Changeset 4883 for OpenPNE/trunk

Timestamp:

Jan 9, 2008, 9:58:22 PM (15 years ago)

Author:

ebihara

Message:

#1749:PEAR::Authを1.3.0から1.5.4にバージョンアップ

Location:

OpenPNE/trunk

Files:

• lib/include/Auth.php (modified) (49 diffs)
• lib/include/Auth/Anonymous.php (modified) (7 diffs)
• lib/include/Auth/Container.php (modified) (12 diffs)
• lib/include/Auth/Container/Array.php (added)
• lib/include/Auth/Container/DB.php (modified) (24 diffs)
• lib/include/Auth/Container/DBLite.php (modified) (9 diffs)
• lib/include/Auth/Container/File.php (modified) (14 diffs)
• lib/include/Auth/Container/IMAP.php (modified) (5 diffs)
• lib/include/Auth/Container/KADM5.php (added)
• lib/include/Auth/Container/LDAP.php (modified) (22 diffs)
• lib/include/Auth/Container/MDB.php (modified) (23 diffs)
• lib/include/Auth/Container/MDB2.php (modified) (21 diffs)
• lib/include/Auth/Container/Multiple.php (added)
• lib/include/Auth/Container/PEAR.php (modified) (5 diffs)
• lib/include/Auth/Container/POP3.php (modified) (5 diffs)
• lib/include/Auth/Container/RADIUS.php (modified) (6 diffs)
• lib/include/Auth/Container/SAP.php (added)
• lib/include/Auth/Container/SMBPasswd.php (modified) (7 diffs)
• lib/include/Auth/Container/SOAP.php (modified) (3 diffs)
• lib/include/Auth/Container/SOAP5.php (added)
• lib/include/Auth/Container/vpopmail.php (modified) (3 diffs)
• lib/include/Auth/Controller.php (modified) (16 diffs)
• lib/include/Auth/Frontend/Html.php (modified) (9 diffs)
• webapp/lib/OpenPNE/Auth.php (modified) (1 diff)

OpenPNE/trunk/lib/include/Auth.php

@@ -19 +19 @@
  * @copyright  2001-2006 The PHP Group
  * @license    http://www.php.net/license/3_01.txt  PHP License 3.01
- * @version    CVS: $Id: Auth.php,v 1.101 2006/03/02 06:53:08 aashley Exp $
+ * @version    CVS: $Id: Auth.php,v 1.119 2007/07/02 03:38:52 aashley Exp $
  * @link       http://pear.php.net/package/Auth
  */
@@ -31 +31 @@
  */
 define('AUTH_EXPIRED',                  -2);
-/** 
+/**
  * Returned if container is unable to authenticate user/password pair
  */
@@ -43 +43 @@
  */
 define('AUTH_SECURITY_BREACH',          -5);
+/**
+ * Returned if checkAuthCallback says session should not continue.
+ */
+define('AUTH_CALLBACK_ABORT',           -6);
+
+/**
+ * Auth Log level - INFO
+ */
+define('AUTH_LOG_INFO',     6);
+/**
+ * Auth Log level - DEBUG
+ */
+define('AUTH_LOG_DEBUG',    7);
+
 
 /**
@@ -56 +70 @@
  * @copyright  2001-2006 The PHP Group
  * @license    http://www.php.net/license/3_01.txt  PHP License 3.01
- * @version    Release: 1.3.0  File: $Revision: 1.101 $
+ * @version    Release: 1.5.4  File: $Revision: 1.119 $
  * @link       http://pear.php.net/package/Auth
  */
@@ -123 +137 @@
      */
     var $showLogin = true;
-    
+
     /**
       * Is Login Allowed from this page
@@ -154 +168 @@
 
     /**
+     * checkAuth callback function name
+     *
+     * @var string
+     * @see setCheckAuthCallback()
+     */
+    var $checkAuthCallback = '';
+
+    /**
      * Login callback function name
      *
@@ -165 +187 @@
      *
      * @var string
-     * @see setLoginFailedCallback()
+     * @see setFailedLoginCallback()
      */
     var $loginFailedCallback = '';
@@ -193 +215 @@
     /**
      * Flag to use advanced security
-     * When set extra checks will be made to see if the 
-     * user's IP or useragent have changed across requests. 
+     * When set extra checks will be made to see if the
+     * user's IP or useragent have changed across requests.
      * Turned off by default to preserve BC.
      *
      * @var boolean
-     */     
+     */
     var $advancedsecurity = false;
 
@@ -244 +266 @@
      */
     var $authdata;
-    
+
     /**
       * How many times has checkAuth been called
-      * var int
+      * @var int
       */
     var $authChecks = 0;
+
+    /**
+     * PEAR::Log object
+     *
+     * @var object Log
+     */
+    var $logger = null;
+
+    /**
+     * Whether to enable logging of behaviour
+     *
+     * @var boolean
+     */
+    var $enableLogging = false;
+
+    /**
+     * Whether to regenerate session id everytime start is called
+     *
+     * @var boolean
+     */
+    var $regenerateSessionId = false;
 
     // }}}
@@ -280 +323 @@
                 PEAR::throwError('Session could not be started by Auth, '
                         .'possibly headers are already sent, try putting '
-                        .'ob_start in the begninig of your script');
+                        .'ob_start in the beginning of your script');
             }
         }
 
         // Make Sure Auth session variable is there
-        if(   !isset($_SESSION[$this->_sessionName]) 
-           && !isset($GLOBALS['HTTP_SESSION_VARS'][$this->_sessionName])) {
-            session_register($this->_sessionName);
+        if(!isset($_SESSION[$this->_sessionName])) {
+            $_SESSION[$this->_sessionName] = array();
         }
 
         // Assign Some globals to internal references, this will replace _importGlobalVariable
-        isset($_SESSION) 
-            ? $this->session =& $_SESSION[$this->_sessionName] 
-            : $this->session =& $GLOBALS['HTTP_SESSION_VARS'][$this->_sessionName] ;
-        isset($_SERVER) 
-            ? $this->server =& $_SERVER 
-            : $this->server =& $GLOBALS['HTTP_SERVER_VARS'];
-        isset($_POST) 
-            ? $this->post =& $_POST 
-            : $this->post =& $GLOBALS['HTTP_POST_VARS'];
-        isset($_COOKIE) 
-            ? $this->cookie =& $_COOKIE 
-            : $this->cookie =& $GLOBALS['HTTP_COOKIE_VARS'];
-        //isset($_GET) ? $var = &$_GET : $var = &$GLOBALS['HTTP_GET_VARS'];
+        $this->session =& $_SESSION[$this->_sessionName];
+        $this->server =& $_SERVER;
+        $this->post =& $_POST;
+        $this->cookie =& $_COOKIE;
 
         if ($loginFunction != '' && is_callable($loginFunction)) {
@@ -320 +353 @@
         } else {
             // $this->storage = $this->_factory($storageDriver, $options);
-            // 
+            //
             $this->storage_driver = $storageDriver;
             $this->storage_options =& $options;
@@ -330 +363 @@
 
     /**
-      * Set the Auth options 
+      * Set the Auth options
       *
       * Some options which are Auth specific will be applied
       * the rest will be left for usage by the container
-      * 
+      *
       * @param array    An array of Auth options
       * @return array   The options which were not applied
@@ -346 +379 @@
                 unset($options['sessionName']);
             }
-            if (!empty($options['allowLogin'])) {
+            if (isset($options['allowLogin'])) {
                 $this->allowLogin = $options['allowLogin'];
                 unset($options['allowLogin']);
@@ -358 +391 @@
                 unset($options['postPassword']);
             }
-            if (!empty($options['advancedsecurity'])) {
+            if (isset($options['advancedsecurity'])) {
                 $this->advancedsecurity = $options['advancedsecurity'];
                 unset($options['advancedsecurity']);
             }
+            if (isset($options['enableLogging'])) {
+                $this->enableLogging = $options['enableLogging'];
+                unset($options['enableLogging']);
+            }
+            if (isset($options['regenerateSessionId']) && is_bool($options['regenerateSessionId'])) {
+                $this->regenerateSessionId = $options['regenerateSessionId'];
+            }
         }
         return($options);
@@ -368 +408 @@
     // }}}
     // {{{ _loadStorage()
-    
+
     /**
       * Load Storage Driver if not already loaded
       *
-      * Suspend storage instantiation to make Auth lighter to use 
+      * Suspend storage instantiation to make Auth lighter to use
       * for calls which do not require login
       *
@@ -382 +422 @@
     {
         if(!is_object($this->storage)) {
-            $this->storage =& $this->_factory($this->storage_driver, 
+            $this->storage =& $this->_factory($this->storage_driver,
                     $this->storage_options);
             $this->storage->_auth_obj =& $this;
+            $this->log('Loaded storage container ('.$this->storage_driver.')', AUTH_LOG_DEBUG);
             return(true);
         }
@@ -428 +469 @@
     function assignData()
     {
-        if (   isset($this->post[$this->_postUsername]) 
+        $this->log('Auth::assignData() called.', AUTH_LOG_DEBUG);
+
+        if (   isset($this->post[$this->_postUsername])
             && $this->post[$this->_postUsername] != '') {
-            $this->username = (get_magic_quotes_gpc() == 1 
-                    ? stripslashes($this->post[$this->_postUsername]) 
+            $this->username = (get_magic_quotes_gpc() == 1
+                    ? stripslashes($this->post[$this->_postUsername])
                     : $this->post[$this->_postUsername]);
         }
-        if (   isset($this->post[$this->_postPassword]) 
+        if (   isset($this->post[$this->_postPassword])
             && $this->post[$this->_postPassword] != '') {
-            $this->password = (get_magic_quotes_gpc() == 1 
-                    ? stripslashes($this->post[$this->_postPassword]) 
+            $this->password = (get_magic_quotes_gpc() == 1
+                    ? stripslashes($this->post[$this->_postPassword])
                     : $this->post[$this->_postPassword] );
         }
@@ -453 +496 @@
     function start()
     {
+        $this->log('Auth::start() called.', AUTH_LOG_DEBUG);
+
+        // #10729 - Regenerate session id here if we are generating it on every
+        //          page load.
+        if ($this->regenerateSessionId) {
+            session_regenerate_id(true);
+        }
+
         $this->assignData();
         if (!$this->checkAuth() && $this->allowLogin) {
@@ -470 +521 @@
     function login()
     {
+        $this->log('Auth::login() called.', AUTH_LOG_DEBUG);
+
         $login_ok = false;
         $this->_loadStorage();
-        
+
         // Check if using challenge response
-        (isset($this->post['authsecret']) && $this->post['authsecret'] == 1) 
-            ? $usingChap = true 
+        (isset($this->post['authsecret']) && $this->post['authsecret'] == 1)
+            ? $usingChap = true
             : $usingChap = false;
 
-        
+
         // When the user has already entered a username, we have to validate it.
         if (!empty($this->username)) {
@@ -484 +537 @@
                 $this->session['challengekey'] = md5($this->username.$this->password);
                 $login_ok = true;
+                $this->log('Successful login.', AUTH_LOG_INFO);
             }
         }
@@ -490 +544 @@
             $this->setAuth($this->username);
             if (is_callable($this->loginCallback)) {
-                call_user_func_array($this->loginCallback, array($this->username, $this));
-            }
-        }
-
-        // If the login failed or the user entered no username, 
+                $this->log('Calling loginCallback ('.$this->loginCallback.').', AUTH_LOG_DEBUG);
+                call_user_func_array($this->loginCallback, array($this->username, &$this));
+            }
+        }
+
+        // If the login failed or the user entered no username,
         // output the login screen again.
         if (!empty($this->username) && !$login_ok) {
+            $this->log('Incorrect login.', AUTH_LOG_INFO);
             $this->status = AUTH_WRONG_LOGIN;
             if (is_callable($this->loginFailedCallback)) {
-                call_user_func_array($this->loginFailedCallback, array($this->username, $this));
+                $this->log('Calling loginFailedCallback ('.$this->loginFailedCallback.').', AUTH_LOG_DEBUG);
+                call_user_func_array($this->loginFailedCallback, array($this->username, &$this));
             }
         }
 
         if ((empty($this->username) || !$login_ok) && $this->showLogin) {
+            $this->log('Rendering Login Form.', AUTH_LOG_INFO);
             if (is_callable($this->loginFunction)) {
-                call_user_func_array($this->loginFunction, array($this->username, $this->status, $this));
+                $this->log('Calling loginFunction ('.$this->loginFunction.').', AUTH_LOG_DEBUG);
+                call_user_func_array($this->loginFunction, array($this->username, $this->status, &$this));
             } else {
                 // BC fix Auth used to use drawLogin for this
                 // call is sub classes implement this
                 if (is_callable(array($this, 'drawLogin'))) {
+                    $this->log('Calling Auth::drawLogin()', AUTH_LOG_DEBUG);
                     return $this->drawLogin($this->username, $this);
                 }
+
+                $this->log('Using default Auth_Frontend_Html', AUTH_LOG_DEBUG);
 
                 // New Login form
@@ -563 +625 @@
      * on the same domain, you can change the name of
      * session per application via this function.
-     * This will chnage the name of the session variable 
+     * This will chnage the name of the session variable
      * auth uses to store it's data in the session
      *
@@ -573 +635 @@
     {
         $this->_sessionName = '_auth_'.$name;
-        isset($_SESSION) 
-            ? $this->session =& $_SESSION[$this->_sessionName] 
-            : $this->session =& $GLOBALS['HTTP_SESSION_VARS'][$this->_sessionName] ;
+        // Make Sure Auth session variable is there
+        if(!isset($_SESSION[$this->_sessionName])) {
+            $_SESSION[$this->_sessionName] = array();
+        }
+        $this->session =& $_SESSION[$this->_sessionName];
     }
 
@@ -609 +673 @@
 
     // }}}
+    // {{{ setCheckAuthCallback()
+
+    /**
+     * Register a callback function to be called whenever the validity of the login is checked
+     * The function will receive two parameters, the username and a reference to the auth object.
+     *
+     * @param  string  callback function name
+     * @return void
+     * @access public
+     * @since Method available since Release 1.4.3
+     */
+    function setCheckAuthCallback($checkAuthCallback)
+    {
+        $this->checkAuthCallback = $checkAuthCallback;
+    }
+
+    // }}}
     // {{{ setLoginCallback()
-    
+
     /**
      * Register a callback function to be called on user login.
@@ -630 +711 @@
     /**
      * Register a callback function to be called on failed user login.
-     * The function will receive a single parameter, the username and a reference to the auth object.
+     * The function will receive two parameters, the username and a reference to the auth object.
      *
      * @param  string  callback function name
@@ -697 +778 @@
         if (!isset($this->session['data'])) {
             return null;
-        }    
+        }
         if(!isset($name)) {
             return $this->session['data'];
@@ -704 +785 @@
             return $this->session['data'][$name];
         }
-        return null;        
+        return null;
     }
 
@@ -720 +801 @@
     function setAuth($username)
     {
-    
-        // #2021 - Change the session id to avoid session fixation attacks php 4.3.3 > 
-        session_regenerate_id();
+        $this->log('Auth::setAuth() called.', AUTH_LOG_DEBUG);
+
+        // #10729 - Regenerate session id here only if generating at login only
+        //          Don't do it if we are regenerating on every request so we don't
+        //          regenerate it twice in one request.
+        if (!$this->regenerateSessionId) {
+            // #2021 - Change the session id to avoid session fixation attacks php 4.3.3 >
+            session_regenerate_id(true);
+        }
 
         if (!isset($this->session) || !is_array($this->session)) {
@@ -732 +819 @@
         }
 
