 08:19:58 -05:00
xisi
9f6cf99aa3 small fixes 2014-01-28 08:08:53 -05:00
xisi
f56c18276a small fixes 2014-01-28 07:26:33 -05:00
xisi
6398e5dfec merged session manager/memcache limiter 
cleanup for PR
 2014-01-28 07:26:33 -05:00
Joey
63c3b96a29 now enforce client & server validity on login with strict on 
fixed csrf token check for a few pages where it mightve been broken
session manager now can be bound to base user class and used, like in login
logout now pushes you to login regardless, no longer has param to push to custom url
fixed validate client, hijacking sessions no longer works
 2014-01-28 07:26:32 -05:00
Joey
795e019d0d cleaned up config options a bit 2014-01-28 07:26:32 -05:00
Joey
493c43e0ed updated check in autoloader so default needs to be changed if SECHASH_CHECK is enabled 2014-01-28 07:26:32 -05:00
xisi
b728b680ca blah blah 2014-01-28 07:26:08 -05:00
xisi
9dcb855b34 strict class, trying to figure out why edit account doesnt work 2014-01-28 06:18:57 -05:00
xisi
f21f05e874 pushing to start core rebuild 2014-01-28 06:18:57 -05:00
Sebastian Grewe
967c1cc48f [FIX] Proper HTTPS detection 
Fixes #1618 once merged
 2014-01-28 09:25:20 +01:00
Sebastian Grewe
b783237c2e Merge pull request #1457 from MPOS/issue-1332 
Issue 1332
 2014-01-28 00:18:56 -08:00
Sebastian Grewe
f83c88aae6 Merge pull request #1603 from MPOS/double-payouts 
Double payouts
 2014-01-27 22:25:44 -08:00
Sebastian Grewe
ecfa741223 [FIX] Do not assign smarty vars if caching hits 2014-01-27 13:43:33 +01:00
Sebastian Grewe
b5cb8171ba Merge branch 'master-read-only-check' into next 2014-01-27 13:26:14 +01:00
Sebastian Grewe
f183b586a8 [ADDED] Check if master is read-only 
Just to ensure we can run at all.
 2014-01-27 12:58:41 +01:00
Sebastian Grewe
fab3c44e90 [ADDED] THash/second modifier 2014-01-27 12:45:46 +01:00
Sebastian Grewe
1cd9352952 [FIX] Transaction ID and RPC Transaction ID 2014-01-27 10:31:18 +01:00
Sebastian Grewe
d4557982ba [FIX] API call for transactions 
Fixes #1602 once merged.
 2014-01-27 09:13:09 +01:00
Sebastian Grewe
b87691371f [SECURITY] Path disclosure and redirects 
* [SECURITY] Do not disclose paths with wrong query arguments in API
* [SECURITY] Removed $to redirect after login

Fixes #1596 once merged.
 2014-01-26 17:41:27 +01:00
Sebastian Grewe
7c8d7701f2 [FIX] Lock state 2 for admin locks 2014-01-26 11:17:33 +01:00