-        $this->session['sessionip'] = isset($this->server['REMOTE_ADDR']) 
-            ? $this->server['REMOTE_ADDR'] 
+        $this->session['sessionip'] = isset($this->server['REMOTE_ADDR'])
+            ? $this->server['REMOTE_ADDR']
             : '';
-        $this->session['sessionuseragent'] = isset($this->server['HTTP_USER_AGENT']) 
-            ? $this->server['HTTP_USER_AGENT'] 
+        $this->session['sessionuseragent'] = isset($this->server['HTTP_USER_AGENT'])
+            ? $this->server['HTTP_USER_AGENT']
+            : '';
+        $this->session['sessionforwardedfor'] = isset($this->server['HTTP_X_FORWARDED_FOR'])
+            ? $this->server['HTTP_X_FORWARDED_FOR']
             : '';
 
@@ -756 +846 @@
     // }}}
     // {{{ setAdvancedSecurity()
-    
+
     /**
       * Enables advanced security checks
       *
-      * Currently only ip change and useragent change 
+      * Currently only ip change and useragent change
       * are detected
-      * @todo Add challenge cookies - Create a cookie which changes every time 
+      * @todo Add challenge cookies - Create a cookie which changes every time
       *       and contains some challenge key which the server can verify with
       *       a session var cookie might need to be crypted (user pass)
@@ -785 +875 @@
     function checkAuth()
     {
+        $this->log('Auth::checkAuth() called.', AUTH_LOG_DEBUG);
         $this->authChecks++;
         if (isset($this->session)) {
@@ -791 +882 @@
                 && isset($this->session['timestamp'])
                 && ($this->session['timestamp'] + $this->expire) < time()) {
+                $this->log('Session Expired', AUTH_LOG_INFO);
                 $this->expired = true;
                 $this->status = AUTH_EXPIRED;
@@ -799 +891 @@
             // Check if maximum idle time is reached
             if (   $this->idle > 0
-                && isset($this->session['idle']) 
+                && isset($this->session['idle'])
                 && ($this->session['idle'] + $this->idle) < time()) {
+                $this->log('Session Idle Time Reached', AUTH_LOG_INFO);
                 $this->idled = true;
                 $this->status = AUTH_IDLED;
@@ -807 +900 @@
             }
 
-            if (   isset($this->session['registered']) 
-                && isset($this->session['username']) 
-                && $this->session['registered'] == true 
+            if (   isset($this->session['registered'])
+                && isset($this->session['username'])
+                && $this->session['registered'] == true
                 && $this->session['username'] != '') {
                 Auth::updateIdle();
 
                 if ($this->advancedsecurity) {
-                    
+                    $this->log('Advanced Security Mode Enabled.', AUTH_LOG_DEBUG);
+
                     // Only Generate the challenge once
                     if($this->authChecks == 1) {
+                        $this->log('Generating new Challenge Cookie.', AUTH_LOG_DEBUG);
                         $this->session['challengecookieold'] = $this->session['challengecookie'];
                         $this->session['challengecookie'] = md5($this->session['challengekey'].microtime());
                         setcookie('authchallenge', $this->session['challengecookie']);
                     }
-                    
+
                     // Check for ip change
-                    if (   isset($this->server['REMOTE_ADDR']) 
+                    if (   isset($this->server['REMOTE_ADDR'])
                         && $this->session['sessionip'] != $this->server['REMOTE_ADDR']) {
-                        // Check if the IP of the user has changed, if so we 
+                        $this->log('Security Breach. Remote IP Address changed.', AUTH_LOG_INFO);
+                        // Check if the IP of the user has changed, if so we
                         // assume a man in the middle attack and log him out
                         $this->expired = true;
@@ -832 +928 @@
                         return false;
                     }
-                    
+
+                    // Check for ip change (if connected via proxy)
+                    if (   isset($this->server['HTTP_X_FORWARDED_FOR'])
+                        && $this->session['sessionforwardedfor'] != $this->server['HTTP_X_FORWARDED_FOR']) {
+                        $this->log('Security Breach. Forwarded For IP Address changed.', AUTH_LOG_INFO);
+                        // Check if the IP of the user connecting via proxy has
+                        // changed, if so we assume a man in the middle attack
+                        // and log him out.
+                        $this->expired = true;
+                        $this->status = AUTH_SECURITY_BREACH;
+                        $this->logout();
+                        return false;
+                    }
+
                     // Check for useragent change
-                    if (   isset($this->server['HTTP_USER_AGENT']) 
+                    if (   isset($this->server['HTTP_USER_AGENT'])
                         && $this->session['sessionuseragent'] != $this->server['HTTP_USER_AGENT']) {
-                        // Check if the User-Agent of the user has changed, if 
+                        $this->log('Security Breach. User Agent changed.', AUTH_LOG_INFO);
+                        // Check if the User-Agent of the user has changed, if
                         // so we assume a man in the middle attack and log him out
                         $this->expired = true;
@@ -843 +953 @@
                         return false;
                     }
-    
-                    // Check challenge cookie here, if challengecookieold is not set 
+
+                    // Check challenge cookie here, if challengecookieold is not set
                     // this is the first time and check is skipped
-                    // TODO when user open two pages similtaneuly (open in new window,open 
+                    // TODO when user open two pages similtaneuly (open in new window,open
                     // in tab) auth breach is caused find out a way around that if possible
-                    if (   isset($this->session['challengecookieold']) 
+                    if (   isset($this->session['challengecookieold'])
                         && $this->session['challengecookieold'] != $this->cookie['authchallenge']) {
+                        $this->log('Security Breach. Challenge Cookie mismatch.', AUTH_LOG_INFO);
                         $this->expired = true;
                         $this->status = AUTH_SECURITY_BREACH;
@@ -858 +969 @@
                 }
 
+                if (is_callable($this->checkAuthCallback)) {
+                    $this->log('Calling checkAuthCallback ('.$this->checkAuthCallback.').', AUTH_LOG_DEBUG);
+                    $checkCallback = call_user_func_array($this->checkAuthCallback, array($this->username, &$this));
+                    if ($checkCallback == false) {
+                        $this->log('checkAuthCallback failed.', AUTH_LOG_INFO);
+                        $this->expired = true;
+                        $this->status = AUTH_CALLBACK_ABORT;
+                        $this->logout();
+                        return false;
+                    }
+                }
+
+                $this->log('Session OK.', AUTH_LOG_INFO);
                 return true;
             }
         }
+        $this->log('Unable to locate session storage.', AUTH_LOG_DEBUG);
         return false;
     }
@@ -881 +1006 @@
             $staticAuth = new Auth('null', $options);
         }
+        $staticAuth->log('Auth::staticCheckAuth() called', AUTH_LOG_DEBUG);
         return $staticAuth->checkAuth();
     }
@@ -895 +1021 @@
     function getAuth()
     {
+        $this->log('Auth::getAuth() called.', AUTH_LOG_DEBUG);
         return $this->checkAuth();
     }
@@ -913 +1040 @@
     function logout()
     {
-        if (is_callable($this->logoutCallback)) {
-            call_user_func_array($this->logoutCallback, array($this->session['username'], $this));
+        $this->log('Auth::logout() called.', AUTH_LOG_DEBUG);
+
+        if (is_callable($this->logoutCallback) && isset($this->session['username'])) {
+            $this->log('Calling logoutCallback ('.$this->logoutCallback.').', AUTH_LOG_DEBUG);
+            call_user_func_array($this->logoutCallback, array($this->session['username'], &$this));
         }
 
         $this->username = '';
         $this->password = '';
-        
+
         $this->session = null;
     }
@@ -970 +1100 @@
     // }}}
     // {{{ getPostUsernameField()
-    
+
     /**
      * Gets the post varible used for the username
-     * 
+     *
      * @return string
      * @access public
@@ -987 +1117 @@
     /**
      * Gets the post varible used for the username
-     * 
+     *
      * @return string
      * @access public
@@ -1010 +1140 @@
             return 0;
         }
+        if ($this->idle == 0) {
+            return 0;
+        }
         return ($this->session['idle'] + $this->idle);
     }
@@ -1025 +1158 @@
     function listUsers()
     {
+        $this->log('Auth::listUsers() called.', AUTH_LOG_DEBUG);
         $this->_loadStorage();
         return $this->storage->listUsers();
@@ -1044 +1178 @@
     function addUser($username, $password, $additional = '')
     {
+        $this->log('Auth::addUser() called.', AUTH_LOG_DEBUG);
         $this->_loadStorage();
         return $this->storage->addUser($username, $password, $additional);
@@ -1061 +1196 @@
     function removeUser($username)
     {
+        $this->log('Auth::removeUser() called.', AUTH_LOG_DEBUG);
         $this->_loadStorage();
         return $this->storage->removeUser($username);
@@ -1073 +1209 @@
      * @access public
      * @param string Username
-     * @param string The new password 
+     * @param string The new password
      * @return mixed True on success, PEAR error object on error
      *               and AUTH_METHOD_NOT_SUPPORTED otherwise.
@@ -1079 +1215 @@
     function changePassword($username, $password)
     {
+        $this->log('Auth::changePassword() called', AUTH_LOG_DEBUG);
         $this->_loadStorage();
         return $this->storage->changePassword($username, $password);
@@ -1084 +1221 @@
 
     // }}}
+    // {{{ log()
+
+    /**
+     * Log a message from the Auth system
+     *
+     * @access public
+     * @param string The message to log
+     * @param string The log level to log the message under. See the Log documentation for more info.
+     * @return boolean
+     */
+    function log($message, $level = AUTH_LOG_DEBUG)
+    {
+        if (!$this->enableLogging) return false;
+
+        $this->_loadLogger();
+
+        $this->logger->log('AUTH: '.$message, $level);
+    }
+
+    // }}}
+    // {{{ _loadLogger()
+
+    /**
+      * Load Log object if not already loaded
+      *
+      * Suspend logger instantiation to make Auth lighter to use
+      * for calls which do not require logging
+      *
+      * @return bool    True if the logger is loaded, false if the logger
+      *                 is already loaded
+      * @access private
+      */
+    function _loadLogger()
+    {
+        if(is_null($this->logger)) {
+            if (!class_exists('Log')) {
+                include_once 'Log.php';
+            }
+            $this->logger =& Log::singleton('null',
+                    null,
+                    'auth['.getmypid().']',
+                    array(),
+                    AUTH_LOG_DEBUG);
+            return(true);
+        }
+        return(false);
+    }
+
+    // }}}
+    // {{{ attachLogObserver()
+
+    /**
+     * Attach an Observer to the Auth Log Source
+     *
+     * @param object Log_Observer A Log Observer instance
+     * @return boolean
+     */
+    function attachLogObserver(&$observer) {
+
+        $this->_loadLogger();
+
+        return $this->logger->attach($observer);
+
+    }
+
+    // }}}
 
 }

OpenPNE/trunk/lib/include/Auth/Anonymous.php

@@ -19 +19 @@
  * @copyright  2001-2006 The PHP Group
  * @license    http://www.php.net/license/3_01.txt  PHP License 3.01
- * @version    CVS: $Id: Anonymous.php,v 1.5 2006/03/02 06:53:08 aashley Exp $
+ * @version    CVS: $Id: Anonymous.php,v 1.6 2007/06/12 03:11:26 aashley Exp $
  * @link       http://pear.php.net/package/Auth
  * @since      File available since Release 1.3.0
@@ -31 +31 @@
 /**
  * Anonymous Authentication
- * 
- * This class provides anonymous authentication if username and password 
+ *
+ * This class provides anonymous authentication if username and password
  * were not supplied
  *
@@ -41 +41 @@
  * @copyright  2001-2006 The PHP Group
  * @license    http://www.php.net/license/3_01.txt  PHP License 3.01
- * @version    Release: 1.3.0  File: $Revision: 1.5 $
+ * @version    Release: 1.5.4  File: $Revision: 1.6 $
  * @link       http://pear.php.net/package/Auth
  * @since      Class available since Release 1.3.0
  */
-class Auth_Anonymous extends Auth 
+class Auth_Anonymous extends Auth
 {
 
@@ -66 +66 @@
     // }}}
     // {{{ Auth_Anonymous() [constructor]
-    
+
     /**
      * Pass all parameters to Parent Auth class
-     * 
+     *
      * Set up the storage driver.
      *
@@ -88 +88 @@
     // }}}
     // {{{ login()
-    
+
     /**
      * Login function
-     * 
+     *
      * If no username & password is passed then login as the username
      * provided in $this->anonymous_username else call standard login()
@@ -101 +101 @@
      */
     function login() {
-        if (   $this->allow_anonymous 
-            && empty($this->username) 
+        if (   $this->allow_anonymous
+            && empty($this->username)
             && empty($this->password) ) {
             $this->setAuth($this->anonymous_username);
@@ -116 +116 @@
     // }}}
     // {{{ forceLogin()
-    
+
     /**
      * Force the user to login

OpenPNE/trunk/lib/include/Auth/Container.php

@@ -19 +19 @@
  * @copyright  2001-2006 The PHP Group
  * @license    http://www.php.net/license/3_01.txt  PHP License 3.01
- * @version    CVS: $Id: Container.php,v 1.23 2006/03/02 06:53:08 aashley Exp $
+ * @version    CVS: $Id: Container.php,v 1.28 2007/06/12 03:11:26 aashley Exp $
  * @link       http://pear.php.net/package/Auth
  */
@@ -32 +32 @@
  * @copyright  2001-2006 The PHP Group
  * @license    http://www.php.net/license/3_01.txt  PHP License 3.01
- * @version    Release: 1.3.0  File: $Revision: 1.23 $
+ * @version    Release: 1.5.4  File: $Revision: 1.28 $
  * @link       http://pear.php.net/package/Auth
  */
@@ -47 +47 @@
     var $activeUser = "";
 
+    /**
+     * The Auth object this container is attached to.
+     *
+     * @access public
+     */
+    var $_auth_obj = null;
+
     // }}}
     // {{{ Auth_Container() [constructor]
@@ -73 +80 @@
     function fetchData($username, $password, $isChallengeResponse=false)
     {
+        $this->log('Auth_Container::fetchData() called.', AUTH_LOG_DEBUG);
     }
 
@@ -91 +99 @@
     function verifyPassword($password1, $password2, $cryptType = "md5")
     {
+        $this->log('Auth_Container::verifyPassword() called.', AUTH_LOG_DEBUG);
         switch ($cryptType) {
             case "crypt" :
-                return ( crypt($password1, $password2) == $password2 );
+                return ((string)crypt($password1, $password2) === (string)$password2);
                 break;
             case "none" :
             case "" :
-                return ($password1 == $password2);
+                return ((string)$password1 === (string)$password2);
                 break;
             case "md5" :
-                return (md5($password1) == $password2);
+                return ((string)md5($password1) === (string)$password2);
                 break;
             default :
                 if (function_exists($cryptType)) {
-                    return ($cryptType($password1) == $password2);
-                } elseif (method_exists($this,$cryptType)) { 
-                    return ($this->$cryptType($password1) == $password2);
+                    return ((string)$cryptType($password1) === (string)$password2);
+                } elseif (method_exists($this,$cryptType)) {
+                    return ((string)$this->$cryptType($password1) === (string)$password2);
                 } else {
                     return false;
@@ -116 +125 @@
     // }}}
     // {{{ supportsChallengeResponse()
-    
-    /**
-      * Returns true if the container supports Challenge Response 
+
+    /**
+      * Returns true if the container supports Challenge Response
       * password authentication
       */
@@ -128 +137 @@
     // }}}
     // {{{ getCryptType()
-    
+
     /**
       * Returns the crypt current crypt type of the container
@@ -147 +156 @@
     function listUsers()
     {
+        $this->log('Auth_Container::listUsers() called.', AUTH_LOG_DEBUG);
         return AUTH_METHOD_NOT_SUPPORTED;
     }
@@ -162 +172 @@
     function getUser($username)
     {
+        $this->log('Auth_Container::getUser() called.', AUTH_LOG_DEBUG);
         $users = $this->listUsers();
         if ($users === AUTH_METHOD_NOT_SUPPORTED) {
@@ -188 +199 @@
     function addUser($username, $password, $additional=null)
     {
+        $this->log('Auth_Container::addUser() called.', AUTH_LOG_DEBUG);
         return AUTH_METHOD_NOT_SUPPORTED;
     }
@@ -201 +213 @@
     function removeUser($username)
     {
+        $this->log('Auth_Container::removeUser() called.', AUTH_LOG_DEBUG);
         return AUTH_METHOD_NOT_SUPPORTED;
     }
@@ -215 +228 @@
     function changePassword($username, $password)
     {
-        return AUTH_METHOD_NOT_SUPPORTED;
+        $this->log('Auth_Container::changePassword() called.', AUTH_LOG_DEBUG);
+        return AUTH_METHOD_NOT_SUPPORTED;
+    }
+
+    // }}}
+    // {{{ log()
+
+    /**
+     * Log a message to the Auth log
+     *
+     * @param string The message
+     * @param int
+     * @return boolean
+     */
+    function log($message, $level = AUTH_LOG_DEBUG) {
+
+        if (is_null($this->_auth_obj)) {
+
+            return false;
+
+        } else {
+
+            return $this->_auth_obj->log($message, $level);
+
+        }
+
     }
 

OpenPNE/trunk/lib/include/Auth/Container/DB.php

@@ -19 +19 @@
  * @copyright  2001-2006 The PHP Group
  * @license    http://www.php.net/license/3_01.txt  PHP License 3.01
- * @version    CVS: $Id: DB.php,v 1.60 2006/03/02 06:53:08 aashley Exp $
+ * @version    CVS: $Id: DB.php,v 1.72 2007/06/12 03:11:26 aashley Exp $
  * @link       http://pear.php.net/package/Auth
  */
@@ -44 +44 @@
  * @copyright  2001-2006 The PHP Group
  * @license    http://www.php.net/license/3_01.txt  PHP License 3.01
- * @version    Release: 1.3.0  File: $Revision: 1.60 $
+ * @version    Release: 1.5.4  File: $Revision: 1.72 $
  * @link       http://pear.php.net/package/Auth
  */
@@ -110 +110 @@
     function _connect($dsn)
     {
+        $this->log('Auth_Container_DB::_connect() called.', AUTH_LOG_DEBUG);
+
         if (is_string($dsn) || is_array($dsn)) {
             $this->db = DB::Connect($dsn, $this->options['db_options']);
@@ -132 +134 @@
     }
 
+    // }}}
+    // {{{ _prepare()
+
     /**
      * Prepare database connection
@@ -148 +153 @@
                 return $res;
             }
+        }
+        if ($this->options['auto_quote'] && $this->db->dsn['phptype'] != 'sqlite') {
+            $this->options['final_table'] = $this->db->quoteIdentifier($this->options['table']);
+            $this->options['final_usernamecol'] = $this->db->quoteIdentifier($this->options['usernamecol']);
+            $this->options['final_passwordcol'] = $this->db->quoteIdentifier($this->options['passwordcol']);
+        } else {
+            $this->options['final_table'] = $this->options['table'];
+            $this->options['final_usernamecol'] = $this->options['usernamecol'];
+            $this->options['final_passwordcol'] = $this->options['passwordcol'];
         }
         return true;
@@ -194 +208 @@
         $this->options['cryptType']   = 'md5';
         $this->options['db_options']  = array();
+        $this->options['db_where']    = '';
+        $this->options['auto_quote']  = true;
     }
 
@@ -212 +228 @@
             }
         }
-
-        /* Include additional fields if they exist */
-        if (!empty($this->options['db_fields'])) {
+    }
+
+    // }}}
+    // {{{ _quoteDBFields()
+
+    /**
+     * Quote the db_fields option to avoid the possibility of SQL injection.
+     *
+     * @access private
+     * @return string A properly quoted string that can be concatenated into a
+     * SELECT clause.
+     */
+    function _quoteDBFields()
+    {
+        if (isset($this->options['db_fields'])) {
             if (is_array($this->options['db_fields'])) {
-                $this->options['db_fields'] = join($this->options['db_fields'], ', ');
-            }
-            $this->options['db_fields'] = ', '.$this->options['db_fields'];
-        }
+                if ($this->options['auto_quote']) {
+                    $fields = array();
+                    foreach ($this->options['db_fields'] as $field) {
+                        $fields[] = $this->db->quoteIdentifier($field);
+                    }
+                    return implode(', ', $fields);
+                } else {
+                    return implode(', ', $this->options['db_fields']);
+                }
+            } else {
+                if (strlen($this->options['db_fields']) > 0) {
+                    if ($this->options['auto_quote']) {
+                        return $this->db->quoteIdentifier($this->options['db_fields']);
+                    } else {
+                        return $this->options['db_fields'];
+                    }
+                }
+            }
+        }
+
+        return '';
     }
 
@@ -243 +288 @@
     function fetchData($username, $password, $isChallengeResponse=false)
     {
+        $this->log('Auth_Container_DB::fetchData() called.', AUTH_LOG_DEBUG);
         // Prepare for a database query
         $err = $this->_prepare();
@@ -250 +296 @@
 
         // Find if db_fields contains a *, if so assume all columns are selected
-        if (strstr($this->options['db_fields'], '*')) {
+        if (is_string($this->options['db_fields'])
+            && strstr($this->options['db_fields'], '*')) {
             $sql_from = "*";
         } else {
-            $sql_from = $this->options['usernamecol'] . ", ".$this->options['passwordcol'].$this->options['db_fields'];
-        }
-        /*
-         Old Style, removed to go around the oci8
-         problem
-         See bug 206
-         http://pear.php.net/bugs/bug.php?id=206
-
-        $query = "SELECT ! FROM ! WHERE ! = ?";
-        $query_params = array(
-                         $sql_from,
-                         $this->options['table'],
-                         $this->options['usernamecol'],
-                         $username
-                         );
-        */
+            $sql_from = $this->options['final_usernamecol'].
+                ", ".$this->options['final_passwordcol'];
+
+            if (strlen($fields = $this->_quoteDBFields()) > 0) {
+                $sql_from .= ', '.$fields;
+            }
+        }
 
         $query = "SELECT ".$sql_from.
-                " FROM ".$this->options['table'].
-                " WHERE ".$this->options['usernamecol']." = ".$this->db->quoteSmart($username);
+                " FROM ".$this->options['final_table'].
+                " WHERE ".$this->options['final_usernamecol']." = ".$this->db->quoteSmart($username);
+
+        // check if there is an optional parameter db_where
+        if ($this->options['db_where'] != '') {
+            // there is one, so add it to the query
+            $query .= " AND ".$this->options['db_where'];
+        }
+
+        $this->log('Running SQL against DB: '.$query, AUTH_LOG_DEBUG);
 
         $res = $this->db->getRow($query, null, DB_FETCHMODE_ASSOC);
@@ -293 +339 @@
             $res[$this->options['passwordcol']] = md5($res[$this->options['passwordcol']]
                     .$this->_auth_obj->session['loginchallenege']);
-            
+
             // UGLY cannot avoid without modifying verifyPassword
             if ($this->options['cryptType'] == 'md5') {
                 $res[$this->options['passwordcol']] = md5($res[$this->options['passwordcol']]);
             }
-            
+
             //print " Hashed Password [{$res[$this->options['passwordcol']]}]<br/>\n";
         }
@@ -311 +357 @@
                     continue;
                 }
+
+                $this->log('Storing additional field: '.$key, AUTH_LOG_DEBUG);
+
                 // Use reference to the auth object if exists
-                // This is because the auth session variable can change so a 
+                // This is because the auth session variable can change so a
                 // static call to setAuthData does not make sence
                 $this->_auth_obj->setAuthData($key, $value);
@@ -333 +382 @@
     function listUsers()
     {
+        $this->log('Auth_Container_DB::listUsers() called.', AUTH_LOG_DEBUG);
         $err = $this->_prepare();
         if ($err !== true) {
@@ -341 +391 @@
 
         // Find if db_fields contains a *, if so assume all col are selected
-        if (strstr($this->options['db_fields'], '*')) {
+        if (   is_string($this->options['db_fields'])
+            && strstr($this->options['db_fields'], '*')) {
             $sql_from = "*";
         } else {
-            $sql_from = $this->options['usernamecol'] . ", ".$this->options['passwordcol'].$this->options['db_fields'];
+            $sql_from = $this->options['final_usernamecol'].
+                ", ".$this->options['final_passwordcol'];
+
+            if (strlen($fields = $this->_quoteDBFields()) > 0) {
+                $sql_from .= ', '.$fields;
+            }
         }
 
         $query = sprintf("SELECT %s FROM %s",
                          $sql_from,
-                         $this->options['table']
+                         $this->options['final_table']
                          );
+
+        // check if there is an optional parameter db_where
+        if ($this->options['db_where'] != '') {
+            // there is one, so add it to the query
+            $query .= " WHERE ".$this->options['db_where'];
+        }
+
+        $this->log('Running SQL against DB: '.$query, AUTH_LOG_DEBUG);
+
         $res = $this->db->getAll($query, null, DB_FETCHMODE_ASSOC);
 
@@ -361 +426 @@
             }
         }
+        $this->log('Found '.count($retVal).' users.', AUTH_LOG_DEBUG);
         return $retVal;
     }
@@ -379 +445 @@
     function addUser($username, $password, $additional = "")
     {
+        $this->log('Auth_Container_DB::addUser() called.', AUTH_LOG_DEBUG);
         $err = $this->_prepare();
         if ($err !== true) {
@@ -384 +451 @@
         }
 
-        if (   isset($this->options['cryptType']) 
+        if (   isset($this->options['cryptType'])
             && $this->options['cryptType'] == 'none') {
             $cryptFunction = 'strval';
-        } elseif (   isset($this->options['cryptType']) 
+        } elseif (   isset($this->options['cryptType'])
                   && function_exists($this->options['cryptType'])) {
             $cryptFunction = $this->options['cryptType'];
@@ -401 +468 @@
         if (is_array($additional)) {
             foreach ($additional as $key => $value) {
-                $additional_key .= ', ' . $key;
+                if ($this->options['auto_quote']) {
+                    $additional_key .= ', ' . $this->db->quoteIdentifier($key);
+                } else {
+                    $additional_key .= ', ' . $key;
+                }
                 $additional_value .= ", " . $this->db->quoteSmart($value);
             }
@@ -407 +478 @@
 
         $query = sprintf("INSERT INTO %s (%s, %s%s) VALUES (%s, %s%s)",
-                         $this->options['table'],
-                         $this->options['usernamecol'],
-                         $this->options['passwordcol'],
+                         $this->options['final_table'],
+                         $this->options['final_usernamecol'],
+                         $this->options['final_passwordcol'],
                          $additional_key,
                          $this->db->quoteSmart($username),
@@ -416 +487 @@
                          );
 
+        $this->log('Running SQL against DB: '.$query, AUTH_LOG_DEBUG);
+
         $res = $this->query($query);
 
@@ -438 +511 @@
     function removeUser($username)
     {
+        $this->log('Auth_Container_DB::removeUser() called.', AUTH_LOG_DEBUG);
+
         $err = $this->_prepare();
         if ($err !== true) {
@@ -443 +518 @@
         }
 
-        $query = sprintf("DELETE FROM %s WHERE %s = %s",
-                         $this->options['table'],
-                         $this->options['usernamecol'],
-                         $this->db->quoteSmart($username)
+        // check if there is an optional parameter db_where
+        if ($this->options['db_where'] != '') {
+            // there is one, so add it to the query
+            $where = " AND ".$this->options['db_where'];
+        } else {
+            $where = '';
+        }
+
+        $query = sprintf("DELETE FROM %s WHERE %s = %s %s",
+                         $this->options['final_table'],
+                         $this->options['final_usernamecol'],
+                         $this->db->quoteSmart($username),
+                         $where
                          );
+
+        $this->log('Running SQL against DB: '.$query, AUTH_LOG_DEBUG);
 
         $res = $this->query($query);
@@ -469 +555 @@
     function changePassword($username, $password)
     {
+        $this->log('Auth_Container_DB::changePassword() called.', AUTH_LOG_DEBUG);
         $err = $this->_prepare();
         if ($err !== true) {
@@ -474 +561 @@
         }
 
-        if (   isset($this->options['cryptType']) 
+        if (   isset($this->options['cryptType'])
             && $this->options['cryptType'] == 'none') {
             $cryptFunction = 'strval';
-        } elseif (   isset($this->options['cryptType']) 
+        } elseif (   isset($this->options['cryptType'])
                   && function_exists($this->options['cryptType'])) {
             $cryptFunction = $this->options['cryptType'];
@@ -486 +573 @@
         $password = $cryptFunction($password);
 
-        $query = sprintf("UPDATE %s SET %s = %s WHERE %s = %s",
-                         $this->options['table'],
-                         $this->options['passwordcol'],
+        // check if there is an optional parameter db_where
+        if ($this->options['db_where'] != '') {
+            // there is one, so add it to the query
+            $where = " AND ".$this->options['db_where'];
+        } else {
+            $where = '';
+        }
+
+        $query = sprintf("UPDATE %s SET %s = %s WHERE %s = %s %s",
+                         $this->options['final_table'],
+                         $this->options['final_passwordcol'],
                          $this->db->quoteSmart($password),
-                         $this->options['usernamecol'],
-                         $this->db->quoteSmart($username)
+                         $this->options['final_usernamecol'],
+                         $this->db->quoteSmart($username),
+                         $where
                          );
+
+        $this->log('Running SQL against DB: '.$query, AUTH_LOG_DEBUG);
 
         $res = $this->query($query);

OpenPNE/trunk/lib/include/Auth/Container/DBLite.php

@@ -19 +19 @@
  * @copyright  2001-2006 The PHP Group
  * @license    http://www.php.net/license/3_01.txt  PHP License 3.01
- * @version    CVS: $Id: DBLite.php,v 1.7 2006/03/02 06:53:08 aashley Exp $
+ * @version    CVS: $Id: DBLite.php,v 1.18 2007/06/12 03:11:26 aashley Exp $
  * @link       http://pear.php.net/package/Auth
  * @since      File available since Release 1.3.0
@@ -46 +46 @@
  * @copyright  2001-2006 The PHP Group
  * @license    http://www.php.net/license/3_01.txt  PHP License 3.01
- * @version    Release: 1.3.0  File: $Revision: 1.7 $
+ * @version    Release: 1.5.4  File: $Revision: 1.18 $
  * @link       http://pear.php.net/package/Auth
  * @since      Class available since Release 1.3.0
@@ -94 +94 @@
         $this->options['cryptType']   = 'md5';
         $this->options['db_options']  = array();
+        $this->options['db_where']    = '';
+        $this->options['auto_quote']  = true;
 
         if (is_array($dsn)) {
@@ -117 +119 @@
     function _connect(&$dsn)
     {
+        $this->log('Auth_Container_DBLite::_connect() called.', AUTH_LOG_DEBUG);
         if (is_string($dsn) || is_array($dsn)) {
             $this->db =& DB::connect($dsn, $this->options['db_options']);
@@ -152 +155 @@
             }
         }
+        if ($this->options['auto_quote'] && $this->db->dsn['phptype'] != 'sqlite') {
+            $this->options['final_table'] = $this->db->quoteIdentifier($this->options['table']);
+            $this->options['final_usernamecol'] = $this->db->quoteIdentifier($this->options['usernamecol']);
+            $this->options['final_passwordcol'] = $this->db->quoteIdentifier($this->options['passwordcol']);
+        } else {
+            $this->options['final_table'] = $this->options['table'];
+            $this->options['final_usernamecol'] = $this->options['usernamecol'];
+            $this->options['final_passwordcol'] = $this->options['passwordcol'];
+        }
         return true;
     }
@@ -171 +183 @@
             }
         }
-
-        /* Include additional fields if they exist */
-        if (!empty($this->options['db_fields'])) {
+    }
+
+    // }}}
+    // {{{ _quoteDBFields()
+
+    /**
+     * Quote the db_fields option to avoid the possibility of SQL injection.
+     *
+     * @access private
+     * @return string A properly quoted string that can be concatenated into a
+     * SELECT clause.
+     */
+    function _quoteDBFields()
+    {
+        if (isset($this->options['db_fields'])) {
             if (is_array($this->options['db_fields'])) {
-                $this->options['db_fields'] = join($this->options['db_fields'], ', ');
-            }
-            $this->options['db_fields'] = ', '.$this->options['db_fields'];
-        }
+                if ($this->options['auto_quote']) {
+                    $fields = array();
+                    foreach ($this->options['db_fields'] as $field) {
+                        $fields[] = $this->db->quoteIdentifier($field);
+                    }
+                    return implode(', ', $fields);
+                } else {
+                    return implode(', ', $this->options['db_fields']);
+                }
+            } else {
+                if (strlen($this->options['db_fields']) > 0) {
+                    if ($this->options['auto_quote']) {
+                        return $this->db->quoteIdentifier($this->options['db_fields']);
+                    } else {
+                        $this->options['db_fields'];
+                    }
+                }
+            }
+        }
+
+        return '';
     }
 
@@ -199 +240 @@
     function fetchData($username, $password)
     {
+        $this->log('Auth_Container_DBLite::fetchData() called.', AUTH_LOG_DEBUG);
         // Prepare for a database query
         $err = $this->_prepare();
@@ -206 +248 @@
 
         // Find if db_fields contains a *, if so assume all col are selected
-        if (strstr($this->options['db_fields'], '*')) {
+        if (is_string($this->options['db_fields'])
+            && strstr($this->options['db_fields'], '*')) {
             $sql_from = "*";
         } else {
-            $sql_from = $this->options['usernamecol'] . ", ".$this->options['passwordcol'].$this->options['db_fields'];
-        }
-        
+            $sql_from = $this->options['final_usernamecol'].
+                ", ".$this->options['final_passwordcol'];
+
+            if (strlen($fields = $this->_quoteDBFields()) > 0) {
+                $sql_from .= ', '.$fields;
+            }
+        }
+
         $query = "SELECT ".$sql_from.
-                " FROM ".$this->options['table'].
-                " WHERE ".$this->options['usernamecol']." = ".$this->db->quoteSmart($username);
+                " FROM ".$this->options['final_table'].
+                " WHERE ".$this->options['final_usernamecol']." = ".$this->db->quoteSmart($username);
+
+        // check if there is an optional parameter db_where
+        if ($this->options['db_where'] != '') {
+            // there is one, so add it to the query
+            $query .= " AND ".$this->options['db_where'];
+        }
+
+        $this->log('Running SQL against DB: '.$query, AUTH_LOG_DEBUG);
+
         $res = $this->db->getRow($query, null, DB_FETCHMODE_ASSOC);
 
@@ -233 +290 @@
                     continue;
                 }
+
+                $this->log('Storing additional field: '.$key, AUTH_LOG_DEBUG);
+
                 // Use reference to the auth object if exists
                 // This is because the auth session variable can change so a static call to setAuthData does not make sence

OpenPNE/trunk/lib/include/Auth/Container/File.php

@@ -15 +15 @@
  * @category   Authentication
  * @package    Auth
- * @author     Stefan Ekman <stekman@sedata.org> 
+ * @author     Stefan Ekman <stekman@sedata.org>
  * @author     Martin Jansen <mj@php.net>
- * @author     Mika Tuupola <tuupola@appelsiini.net> 
+ * @author     Mika Tuupola <tuupola@appelsiini.net>
  * @author     Michael Wallner <mike@php.net>
  * @author     Adam Ashley <aashley@php.net>
  * @copyright  2001-2006 The PHP Group
  * @license    http://www.php.net/license/3_01.txt  PHP License 3.01
- * @version    CVS: $Id: File.php,v 1.20 2006/03/02 06:53:08 aashley Exp $
+ * @version    CVS: $Id: File.php,v 1.25 2007/06/12 03:11:26 aashley Exp $
  * @link       http://pear.php.net/package/Auth
  */
@@ -46 +46 @@
  * @category   Authentication
  * @package    Auth
- * @author     Stefan Ekman <stekman@sedata.org> 
+ * @author     Stefan Ekman <stekman@sedata.org>
  * @author     Martin Jansen <mj@php.net>
- * @author     Mika Tuupola <tuupola@appelsiini.net> 
+ * @author     Mika Tuupola <tuupola@appelsiini.net>
  * @author     Michael Wallner <mike@php.net>
  * @author     Adam Ashley <aashley@php.net>
  * @copyright  2001-2006 The PHP Group
  * @license    http://www.php.net/license/3_01.txt  PHP License 3.01
- * @version    Release: 1.3.0  File: $Revision: 1.20 $
+ * @version    Release: 1.5.4  File: $Revision: 1.25 $
  * @link       http://pear.php.net/package/Auth
  */
@@ -63 +63 @@
     /**
      * Path to passwd file
-     * 
+     *
      * @var string
      */
     var $pwfile = '';
+
+    /**
+     * Options for container
+     *
+     * @var array
+     */
+    var $options = array();
 
     // }}}
@@ -78 +85 @@
      */
     function Auth_Container_File($filename) {
+        $this->_setDefaults();
+
         // Only file is a valid option here
         if(is_array($filename)) {
-            $filename = $filename['file'];
-        }
-        $this->pwfile = $filename;
+            $this->pwfile = $filename['file'];
+            $this->_parseOptions($filename);
+        } else {
+            $this->pwfile = $filename;
+        }
     }
 
@@ -97 +108 @@
     function fetchData($user, $pass)
     {
-        return File_Passwd::staticAuth('Cvs', $this->pwfile, $user, $pass);
+        $this->log('Auth_Container_File::fetchData() called.', AUTH_LOG_DEBUG);
+        return File_Passwd::staticAuth($this->options['type'], $this->pwfile, $user, $pass);
     }
 
     // }}}
     // {{{ listUsers()
-    
+
     /**
      * List all available users
-     * 
+     *
      * @return   array
      */
     function listUsers()
     {
+        $this->log('Auth_Container_File::listUsers() called.', AUTH_LOG_DEBUG);
+
         $pw_obj = &$this->_load();
         if (PEAR::isError($pw_obj)) {
@@ -121 +135 @@
 
         foreach ($users as $key => $value) {
-            $retVal[] = array("username" => $key, 
+            $retVal[] = array("username" => $key,
                               "password" => $value['passwd'],
                               "cvsuser"  => $value['system']);
         }
 
+        $this->log('Found '.count($retVal).' users.', AUTH_LOG_DEBUG);
+
         return $retVal;
     }
@@ -137 +153 @@
      * @param string username
      * @param string password
-     * @param mixed  CVS username
+     * @param mixed  Additional parameters to File_Password_*::addUser()
      *
      * @return boolean
@@ -143 +159 @@
     function addUser($user, $pass, $additional='')
     {
-        $cvs = (string) (is_array($additional) && isset($additional['cvsuser'])) ? 
-               $additional['cvsuser'] : $additional;
+        $this->log('Auth_Container_File::addUser() called.', AUTH_LOG_DEBUG);
+        $params = array($user, $pass);
+        if (is_array($additional)) {
+            foreach ($additional as $item) {
+                $params[] = $item;
+            }
+        } else {
+            $params[] = $additional;
+        }
 
         $pw_obj = &$this->_load();
@@ -150 +173 @@
             return false;
         }
-        
-        $res = $pw_obj->addUser($user, $pass, $cvs);
-        if (PEAR::isError($res)) {
-            return false;
-        }
-        
+
+        $res = call_user_func_array(array(&$pw_obj, 'addUser'), $params);
+        if (PEAR::isError($res)) {
+            return false;
+        }
+
         $res = $pw_obj->save();
         if (PEAR::isError($res)) {
             return false;
         }
-        
+
         return true;
     }
@@ -175 +198 @@
     function removeUser($user)
     {
+        $this->log('Auth_Container_File::removeUser() called.', AUTH_LOG_DEBUG);
         $pw_obj = &$this->_load();
         if (PEAR::isError($pw_obj)) {
             return false;
         }
-        
+
         $res = $pw_obj->delUser($user);
         if (PEAR::isError($res)) {
             return false;
         }
-        
+
         $res = $pw_obj->save();
         if (PEAR::isError($res)) {
             return false;
         }
-        
+
         return true;
     }
@@ -200 +224 @@
      *
      * @param string Username
-     * @param string The new password 
+     * @param string The new password
      */
     function changePassword($username, $password)
     {
+        $this->log('Auth_Container_File::changePassword() called.', AUTH_LOG_DEBUG);
         $pw_obj = &$this->_load();
         if (PEAR::isError($pw_obj)) {
             return false;
         }
-        
+
         $res = $pw_obj->changePasswd($username, $password);
         if (PEAR::isError($res)) {
             return false;
         }
-        
+
         $res = $pw_obj->save();
         if (PEAR::isError($res)) {
             return false;
         }
-        
+
         return true;
     }
@@ -224 +249 @@
     // }}}
     // {{{ _load()
-    
+
     /**
      * Load and initialize the File_Passwd object
-     * 
+     *
      * @return  object  File_Passwd_Cvs|PEAR_Error
      */
@@ -233 +258 @@
     {
         static $pw_obj;
-        
+
         if (!isset($pw_obj)) {
-            $pw_obj = File_Passwd::factory('Cvs');
+            $this->log('Instanciating File_Password object of type '.$this->options['type'], AUTH_LOG_DEBUG);
+            $pw_obj = File_Passwd::factory($this->options['type']);
             if (PEAR::isError($pw_obj)) {
                 return $pw_obj;
             }
-            
+
             $pw_obj->setFile($this->pwfile);
-            
+
             $res = $pw_obj->load();
             if (PEAR::isError($res)) {
@@ -247 +273 @@
             }
         }
-        
+
         return $pw_obj;
+    }
+
+    // }}}
+    // {{{ _setDefaults()
+
+    /**
+     * Set some default options
+     *
+     * @access private
+     * @return void
+     */
+    function _setDefaults()
+    {
+        $this->options['type']       = 'Cvs';
+    }
+
+    // }}}
+    // {{{ _parseOptions()
+
+    /**
+     * Parse options passed to the container class
+     *
+     * @access private
+     * @param  array
+     */
+    function _parseOptions($array)
+    {
+        foreach ($array as $key => $value) {
+            if (isset($this->options[$key])) {
+                $this->options[$key] = $value;
+            }
+        }
     }
 

OpenPNE/trunk/lib/include/Auth/Container/IMAP.php

@@ -15 +15 @@
  * @category   Authentication
  * @package    Auth
- * @author     Jeroen Houben <jeroen@terena.nl> 
+ * @author     Jeroen Houben <jeroen@terena.nl>
  * @author     Adam Ashley <aashley@php.net>
  * @copyright  2001-2006 The PHP Group
  * @license    http://www.php.net/license/3_01.txt  PHP License 3.01
- * @version    CVS: $Id: IMAP.php,v 1.14 2006/03/02 06:53:08 aashley Exp $
+ * @version    CVS: $Id: IMAP.php,v 1.18 2007/06/12 03:11:26 aashley Exp $
  * @link       http://pear.php.net/package/Auth
  * @since      File available since Release 1.2.0
@@ -25 +25 @@
 
 /**
- * Include Auth_Container base class 
+ * Include Auth_Container base class
  */
 require_once "Auth/Container.php";
@@ -78 +78 @@
  * @copyright  2001-2006 The PHP Group
  * @license    http://www.php.net/license/3_01.txt  PHP License 3.01
- * @version    Release: 1.3.0  File: $Revision: 1.14 $
+ * @version    Release: 1.5.4  File: $Revision: 1.18 $
  * @link       http://pear.php.net/package/Auth
  * @since      Class available since Release 1.2.0
@@ -149 +149 @@
      */
     function _checkServer() {
+        $this->log('Auth_Container_IMAP::_checkServer() called.', AUTH_LOG_DEBUG);
         $fp = @fsockopen ($this->options['host'], $this->options['port'],
                           $errno, $errstr, $this->options['timeout']);
@@ -189 +190 @@
     function fetchData($username, $password)
     {
+        $this->log('Auth_Container_IMAP::fetchData() called.', AUTH_LOG_DEBUG);
         $dsn = '{'.$this->options['host'].':'.$this->options['port'].$this->options['baseDSN'].'}';
         $conn = @imap_open ($dsn, $username, $password, OP_HALFOPEN);
         if (is_resource($conn)) {
+            $this->log('Successfully connected to IMAP server.', AUTH_LOG_DEBUG);
             $this->activeUser = $username;
             @imap_close($conn);
             return true;
         } else {
+            $this->log('Connection to IMAP server failed.', AUTH_LOG_DEBUG);
             $this->activeUser = '';
             return false;

OpenPNE/trunk/lib/include/Auth/Container/LDAP.php

@@ -15 +15 @@
  * @category   Authentication
  * @package    Auth
- * @author     Jan Wagner <wagner@netsols.de> 
+ * @author     Jan Wagner <wagner@netsols.de>
  * @author     Adam Ashley <aashley@php.net>
  * @author     Hugues Peeters <hugues.peeters@claroline.net>
  * @copyright  2001-2006 The PHP Group
  * @license    http://www.php.net/license/3_01.txt  PHP License 3.01
- * @version    CVS: $Id: LDAP.php,v 1.30 2006/03/02 06:53:08 aashley Exp $
+ * @version    CVS: $Id: LDAP.php,v 1.43 2007/06/12 03:11:26 aashley Exp $
  * @link       http://pear.php.net/package/Auth
  */
@@ -76 +76 @@
  *              Auth::getAuthData(). An empty array will fetch all attributes,
  *              array('') will fetch no attributes at all (default)
+ *              If you add 'dn' as a value to this array, the users DN that was
+ *              used for binding will be added to auth data as well.
  * attrformat:  The returned format of the additional data defined in the
  *              'attributes' option. Two formats are available.
@@ -102 +104 @@
  * group:       the name of group to search for
  * groupscope:  Scope for group searching: one, sub (default), or base
+ * start_tls:   enable/disable the use of START_TLS encrypted connection
+ *              (default: false)
  * debug:       Enable/Disable debugging output (default: false)
+ * try_all:     Whether to try all user accounts returned from the search
+ *              or just the first one. (default: false)
  *
  * To use this storage container, you have to use the following syntax:
@@ -172 +178 @@
  * is not allowed, so you have to set binddn and bindpw for
  * user searching.
- * 
+ *
  * LDAP Referrals need to be set to false for AD to work sometimes.
  *
- * Example a3 shows a full blown and tested example for connection to 
+ * Example a3 shows a full blown and tested example for connection to
  * Windows 2000 Active Directory with group mebership checking
+ *
+ * Note also that if you want an encrypted connection to an MS LDAP
+ * server, then, on your webserver, you must specify
+ *        TLS_REQCERT never
+ * in /etc/ldap/ldap.conf or in the webserver user's ~/.ldaprc (which
+ * may or may not be read depending on your configuration).
+ *
  *
  * @category   Authentication
@@ -185 +198 @@
  * @copyright  2001-2006 The PHP Group
  * @license    http://www.php.net/license/3_01.txt  PHP License 3.01
- * @version    Release: 1.3.0  File: $Revision: 1.30 $
+ * @version    Release: 1.5.4  File: $Revision: 1.43 $
  * @link       http://pear.php.net/package/Auth
  */
@@ -230 +243 @@
 
     // }}}
+    // {{{ _prepare()
+
+    /**
+     * Prepare LDAP connection
+     *
+     * This function checks if we have already opened a connection to
+     * the LDAP server. If that's not the case, a new connection is opened.
+     *
+     * @access private
+     * @return mixed True or a PEAR error object.
+     */
+    function _prepare()
+    {
+        if (!$this->_isValidLink()) {
+            $res = $this->_connect();
+            if (PEAR::isError($res)) {
+                return $res;
+            }
+        }
+        return true;
+    }
+
+    // }}}
     // {{{ _connect()
 
@@ -240 +276 @@
     function _connect()
     {
+        $this->log('Auth_Container_LDAP::_connect() called.', AUTH_LOG_DEBUG);
         // connect
         if (isset($this->options['url']) && $this->options['url'] != '') {
-            $this->_debug('Connecting with URL', __LINE__);
+            $this->log('Connecting with URL', AUTH_LOG_DEBUG);
             $conn_params = array($this->options['url']);
         } else {
-            $this->_debug('Connecting with host:port', __LINE__);
+            $this->log('Connecting with host:port', AUTH_LOG_DEBUG);
             $conn_params = array($this->options['host'], $this->options['port']);
         }
 
         if (($this->conn_id = @call_user_func_array('ldap_connect', $conn_params)) === false) {
+            $this->log('Connection to server failed.', AUTH_LOG_DEBUG);
+            $this->log('LDAP ERROR: '.ldap_errno($this->conn_id).': '.ldap_error($this->conn_id), AUTH_LOG_DEBUG);
             return PEAR::raiseError('Auth_Container_LDAP: Could not connect to server.', 41);
         }
-        $this->_debug('Successfully connected to server', __LINE__);
+        $this->log('Successfully connected to server', AUTH_LOG_DEBUG);
 
         // switch LDAP version
-        if (is_int($this->options['version']) && $this->options['version'] > 2) {
-            $this->_debug("Switching to LDAP version {$this->options['version']}", __LINE__);
+        if (is_numeric($this->options['version']) && $this->options['version'] > 2) {
+            $this->log("Switching to LDAP version {$this->options['version']}", AUTH_LOG_DEBUG);
             @ldap_set_option($this->conn_id, LDAP_OPT_PROTOCOL_VERSION, $this->options['version']);
+
+            // start TLS if available
+            if (isset($this->options['start_tls']) && $this->options['start_tls']) {
+                $this->log("Starting TLS session", AUTH_LOG_DEBUG);
+                if (@ldap_start_tls($this->conn_id) === false) {
+                    $this->log('Could not start TLS session', AUTH_LOG_DEBUG);
+                    $this->log('LDAP ERROR: '.ldap_errno($this->conn_id).': '.ldap_error($this->conn_id), AUTH_LOG_DEBUG);
+                    return PEAR::raiseError('Auth_Container_LDAP: Could not start tls.', 41);
+                }
+            }
         }
 
         // switch LDAP referrals
         if (is_bool($this->options['referrals'])) {
-          $this->_debug("Switching LDAP referrals to " . (($this->options['referrals']) ? 'true' : 'false'), __LINE__);
-          @ldap_set_option($this->conn_id, LDAP_OPT_REFERRALS, $this->options['referrals']);
+            $this->log("Switching LDAP referrals to " . (($this->options['referrals']) ? 'true' : 'false'), AUTH_LOG_DEBUG);
+            if (@ldap_set_option($this->conn_id, LDAP_OPT_REFERRALS, $this->options['referrals']) === false) {
+                $this->log('Could not change LDAP referrals options', AUTH_LOG_DEBUG);
+                $this->log('LDAP ERROR: '.ldap_errno($this->conn_id).': '.ldap_error($this->conn_id), AUTH_LOG_DEBUG);
+            }
         }
 
         // bind with credentials or anonymously
         if (strlen($this->options['binddn']) && strlen($this->options['bindpw'])) {
-            $this->_debug('Binding with credentials', __LINE__);
+            $this->log('Binding with credentials', AUTH_LOG_DEBUG);
             $bind_params = array($this->conn_id, $this->options['binddn'], $this->options['bindpw']);
         } else {
-            $this->_debug('Binding anonymously', __LINE__);
+            $this->log('Binding anonymously', AUTH_LOG_DEBUG);
             $bind_params = array($this->conn_id);
         }
@@ -277 +329 @@
         // bind for searching
         if ((@call_user_func_array('ldap_bind', $bind_params)) === false) {
-            $this->_debug();
+            $this->log('Bind failed', AUTH_LOG_DEBUG);
+            $this->log('LDAP ERROR: '.ldap_errno($this->conn_id).': '.ldap_error($this->conn_id), AUTH_LOG_DEBUG);
             $this->_disconnect();
             return PEAR::raiseError("Auth_Container_LDAP: Could not bind to LDAP server.", 41);
         }
-        $this->_debug('Binding was successful', __LINE__);
+        $this->log('Binding was successful', AUTH_LOG_DEBUG);
+
+        return true;
     }
 
@@ -294 +349 @@
     function _disconnect()
     {
+        $this->log('Auth_Container_LDAP::_disconnect() called.', AUTH_LOG_DEBUG);
         if ($this->_isValidLink()) {
-            $this->_debug('disconnecting from server');
+            $this->log('disconnecting from server');
             @ldap_unbind($this->conn_id);
         }
@@ -310 +366 @@
     function _getBaseDN()
     {
+        $this->log('Auth_Container_LDAP::_getBaseDN() called.', AUTH_LOG_DEBUG);
+        $err = $this->_prepare();
+        if ($err !== true) {
+            return PEAR::raiseError($err->getMessage(), $err->getCode());
+        }
+
         if ($this->options['basedn'] == "" && $this->_isValidLink()) {
-            $this->_debug("basedn not set, searching via namingContexts.", __LINE__);
+            $this->log("basedn not set, searching via namingContexts.", AUTH_LOG_DEBUG);
 
             $result_id = @ldap_read($this->conn_id, "", "(objectclass=*)", array("namingContexts"));
@@ -317 +379 @@
             if (@ldap_count_entries($this->conn_id, $result_id) == 1) {
 
-                $this->_debug("got result for namingContexts", __LINE__);
+                $this->log("got result for namingContexts", AUTH_LOG_DEBUG);
 
                 $entry_id = @ldap_first_entry($this->conn_id, $result_id);
@@ -324 +386 @@
 
                 if ($basedn != "") {
-                    $this->_debug("result for namingContexts was $basedn", __LINE__);
+                    $this->log("result for namingContexts was $basedn", AUTH_LOG_DEBUG);
                     $this->options['basedn'] = $basedn;
                 }
@@ -333 +395 @@
         // if base ist still not set, raise error
         if ($this->options['basedn'] == "") {
-            return PEAR::raiseError("Auth_Container_LDAP: LDAP search base not specified!", 41, PEAR_ERROR_DIE);
+            return PEAR::raiseError("Auth_Container_LDAP: LDAP search base not specified!", 41);
         }
         return true;
@@ -380 +442 @@
         $this->options['userfilter']  = '(objectClass=posixAccount)';
         $this->options['attributes']  = array(''); // no attributes
-     // $this->options['attrformat']  = 'LDAP'; // returns attribute array as PHP LDAP functions return it
         $this->options['attrformat']  = 'AUTH'; // returns attribute like other Auth containers
         $this->options['group']       = '';
@@ -389 +450 @@
         $this->options['memberattr']  = 'uniqueMember';
         $this->options['memberisdn']  = true;
+        $this->options['start_tls']   = false;
         $this->options['debug']       = false;
+        $this->options['try_all']     = false; // Try all user ids returned not just the first one
     }
 
@@ -425 +488 @@
     /**
      * Adapt deprecated options from Auth 1.2 LDAP to Auth 1.3 LDAP
-     * 
+     *
      * @author Hugues Peeters <hugues.peeters@claroline.net>
      * @access private
@@ -484 +547 @@
     function fetchData($username, $password)
     {
-        $this->_connect();
-        $this->_getBaseDN();
+        $this->log('Auth_Container_LDAP::fetchData() called.', AUTH_LOG_DEBUG);
+        $err = $this->_prepare();
+        if ($err !== true) {
+            return PEAR::raiseError($err->getMessage(), $err->getCode());
+        }
+
+        $err = $this->_getBaseDN();
+        if ($err !== true) {
+            return PEAR::raiseError($err->getMessage(), $err->getCode());
+        }
 
         // UTF8 Encode username for LDAPv3
         if (@ldap_get_option($this->conn_id, LDAP_OPT_PROTOCOL_VERSION, $ver) && $ver == 3) {
-            $this->_debug('UTF8 encoding username for LDAPv3', __LINE__);
+            $this->log('UTF8 encoding username for LDAPv3', AUTH_LOG_DEBUG);
             $username = utf8_encode($username);
         }
@@ -507 +578 @@
 
         // attributes
-        $attributes = $this->options['attributes'];
+        $searchAttributes = $this->options['attributes'];
 
         // make functions params array
-        $func_params = array($this->conn_id, $search_basedn, $filter, $attributes);
+        $func_params = array($this->conn_id, $search_basedn, $filter, $searchAttributes);
 
         // search function to use
         $func_name = $this->_scope2function($this->options['userscope']);
 
-        $this->_debug("Searching with $func_name and filter $filter in $search_basedn", __LINE__);
+        $this->log("Searching with $func_name and filter $filter in $search_basedn", AUTH_LOG_DEBUG);
 
         // search
         if (($result_id = @call_user_func_array($func_name, $func_params)) === false) {
-            $this->_debug('User not found', __LINE__);
-        } elseif (@ldap_count_entries($this->conn_id, $result_id) == 1) { // did we get just one entry?
-
-            $this->_debug('User was found', __LINE__);
-
-            // then get the user dn
-            $entry_id = @ldap_first_entry($this->conn_id, $result_id);
-            $user_dn  = @ldap_get_dn($this->conn_id, $entry_id);
-
-            // fetch attributes
-            if ($attributes = @ldap_get_attributes($this->conn_id, $entry_id)) {
-
-                if (is_array($attributes) && isset($attributes['count']) &&
-                     $attributes['count'] > 0) {
-
-                    // ldap_get_attributes() returns a specific multi dimensional array
-                    // format containing all the attributes and where each array starts
-                    // with a 'count' element providing the number of attributes in the
-                    // entry, or the number of values for attribute. For compatibility
-                    // reasons, it remains the default format returned by LDAP container
-                    // setAuthData().
-                    // The code below optionally returns attributes in another format,
-                    // more compliant with other Auth containers, where each attribute
-                    // element are directly set in the 'authData' list. This option is
-                    // enabled by setting 'attrformat' to
-                    // 'AUTH' in the 'options' array.
-                    // eg. $this->options['attrformat'] = 'AUTH'
-
-                    if ( strtoupper($this->options['attrformat']) == 'AUTH' ) {
-                        $this->_debug('Saving attributes to Auth data in AUTH format', __LINE__);
-                        unset ($attributes['count']);
-                        foreach ($attributes as $attributeName => $attributeValue ) {
-                            if (is_int($attributeName)) continue;
-                            if (is_array($attributeValue) && isset($attributeValue['count'])) {
-                                unset ($attributeValue['count']);
+            $this->log('User not found', AUTH_LOG_DEBUG);
+        } elseif (@ldap_count_entries($this->conn_id, $result_id) >= 1) { // did we get some possible results?
+
+            $this->log('User(s) found', AUTH_LOG_DEBUG);
+
+            $first = true;
+            $entry_id = null;
+
+            do {
+
+                // then get the user dn
+                if ($first) {
+                    $entry_id = @ldap_first_entry($this->conn_id, $result_id);
+                    $first = false;
+                } else {
+                    $entry_id = @ldap_next_entry($this->conn_id, $entry_id);
+                    if ($entry_id === false)
+                        break;
+                }
+                $user_dn  = @ldap_get_dn($this->conn_id, $entry_id);
+
+                // as the dn is not fetched as an attribute, we save it anyway
+                if (is_array($searchAttributes) && in_array('dn', $searchAttributes)) {
+                    $this->log('Saving DN to AuthData', AUTH_LOG_DEBUG);
+                    $this->_auth_obj->setAuthData('dn', $user_dn);
+                }
+
+                // fetch attributes
+                if ($attributes = @ldap_get_attributes($this->conn_id, $entry_id)) {
+
+                    if (is_array($attributes) && isset($attributes['count']) &&
+                         $attributes['count'] > 0) {
+
+                        // ldap_get_attributes() returns a specific multi dimensional array
+                        // format containing all the attributes and where each array starts
+                        // with a 'count' element providing the number of attributes in the
+                        // entry, or the number of values for attribute. For compatibility
+                        // reasons, it remains the default format returned by LDAP container
+                        // setAuthData().
+                        // The code below optionally returns attributes in another format,
+                        // more compliant with other Auth containers, where each attribute
+                        // element are directly set in the 'authData' list. This option is
+                        // enabled by setting 'attrformat' to
+                        // 'AUTH' in the 'options' array.
+                        // eg. $this->options['attrformat'] = 'AUTH'
+
+                        if ( strtoupper($this->options['attrformat']) == 'AUTH' ) {
+                            $this->log('Saving attributes to Auth data in AUTH format', AUTH_LOG_DEBUG);
+                            unset ($attributes['count']);
+                            foreach ($attributes as $attributeName => $attributeValue ) {
+                                if (is_int($attributeName)) continue;
+                                if (is_array($attributeValue) && isset($attributeValue['count'])) {
+                                    unset ($attributeValue['count']);
+                                }
+                                if (count($attributeValue)<=1) $attributeValue = $attributeValue[0];
+                                $this->log('Storing additional field: '.$attributeName, AUTH_LOG_DEBUG);
+                                $this->_auth_obj->setAuthData($attributeName, $attributeValue);
                             }
-                            if (count($attributeValue)<=1) $attributeValue = $attributeValue[0];
-                            $this->_auth_obj->setAuthData($attributeName, $attributeValue);
+                        }
+                        else
+                        {
+                            $this->log('Saving attributes to Auth data in LDAP format', AUTH_LOG_DEBUG);
+                            $this->_auth_obj->setAuthData('attributes', $attributes);
                         }
                     }
-                    else
-                    {
-                        $this->_debug('Saving attributes to Auth data in LDAP format', __LINE__);
-                        $this->_auth_obj->setAuthData('attributes', $attributes);
-                    }
                 }
-            }
-            @ldap_free_result($result_id);
-
-            // need to catch an empty password as openldap seems to return TRUE
-            // if anonymous binding is allowed
-            if ($password != "") {
-                $this->_debug("Bind as $user_dn", __LINE__);
-
-                // try binding as this user with the supplied password
-                if (@ldap_bind($this->conn_id, $user_dn, $password)) {
-                    $this->_debug('Bind successful', __LINE__);
-
-                    // check group if appropiate
-                    if (strlen($this->options['group'])) {
-                        // decide whether memberattr value is a dn or the username
-                        $this->_debug('Checking group membership', __LINE__);
-                        return $this->checkGroup(($this->options['memberisdn']) ? $user_dn : $username);
-                    } else {
-                        $this->_debug('Authenticated', __LINE__);
-                        $this->_disconnect();
-                        return true; // user authenticated
-                    } // checkGroup
-                } // bind
-            } // non-empty password
-        } // one entry
+                @ldap_free_result($result_id);
+
+                // need to catch an empty password as openldap seems to return TRUE
+                // if anonymous binding is allowed
+                if ($password != "") {
+                    $this->log("Bind as $user_dn", AUTH_LOG_DEBUG);
+
+                    // try binding as this user with the supplied password
+                    if (@ldap_bind($this->conn_id, $user_dn, $password)) {
+                        $this->log('Bind successful', AUTH_LOG_DEBUG);
+
+                        // check group if appropiate
+                        if (strlen($this->options['group'])) {
+                            // decide whether memberattr value is a dn or the username
+                            $this->log('Checking group membership', AUTH_LOG_DEBUG);
+                            $return = $this->checkGroup(($this->options['memberisdn']) ? $user_dn : $username);
+                            $this->_disconnect();
+                            return $return;
+                        } else {
+                            $this->log('Authenticated', AUTH_LOG_DEBUG);
+                            $this->_disconnect();
+                            return true; // user authenticated
+                        } // checkGroup
+                    } // bind
+                } // non-empty password
+            } while ($this->options['try_all'] == true); // interate through entries
+        } // get results
         // default
-        $this->_debug('NOT authenticated!', __LINE__);
+        $this->log('NOT authenticated!', AUTH_LOG_DEBUG);
         $this->_disconnect();
         return false;
@@ -603 +696 @@
      *
      * Searches the LDAP server for group membership of the
-     * authenticated user.  Quotes all LDAP filter meta characters in
+     * supplied username.  Quotes all LDAP filter meta characters in
      * the user name before querying the LDAP server.
      *
@@ -611 +704 @@
     function checkGroup($user)
     {
+        $this->log('Auth_Container_LDAP::checkGroup() called.', AUTH_LOG_DEBUG);
+        $err = $this->_prepare();
+        if ($err !== true) {
+            return PEAR::raiseError($err->getMessage(), $err->getCode());
+        }
+
         // make filter
         $filter = sprintf('(&(%s=%s)(%s=%s)%s)',
@@ -630 +729 @@
         $func_name = $this->_scope2function($this->options['groupscope']);
 
-        $this->_debug("Searching with $func_name and filter $filter in $search_basedn", __LINE__);
+        $this->log("Searching with $func_name and filter $filter in $search_basedn", AUTH_LOG_DEBUG);
 
         // search
@@ -636 +735 @@
             if (@ldap_count_entries($this->conn_id, $result_id) == 1) {
                 @ldap_free_result($result_id);
-                $this->_debug('User is member of group', __LINE__);
-                $this->_disconnect();
+                $this->log('User is member of group', AUTH_LOG_DEBUG);
                 return true;
             }
         }
         // default
-        $this->_debug('User is NOT member of group', __LINE__);
-        $this->_disconnect();
+        $this->log('User is NOT member of group', AUTH_LOG_DEBUG);
         return false;
-    }
-
-    // }}}
-    // {{{ _debug()
-
-    /**
-     * Outputs debugging messages
-     *
-     * @access private
-     * @param string Debugging Message
-     * @param integer Line number
-     */
-    function _debug($msg = '', $line = 0)
-    {
-        if ($this->options['debug'] === true) {
-            if ($msg == '' && $this->_isValidLink()) {
-                $msg = 'LDAP_Error: ' . @ldap_err2str(@ldap_errno($this->_conn_id));
-            }
-            print("$line: $msg <br />");
-        }
     }
 

OpenPNE/trunk/lib/include/Auth/Container/MDB.php

@@ -15 +15 @@
  * @category   Authentication
  * @package    Auth
- * @author     Lorenzo Alberton <l.alberton@quipo.it> 
+ * @author     Lorenzo Alberton <l.alberton@quipo.it>
  * @author     Adam Ashley <aashley@php.net>
  * @copyright  2001-2006 The PHP Group
  * @license    http://www.php.net/license/3_01.txt  PHP License 3.01
- * @version    CVS: $Id: MDB.php,v 1.24 2006/03/02 06:53:08 aashley Exp $
+ * @version    CVS: $Id: MDB.php,v 1.35 2007/06/12 03:11:26 aashley Exp $
  * @link       http://pear.php.net/package/Auth
  * @since      File available since Release 1.2.3
@@ -45 +45 @@
  * @copyright  2001-2006 The PHP Group
  * @license    http://www.php.net/license/3_01.txt  PHP License 3.01
- * @version    Release: 1.3.0  File: $Revision: 1.24 $
+ * @version    Release: 1.5.4  File: $Revision: 1.35 $
  * @link       http://pear.php.net/package/Auth
  * @since      Class available since Release 1.2.3
@@ -110 +110 @@
     function _connect($dsn)
     {
+        $this->log('Auth_Container_MDB::_connect() called.', AUTH_LOG_DEBUG);
         if (is_string($dsn) || is_array($dsn)) {
             $this->db =& MDB::connect($dsn, $this->options['db_options']);
@@ -129 +130 @@
             return PEAR::raiseError($this->db->getMessage(), $this->db->code);
         }
+
+        if ($this->options['auto_quote']) {
+            $this->options['final_table'] = $this->db->quoteIdentifier($this->options['table']);
+            $this->options['final_usernamecol'] = $this->db->quoteIdentifier($this->options['usernamecol']);
+            $this->options['final_passwordcol'] = $this->db->quoteIdentifier($this->options['passwordcol']);
+        } else {
+            $this->options['final_table'] = $this->options['table'];
+            $this->options['final_usernamecol'] = $this->options['usernamecol'];
+            $this->options['final_passwordcol'] = $this->options['passwordcol'];
+        }
+
         return true;
     }
@@ -169 +181 @@
     function query($query)
     {
+        $this->log('Auth_Container_MDB::query() called.', AUTH_LOG_DEBUG);
         $err = $this->_prepare();
         if ($err !== true) {
@@ -194 +207 @@
         $this->options['cryptType']   = 'md5';
         $this->options['db_options']  = array();
+        $this->options['db_where']    = '';
+        $this->options['auto_quote']  = true;
     }
 
@@ -212 +227 @@
             }
         }
-
-        // Include additional fields if they exist
-        if (!empty($this->options['db_fields'])) {
+    }
+
+    // }}}
+    // {{{ _quoteDBFields()
+
+    /**
+     * Quote the db_fields option to avoid the possibility of SQL injection.
+     *
+     * @access private
+     * @return string A properly quoted string that can be concatenated into a
+     * SELECT clause.
+     */
+    function _quoteDBFields()
+    {
+        if (isset($this->options['db_fields'])) {
             if (is_array($this->options['db_fields'])) {
-                $this->options['db_fields'] = join($this->options['db_fields'], ', ');
-            }
-            $this->options['db_fields'] = ', ' . $this->options['db_fields'];
-        }
+                if ($this->options['auto_quote']) {
+                    $fields = array();
+                    foreach ($this->options['db_fields'] as $field) {
+                        $fields[] = $this->db->quoteIdentifier($field);
+                    }
+                    return implode(', ', $fields);
+                } else {
+                    return implode(', ', $this->options['db_fields']);
+                }
+            } else {
+                if (strlen($this->options['db_fields']) > 0) {
+                    if ($this->options['auto_quote']) {
+                        return $this->db->quoteIdentifier($this->options['db_fields']);
+                    } else {
+                        return $this->options['db_fields'];
+                    }
+                }
+            }
+        }
+
+        return '';
     }
 
@@ -243 +287 @@
     function fetchData($username, $password, $isChallengeResponse=false)
     {
+        $this->log('Auth_Container_MDB::fetchData() called.', AUTH_LOG_DEBUG);
         // Prepare for a database query
         $err = $this->_prepare();
@@ -250 +295 @@
 
         //Check if db_fields contains a *, if so assume all columns are selected
-        if (strstr($this->options['db_fields'], '*')) {
+        if (is_string($this->options['db_fields'])
+            && strstr($this->options['db_fields'], '*')) {
             $sql_from = '*';
         } else {
-            $sql_from = $this->options['usernamecol'] . ', '. $this->options['passwordcol'] . $this->options['db_fields'];
+            $sql_from = $this->options['final_usernamecol'].
+                ", ".$this->options['final_passwordcol'];
+
+            if (strlen($fields = $this->_quoteDBFields()) > 0) {
+                $sql_from .= ', '.$fields;
+            }
         }
 
         $query = sprintf("SELECT %s FROM %s WHERE %s = %s",
                          $sql_from,
-                         $this->options['table'],
-                         $this->options['usernamecol'],
+                         $this->options['final_table'],
+                         $this->options['final_usernamecol'],
                          $this->db->getTextValue($username)
                          );
+
+        // check if there is an optional parameter db_where
+        if ($this->options['db_where'] != '') {
+            // there is one, so add it to the query
+            $query .= " AND ".$this->options['db_where'];
+        }
+
+        $this->log('Running SQL against MDB: '.$query, AUTH_LOG_DEBUG);
 
         $res = $this->db->getRow($query, null, null, null, MDB_FETCHMODE_ASSOC);
@@ -276 +335 @@
         $password = trim($password, "\r\n");
         $res[$this->options['passwordcol']] = trim($res[$this->options['passwordcol']], "\r\n");
-        
+
         // If using Challenge Response md5 the pass with the secret
         if ($isChallengeResponse) {
@@ -286 +345 @@
             }
         }
-        
+
         if ($this->verifyPassword($password,
                                   $res[$this->options['passwordcol']],
@@ -296 +355 @@
                     continue;
                 }
+
+                $this->log('Storing additional field: '.$key, AUTH_LOG_DEBUG);
                 // Use reference to the auth object if exists
                 // This is because the auth session variable can change so a static
@@ -319 +380 @@
     function listUsers()
     {
+        $this->log('Auth_Container_MDB::listUsers() called.', AUTH_LOG_DEBUG);
         $err = $this->_prepare();
         if ($err !== true) {
@@ -327 +389 @@
 
         //Check if db_fields contains a *, if so assume all columns are selected
-        if (strstr($this->options['db_fields'], '*')) {
+        if (   is_string($this->options['db_fields'])
+            && strstr($this->options['db_fields'], '*')) {
             $sql_from = '*';
         } else {
-            $sql_from = $this->options['db_fields'];
+            $sql_from = $this->options['final_usernamecol']
+                .', '.$this->options['final_passwordcol'];
+
+            if (strlen($fields = $this->_quoteDBFields()) > 0) {
+                $sql_from .= ', '.$fields;
+            }
         }
 
         $query = sprintf('SELECT %s FROM %s',
                          $sql_from,
-                         $this->options['table']
+                         $this->options['final_table']
                          );
+
+        // check if there is an optional parameter db_where
+        if ($this->options['db_where'] != '') {
+            // there is one, so add it to the query
+            $query .= " WHERE ".$this->options['db_where'];
+        }
+
+        $this->log('Running SQL against MDB: '.$query, AUTH_LOG_DEBUG);
 
         $res = $this->db->getAll($query, null, null, null, MDB_FETCHMODE_ASSOC);
@@ -348 +424 @@
             }
         }
+        $this->log('Found '.count($retVal).' users.', AUTH_LOG_DEBUG);
         return $retVal;
     }
@@ -366 +443 @@
     function addUser($username, $password, $additional = "")
     {
+        $this->log('Auth_Container_MDB::addUser() called.', AUTH_LOG_DEBUG);
         $err = $this->_prepare();
         if ($err !== true) {
@@ -386 +464 @@
         if (is_array($additional)) {
             foreach ($additional as $key => $value) {
-                $additional_key   .= ', ' . $key;
+                if ($this->options['auto_quote']) {
+                    $additional_key   .= ', ' . $this->db->quoteIdentifier($key);
+                } else {
+                    $additional_key   .= ', ' . $key;
+                }
                 $additional_value .= ', ' . $this->db->getTextValue($value);
             }
@@ -392 +474 @@
 
         $query = sprintf("INSERT INTO %s (%s, %s%s) VALUES (%s, %s%s)",
-                         $this->options['table'],
-                         $this->options['usernamecol'],
-                         $this->options['passwordcol'],
+                         $this->options['final_table'],
+                         $this->options['final_usernamecol'],
+                         $this->options['final_passwordcol'],
                          $additional_key,
                          $this->db->getTextValue($username),
@@ -401 +483 @@
                          );
 
+        $this->log('Running SQL against MDB: '.$query, AUTH_LOG_DEBUG);
+
         $res = $this->query($query);
 
@@ -422 +506 @@
     function removeUser($username)
     {
+        $this->log('Auth_Container_MDB::removeUser() called.', AUTH_LOG_DEBUG);
         $err = $this->_prepare();
         if ($err !== true) {
@@ -428 +513 @@
 
         $query = sprintf("DELETE FROM %s WHERE %s = %s",
-                         $this->options['table'],
-                         $this->options['usernamecol'],
+                         $this->options['final_table'],
+                         $this->options['final_usernamecol'],
                          $this->db->getTextValue($username)
                          );
 
+        // check if there is an optional parameter db_where
+        if ($this->options['db_where'] != '') {
+            // there is one, so add it to the query
+            $query .= " AND ".$this->options['db_where'];
+        }
+
+        $this->log('Running SQL against MDB: '.$query, AUTH_LOG_DEBUG);
+
         $res = $this->query($query);
 
@@ -452 +545 @@
     function changePassword($username, $password)
     {
+        $this->log('Auth_Container_MDB::changePassword() called.', AUTH_LOG_DEBUG);
         $err = $this->_prepare();
         if ($err !== true) {
@@ -468 +562 @@
 
         $query = sprintf("UPDATE %s SET %s = %s WHERE %s = %s",
-                         $this->options['table'],
-                         $this->options['passwordcol'],
+                         $this->options['final_table'],
+                         $this->options['final_passwordcol'],
                          $this->db->getTextValue($password),
-                         $this->options['usernamecol'],
+                         $this->options['final_usernamecol'],
                          $this->db->getTextValue($username)
                          );
 
+        // check if there is an optional parameter db_where
+        if ($this->options['db_where'] != '') {
+            // there is one, so add it to the query
+            $query .= " AND ".$this->options['db_where'];
+        }
+
+        $this->log('Running SQL against MDB: '.$query, AUTH_LOG_DEBUG);
+
         $res = $this->query($query);
 

OpenPNE/trunk/lib/include/Auth/Container/MDB2.php

@@ -15 +15 @@
  * @category   Authentication
  * @package    Auth
- * @author     Lorenzo Alberton <l.alberton@quipo.it> 
+ * @author     Lorenzo Alberton <l.alberton@quipo.it>
  * @author     Adam Ashley <aashley@php.net>
  * @copyright  2001-2006 The PHP Group
  * @license    http://www.php.net/license/3_01.txt  PHP License 3.01
- * @version    CVS: $Id: MDB2.php,v 1.10 2006/03/02 06:53:08 aashley Exp $
+ * @version    CVS: $Id: MDB2.php,v 1.22 2007/06/12 03:11:26 aashley Exp $
  * @link       http://pear.php.net/package/Auth
  * @since      File available since Release 1.3.0
@@ -45 +45 @@
  * @copyright  2001-2006 The PHP Group
  * @license    http://www.php.net/license/3_01.txt  PHP License 3.01
- * @version    Release: 1.3.0  File: $Revision: 1.10 $
+ * @version    Release: 1.5.4  File: $Revision: 1.22 $
  * @link       http://pear.php.net/package/Auth
  * @since      Class available since Release 1.3.0
@@ -110 +110 @@
     function _connect($dsn)
     {
+        $this->log('Auth_Container_MDB2::_connect() called.', AUTH_LOG_DEBUG);
         if (is_string($dsn) || is_array($dsn)) {
             $this->db =& MDB2::connect($dsn, $this->options['db_options']);
@@ -129 +130 @@
             return PEAR::raiseError($this->db->getMessage(), $this->db->code);
         }
+
+        if ($this->options['auto_quote']) {
+            $this->options['final_table'] = $this->db->quoteIdentifier($this->options['table'], true);
+            $this->options['final_usernamecol'] = $this->db->quoteIdentifier($this->options['usernamecol'], true);
+            $this->options['final_passwordcol'] = $this->db->quoteIdentifier($this->options['passwordcol'], true);
+        } else {
+            $this->options['final_table'] = $this->options['table'];
+            $this->options['final_usernamecol'] = $this->options['usernamecol'];
+            $this->options['final_passwordcol'] = $this->options['passwordcol'];
+        }
+
         return true;
     }
@@ -169 +181 @@
     function query($query)
     {
+        $this->log('Auth_Container_MDB2::query() called.', AUTH_LOG_DEBUG);
         $err = $this->_prepare();
         if ($err !== true) {
@@ -194 +207 @@
         $this->options['cryptType']   = 'md5';
         $this->options['db_options']  = array();
+        $this->options['db_where']    = '';
+        $this->options['auto_quote']  = true;
     }
 
@@ -212 +227 @@
             }
         }
-
-        // Include additional fields if they exist
-        if (!empty($this->options['db_fields'])) {
+    }
+
+    // }}}
+    // {{{ _quoteDBFields()
+
+    /**
+     * Quote the db_fields option to avoid the possibility of SQL injection.
+     *
+     * @access private
+     * @return string A properly quoted string that can be concatenated into a
+     * SELECT clause.
+     */
+    function _quoteDBFields()
+    {
+        if (isset($this->options['db_fields'])) {
             if (is_array($this->options['db_fields'])) {
-                $this->options['db_fields'] = join($this->options['db_fields'], ', ');
-            }
-            $this->options['db_fields'] = ', ' . $this->options['db_fields'];
-        }
+                if ($this->options['auto_quote']) {
+                    $fields = array();
+                    foreach ($this->options['db_fields'] as $field) {
+                        $fields[] = $this->db->quoteIdentifier($field, true);
+                    }
+                    return implode(', ', $fields);
+                } else {
+                    return implode(', ', $this->options['db_fields']);
+                }
+            } else {
+                if (strlen($this->options['db_fields']) > 0) {
+                    if ($this->options['auto_quote']) {
+                        return $this->db->quoteIdentifier($this->options['db_fields'], true);
+                    } else {
+                        return $this->options['db_fields'];
+                    }
+                }
+            }
+        }
+
+        return '';
     }
 
@@ -243 +287 @@
     function fetchData($username, $password, $isChallengeResponse=false)
     {
+        $this->log('Auth_Container_MDB2::fetchData() called.', AUTH_LOG_DEBUG);
         // Prepare for a database query
         $err = $this->_prepare();
@@ -250 +295 @@
 
         //Check if db_fields contains a *, if so assume all columns are selected
-        if (strstr($this->options['db_fields'], '*')) {
+        if (is_string($this->options['db_fields'])
+            && strstr($this->options['db_fields'], '*')) {
             $sql_from = '*';
         } else {
-            $sql_from = $this->options['usernamecol'] . ', '. $this->options['passwordcol'] . $this->options['db_fields'];
+            $sql_from = $this->options['final_usernamecol'].
+                ", ".$this->options['final_passwordcol'];
+
+            if (strlen($fields = $this->_quoteDBFields()) > 0) {
+                $sql_from .= ', '.$fields;
+            }
         }
         $query = sprintf("SELECT %s FROM %s WHERE %s = %s",
                          $sql_from,
-                         $this->options['table'],
-                         $this->options['usernamecol'],
+                         $this->options['final_table'],
+                         $this->options['final_usernamecol'],
                          $this->db->quote($username, 'text')
                          );
+
+        // check if there is an optional parameter db_where
+        if ($this->options['db_where'] != '') {
+            // there is one, so add it to the query
+            $query .= " AND ".$this->options['db_where'];
+        }
+
+        $this->log('Running SQL against MDB2: '.$query, AUTH_LOG_DEBUG);
 
         $res = $this->db->queryRow($query, null, MDB2_FETCHMODE_ASSOC);
@@ -292 +351 @@
                     continue;
                 }
+
+                $this->log('Storing additional field: '.$key, AUTH_LOG_DEBUG);
+
                 // Use reference to the auth object if exists
                 // This is because the auth session variable can change so a static call to setAuthData does not make sense
@@ -314 +376 @@
     function listUsers()
     {
+        $this->log('Auth_Container_MDB2::listUsers() called.', AUTH_LOG_DEBUG);
         $err = $this->_prepare();
         if ($err !== true) {
@@ -322 +385 @@
 
         //Check if db_fields contains a *, if so assume all columns are selected
-        if (strstr($this->options['db_fields'], '*')) {
+        if (   is_string($this->options['db_fields'])
+            && strstr($this->options['db_fields'], '*')) {
             $sql_from = '*';
         } else {
-            $sql_from = $this->options['db_fields'];
+            $sql_from = $this->options['final_usernamecol'].
+                ", ".$this->options['final_passwordcol'];
+
+            if (strlen($fields = $this->_quoteDBFields()) > 0) {
+                $sql_from .= ', '.$fields;
+            }
         }
 
         $query = sprintf('SELECT %s FROM %s',
                          $sql_from,
-                         $this->options['table']
+                         $this->options['final_table']
                          );
+
+        // check if there is an optional parameter db_where
+        if ($this->options['db_where'] != '') {
+            // there is one, so add it to the query
+            $query .= " WHERE ".$this->options['db_where'];
+        }
+
+        $this->log('Running SQL against MDB2: '.$query, AUTH_LOG_DEBUG);
 
         $res = $this->db->queryAll($query, null, MDB2_FETCHMODE_ASSOC);
@@ -342 +419 @@
             }
         }
+        $this->log('Found '.count($retVal).' users.', AUTH_LOG_DEBUG);
         return $retVal;
     }
@@ -360 +438 @@
     function addUser($username, $password, $additional = "")
     {
+        $this->log('Auth_Container_MDB2::addUser() called.', AUTH_LOG_DEBUG);
 
         // Prepare for a database query
@@ -382 +461 @@
         if (is_array($additional)) {
             foreach ($additional as $key => $value) {
-                $additional_key   .= ', ' . $key;
+                if ($this->options['auto_quote']) {
+                    $additional_key   .= ', ' . $this->db->quoteIdentifier($key, true);
+                } else {
+                    $additional_key   .= ', ' . $key;
+                }
                 $additional_value .= ', ' . $this->db->quote($value, 'text');
             }
@@ -388 +471 @@
 
         $query = sprintf("INSERT INTO %s (%s, %s%s) VALUES (%s, %s%s)",
-                         $this->options['table'],
-                         $this->options['usernamecol'],
-                         $this->options['passwordcol'],
+                         $this->options['final_table'],
+                         $this->options['final_usernamecol'],
+                         $this->options['final_passwordcol'],
                          $additional_key,
                          $this->db->quote($username, 'text'),
@@ -397 +480 @@
                          );
 
+        $this->log('Running SQL against MDB2: '.$query, AUTH_LOG_DEBUG);
+
         $res = $this->query($query);
 
@@ -418 +503 @@
     function removeUser($username)
     {
+        $this->log('Auth_Container_MDB2::removeUser() called.', AUTH_LOG_DEBUG);
         // Prepare for a database query
         $err = $this->_prepare();
@@ -425 +511 @@
 
         $query = sprintf("DELETE FROM %s WHERE %s = %s",
-                         $this->options['table'],
-                         $this->options['usernamecol'],
+                         $this->options['final_table'],
+                         $this->options['final_usernamecol'],
                          $this->db->quote($username, 'text')
                          );
 
+        // check if there is an optional parameter db_where
+        if ($this->options['db_where'] != '') {
+            // there is one, so add it to the query
+            $query .= " AND ".$this->options['db_where'];
+        }
+
+        $this->log('Running SQL against MDB2: '.$query, AUTH_LOG_DEBUG);
+
         $res = $this->query($query);
 
@@ -449 +543 @@
     function changePassword($username, $password)
     {
+        $this->log('Auth_Container_MDB2::changePassword() called.', AUTH_LOG_DEBUG);
         // Prepare for a database query
         $err = $this->_prepare();
@@ -466 +561 @@
 
         $query = sprintf("UPDATE %s SET %s = %s WHERE %s = %s",
-                         $this->options['table'],
-                         $this->options['passwordcol'],
+                         $this->options['final_table'],
+                         $this->options['final_passwordcol'],
                          $this->db->quote($password, 'text'),
-                         $this->options['usernamecol'],
+                         $this->options['final_usernamecol'],
                          $this->db->quote($username, 'text')
                          );
 
+        // check if there is an optional parameter db_where
+        if ($this->options['db_where'] != '') {
+            // there is one, so add it to the query
+            $query .= " AND ".$this->options['db_where'];
+        }
+
+        $this->log('Running SQL against MDB2: '.$query, AUTH_LOG_DEBUG);
+
         $res = $this->query($query);
 

OpenPNE/trunk/lib/include/Auth/Container/PEAR.php

@@ -19 +19 @@
  * @copyright  2001-2006 The PHP Group
  * @license    http://www.php.net/license/3_01.txt  PHP License 3.01
- * @version    CVS: $Id: PEAR.php,v 1.7 2006/03/02 06:53:08 aashley Exp $
+ * @version    CVS: $Id: PEAR.php,v 1.12 2007/07/02 05:09:43 aharvey Exp $
  * @link       http://pear.php.net/package/Auth
  * @since      File available since Release 1.3.0
@@ -25 +25 @@
 
 /**
+ * Include PEAR HTTP_Client.
+ */
+require_once 'HTTP/Client.php';
+/**
  * Include Auth_Container base class
  */
 require_once 'Auth/Container.php';
-/**
- * Include PEAR XML_RPC
- */
-require_once 'XML/RPC.php';
 
 /**
@@ -43 +43 @@
  * @author     Yavor Shahpasov <yavo@netsmart.com.cy>
  * @author     Adam Ashley <aashley@php.net>
- * @copyright  2001-2006 The PHP Group
+ * @author     Adam Harvey <aharvey@php.net>
+ * @copyright  2001-2007 The PHP Group
  * @license    http://www.php.net/license/3_01.txt  PHP License 3.01
- * @version    Release: 1.3.0  File: $Revision: 1.7 $
+ * @version    Release: 1.5.4  File: $Revision: 1.12 $
  * @link       http://pear.php.net/package/Auth
  * @since      Class available since Release 1.3.0
@@ -58 +59 @@
      *
      * Currently does nothing
-     * 
+     *
      * @return void
      */
     function Auth_Container_Pear()
     {
-    
+
     }
 
     // }}}
     // {{{ fetchData()
-    
+
     /**
      * Get user information from pear.php.net
@@ -81 +82 @@
     function fetchData($username, $password)
     {
-        $rpc = new XML_RPC_Client('/xmlrpc.php', 'pear.php.net');
-        $rpc_message = new XML_RPC_Message("user.info", array(new XML_RPC_Value($username, "string")) );
-        
-        // Error Checking howto ???
-        $result = $rpc->send($rpc_message);
-        $value = $result->value();
-        $userinfo = xml_rpc_decode($value);
-        if ($userinfo['password'] == md5($password)) {
-            $this->activeUser = $userinfo['handle'];
-            foreach ($userinfo as $uk=>$uv) {
-                $this->_auth_obj->setAuthData($uk, $uv);
-            }
-            return true;
+        $this->log('Auth_Container_PEAR::fetchData() called.', AUTH_LOG_DEBUG);
+
+        $client = new HTTP_Client;
+
+        $this->log('Auth_Container_PEAR::fetchData() getting salt.', AUTH_LOG_DEBUG);
+        $code = $client->get('https://pear.php.net/rest-login.php/getsalt');
+        if ($code != 200) {
+            return PEAR::raiseError('Bad response to salt request.', $code);
         }
-        return false;
+        $resp = $client->currentResponse();
+        $salt = $resp['body'];
+
+        $this->log('Auth_Container_PEAR::fetchData() calling validate.', AUTH_LOG_DEBUG);
+        $code = $client->post('https://pear.php.net/rest-login.php/validate',
+                              array('username' => $username,
+                                    'password' => md5($salt.md5($password))));
+        if ($code != 200) {
+            return PEAR::raiseError('Bad response to validate request.', $code);
+        }
+        $resp = $client->currentResponse();
+
+        list($code, $message) = explode(' ', $resp['body'], 1);
+        if ($code != 8) {
+            return PEAR::raiseError($message, $code);
+        }
+        return true;
     }
 
     // }}}
-    
+
 }
 ?>

OpenPNE/trunk/lib/include/Auth/Container/POP3.php

@@ -15 +15 @@
  * @category   Authentication
  * @package    Auth
- * @author     Stefan Ekman <stekman@sedata.org> 
+ * @author     Stefan Ekman <stekman@sedata.org>
  * @author     Martin Jansen <mj@php.net>
- * @author     Mika Tuupola <tuupola@appelsiini.net> 
+ * @author     Mika Tuupola <tuupola@appelsiini.net>
  * @author     Adam Ashley <aashley@php.net>
  * @copyright  2001-2006 The PHP Group
  * @license    http://www.php.net/license/3_01.txt  PHP License 3.01
- * @version    CVS: $Id: POP3.php,v 1.8 2006/03/02 06:53:08 aashley Exp $
+ * @version    CVS: $Id: POP3.php,v 1.12 2007/06/12 03:11:26 aashley Exp $
  * @link       http://pear.php.net/package/Auth
  * @since      File available since Release 1.2.0
@@ -45 +45 @@
  * @package    Auth
  * @author     Martin Jansen <mj@php.net>
- * @author     Mika Tuupola <tuupola@appelsiini.net> 
+ * @author     Mika Tuupola <tuupola@appelsiini.net>
  * @author     Adam Ashley <aashley@php.net>
  * @copyright  2001-2006 The PHP Group
  * @license    http://www.php.net/license/3_01.txt  PHP License 3.01
- * @version    Release: 1.3.0  File: $Revision: 1.8 $
+ * @version    Release: 1.5.4  File: $Revision: 1.12 $
  * @link       http://pear.php.net/package/Auth
  * @since      Class available since Release 1.2.0
@@ -78 +78 @@
      *                      - Attempt this authentication style first
      *                        then fallback to autodetection.
-     * @var mixed 
+     * @var mixed
      */
     var $method=true;
@@ -93 +93 @@
     function Auth_Container_POP3($server=null)
     {
-        if (isset($server)) {
+        if (isset($server) && !is_null($server)) {
             if (is_array($server)) {
                 if (isset($server['host'])) {
@@ -128 +128 @@
     function fetchData($username, $password)
     {
+        $this->log('Auth_Container_POP3::fetchData() called.', AUTH_LOG_DEBUG);
         $pop3 =& new Net_POP3();
         $res = $pop3->connect($this->server, $this->port, $this->method);
         if (!$res) {
+            $this->log('Connection to POP3 server failed.', AUTH_LOG_DEBUG);
             return $res;
         }

OpenPNE/trunk/lib/include/Auth/Container/RADIUS.php

@@ -15 +15 @@
  * @category   Authentication
  * @package    Auth
- * @author     Michael Bretterklieber <michael@bretterklieber.com> 
+ * @author     Michael Bretterklieber <michael@bretterklieber.com>
  * @author     Adam Ashley <aashley@php.net>
  * @copyright  2001-2006 The PHP Group
  * @license    http://www.php.net/license/3_01.txt  PHP License 3.01
- * @version    CVS: $Id: RADIUS.php,v 1.11 2006/03/02 06:53:08 aashley Exp $
+ * @version    CVS: $Id: RADIUS.php,v 1.16 2007/06/12 03:11:26 aashley Exp $
  * @link       http://pear.php.net/package/Auth
  * @since      File available since Release 1.2.0
@@ -42 +42 @@
  * @copyright  2001-2006 The PHP Group
  * @license    http://www.php.net/license/3_01.txt  PHP License 3.01
- * @version    Release: 1.3.0  File: $Revision: 1.11 $
+ * @version    Release: 1.5.4  File: $Revision: 1.16 $
  * @link       http://pear.php.net/package/Auth
  * @since      Class available since Release 1.2.0
@@ -56 +56 @@
      */
     var $radius;
-    
+
     /**
      * Contains the authentication type
      * @var string
      */
-    var $authtype;    
+    var $authtype;
 
     // }}}
@@ -87 +87 @@
         $classname = 'Auth_RADIUS_' . $this->authtype;
         if (!class_exists($classname)) {
-            PEAR::raiseError("Unknown Authtype, please use on of: "
+            PEAR::raiseError("Unknown Authtype, please use one of: "
                     ."PAP, CHAP_MD5, MSCHAPv1, MSCHAPv2!", 41, PEAR_ERROR_DIE);
         }
-        
+
         $this->radius = new $classname;
 
@@ -108 +108 @@
             }
         }
-        
+
         if (!$this->radius->start()) {
             PEAR::raiseError($this->radius->getError(), 41, PEAR_ERROR_DIE);
@@ -126 +126 @@
     function fetchData($username, $password, $challenge = null)
     {
+        $this->log('Auth_Container_RADIUS::fetchData() called.', AUTH_LOG_DEBUG);
+
         switch($this->authtype) {
-        case 'CHAP_MD5':
-        case 'MSCHAPv1':
-            if (isset($challenge)) {
-                echo $password;
-                $this->radius->challenge = $challenge;
-                $this->radius->chapid    = 1;
-                $this->radius->response  = pack('H*', $password);
-            } else {
+            case 'CHAP_MD5':
+            case 'MSCHAPv1':
+                if (isset($challenge)) {
+                    $this->radius->challenge = $challenge;
+                    $this->radius->chapid    = 1;
+                    $this->radius->response  = pack('H*', $password);
+                } else {
+                    require_once 'Crypt/CHAP.php';
+                    $classname = 'Crypt_' . $this->authtype;
+                    $crpt = new $classname;
+                    $crpt->password = $password;
+                    $this->radius->challenge = $crpt->challenge;
+                    $this->radius->chapid    = $crpt->chapid;
+                    $this->radius->response  = $crpt->challengeResponse();
+                }
+                break;
+
+            case 'MSCHAPv2':
                 require_once 'Crypt/CHAP.php';
-                $classname = 'Crypt_' . $this->authtype;
-                $crpt = new $classname;
+                $crpt = new Crypt_MSCHAPv2;
+                $crpt->username = $username;
                 $crpt->password = $password;
-                $this->radius->challenge = $crpt->challenge;
-                $this->radius->chapid    = $crpt->chapid;
-                $this->radius->response  = $crpt->challengeResponse();
+                $this->radius->challenge     = $crpt->authChallenge;
+                $this->radius->peerChallenge = $crpt->peerChallenge;
+                $this->radius->chapid        = $crpt->chapid;
+                $this->radius->response      = $crpt->challengeResponse();
                 break;
-            }
 
-        case 'MSCHAPv2':
-            require_once 'Crypt/CHAP.php';
-            $crpt = new Crypt_MSCHAPv2;
-            $crpt->username = $username;
-            $crpt->password = $password;
-            $this->radius->challenge     = $crpt->authChallenge;
-            $this->radius->peerChallenge = $crpt->peerChallenge;
-            $this->radius->chapid        = $crpt->chapid;
-            $this->radius->response      = $crpt->challengeResponse();
-            break;
-
-        default:
-            $this->radius->password = $password;
-            break;
+            default:
+                $this->radius->password = $password;
+                break;
         }
 

OpenPNE/trunk/lib/include/Auth/Container/SMBPasswd.php

@@ -15 +15 @@
  * @category   Authentication
  * @package    Auth
- * @author     Michael Bretterklieber <michael@bretterklieber.com> 
+ * @author     Michael Bretterklieber <michael@bretterklieber.com>
  * @author     Adam Ashley <aashley@php.net>
  * @copyright  2001-2006 The PHP Group
  * @license    http://www.php.net/license/3_01.txt  PHP License 3.01
- * @version    CVS: $Id: SMBPasswd.php,v 1.5 2006/03/02 06:53:08 aashley Exp $
+ * @version    CVS: $Id: SMBPasswd.php,v 1.8 2007/06/12 03:11:26 aashley Exp $
  * @link       http://pear.php.net/package/Auth
  * @since      File available since Release 1.2.3
@@ -57 +57 @@
  * @copyright  2001-2006 The PHP Group
  * @license    http://www.php.net/license/3_01.txt  PHP License 3.01
- * @version    Release: 1.3.0  File: $Revision: 1.5 $
+ * @version    Release: 1.5.4  File: $Revision: 1.8 $
  * @link       http://pear.php.net/package/Auth
  * @since      Class available since Release 1.2.3
@@ -105 +105 @@
     function fetchData($username, $password)
     {
+        $this->log('Auth_Container_SMBPasswd::fetchData() called.', AUTH_LOG_DEBUG);
         return $this->pwfile->verifyAccount($username, $password);
     }
@@ -110 +111 @@
     // }}}
     // {{{ listUsers()
-    
+
     function listUsers()
     {
+        $this->log('Auth_Container_SMBPasswd::fetchData() called.', AUTH_LOG_DEBUG);
         return $this->pwfile->getAccounts();
     }
@@ -130 +132 @@
     function addUser($username, $password, $additional = '')
     {
+        $this->log('Auth_Container_SMBPasswd::addUser() called.', AUTH_LOG_DEBUG);
         $res = $this->pwfile->addUser($user, $additional['userid'], $pass);
         if ($res === true) {
@@ -147 +150 @@
     function removeUser($username)
     {
+        $this->log('Auth_Container_SMBPasswd::removeUser() called.', AUTH_LOG_DEBUG);
         $res = $this->pwfile->delUser($username);
         if ($res === true) {
@@ -161 +165 @@
      *
      * @param string Username
-     * @param string The new password 
+     * @param string The new password
      */
     function changePassword($username, $password)
     {
-         $res = $this->pwfile->modUser($username, '', $password);
-         if ($res === true) {
-             return $this->pwfile->save();
-         }
-         return $res;
+        $this->log('Auth_Container_SMBPasswd::changePassword() called.', AUTH_LOG_DEBUG);
+        $res = $this->pwfile->modUser($username, '', $password);
+        if ($res === true) {
+            return $this->pwfile->save();
+        }
+        return $res;
     }
 

OpenPNE/trunk/lib/include/Auth/Container/SOAP.php

@@ -15 +15 @@
  * @category   Authentication
  * @package    Auth
- * @author     Bruno Pedro <bpedro@co.sapo.pt> 
+ * @author     Bruno Pedro <bpedro@co.sapo.pt>
  * @author     Adam Ashley <aashley@php.net>
  * @copyright  2001-2006 The PHP Group
  * @license    http://www.php.net/license/3_01.txt  PHP License 3.01
- * @version    CVS: $Id: SOAP.php,v 1.10 2006/03/02 06:53:08 aashley Exp $
+ * @version    CVS: $Id: SOAP.php,v 1.13 2007/06/12 03:11:26 aashley Exp $
  * @link       http://pear.php.net/package/Auth
  * @since      File available since Release 1.2.0
@@ -84 +84 @@
  * @copyright  2001-2006 The PHP Group
  * @license    http://www.php.net/license/3_01.txt  PHP License 3.01
- * @version    Release: 1.3.0  File: $Revision: 1.10 $
+ * @version    Release: 1.5.4  File: $Revision: 1.13 $
  * @link       http://pear.php.net/package/Auth
  * @since      Class available since Release 1.2.0
@@ -171 +171 @@
     function fetchData($username, $password)
     {
+        $this->log('Auth_Container_SOAP::fetchData() called.', AUTH_LOG_DEBUG);
         // check if all required options are set
         if (array_intersect($this->_requiredOptions, array_keys($this->_options)) != $this->_requiredOptions) {

OpenPNE/trunk/lib/include/Auth/Container/vpopmail.php

@@ -15 +15 @@
  * @category   Authentication
  * @package    Auth
- * @author     Stanislav Grozev <tacho@orbitel.bg> 
+ * @author     Stanislav Grozev <tacho@orbitel.bg>
  * @author     Adam Ashley <aashley@php.net>
  * @copyright  2001-2006 The PHP Group
  * @license    http://www.php.net/license/3_01.txt  PHP License 3.01
- * @version    CVS: $Id: vpopmail.php,v 1.7 2006/03/02 06:53:08 aashley Exp $
+ * @version    CVS: $Id: vpopmail.php,v 1.10 2007/06/12 03:11:26 aashley Exp $
  * @link       http://pear.php.net/package/Auth
  * @since      File available since Release 1.2.0
@@ -42 +42 @@
  * @copyright  2001-2006 The PHP Group
  * @license    http://www.php.net/license/3_01.txt  PHP License 3.01
- * @version    Release: 1.3.0  File: $Revision: 1.7 $
+ * @version    Release: 1.5.4  File: $Revision: 1.10 $
  * @link       http://pear.php.net/package/Auth
  * @since      Class available since Release 1.2.0
@@ -75 +75 @@
     function fetchData($username, $password)
     {
+        $this->log('Auth_Container_vpopmail::fetchData() called.', AUTH_LOG_DEBUG);
         $userdata = array();
         $userdata = preg_split("/@/", $username, 2);

OpenPNE/trunk/lib/include/Auth/Controller.php

@@ -19 +19 @@
  * @copyright  2001-2006 The PHP Group
  * @license    http://www.php.net/license/3_01.txt  PHP License 3.01
- * @version    CVS: $Id: Controller.php,v 1.10 2006/03/02 06:53:08 aashley Exp $
+ * @version    CVS: $Id: Controller.php,v 1.11 2007/06/12 03:11:26 aashley Exp $
  * @link       http://pear.php.net/package/Auth
  * @since      File available since Release 1.3.0
@@ -25 +25 @@
 
 /**
- * Controlls access to a group of php access 
- * and redirects to a predefined login page as 
+ * Controlls access to a group of php access
+ * and redirects to a predefined login page as
  * needed
  *
@@ -47 +47 @@
  * if( $authController->isAuthorised() ){
  *   $authController->redirectBack();
- * }  
+ * }
  * </code>
  *
@@ -55 +55 @@
  * @copyright  2001-2006 The PHP Group
  * @license    http://www.php.net/license/3_01.txt  PHP License 3.01
- * @version    Release: 1.3.0  File: $Revision: 1.10 $
+ * @version    Release: 1.5.4  File: $Revision: 1.11 $
  * @link       http://pear.php.net/package/Auth
  * @since      Class available since Release 1.3.0
@@ -64 +64 @@
     // {{{ properties
 
-    /** 
+    /**
      * The Auth instance this controller is managing
      *
@@ -70 +70 @@
      */
     var $auth = null;
-    
+
     /**
      * The login URL
@@ -76 +76 @@
      * */
     var $login = null;
-    
+
     /**
      * The default index page to use when the caller page is not set
      *
-     * @var string 
+     * @var string
      */
     var $default = null;
-    
-    /** 
-     * If this is set to true after a succesfull login the 
-     * Auth_Controller::redirectBack() is invoked automatically 
+
+    /**
+     * If this is set to true after a succesfull login the
+     * Auth_Controller::redirectBack() is invoked automatically
      *
      * @var boolean
@@ -94 +94 @@
     // }}}
     // {{{ Auth_Controller() [constructor]
-    
+
     /**
      * Constructor
@@ -122 +122 @@
     // }}}
     // {{{ setAutoRedirectBack()
-    
-    /** 
+
+    /**
      * Enables auto redirection when login is done
-     * 
+     *
      * @param bool Sets the autoRedirectBack flag to this
      * @see Auth_Controller::autoRedirectBack
@@ -137 +137 @@
     // }}}
     // {{{ redirectBack()
-    
+
     /**
      * Redirects Back to the calling page
@@ -147 +147 @@
         // If redirectback go there
         // else go to the default page
-        
+
         $returnUrl = $this->auth->getAuthData('returnUrl');
         if(!$returnUrl) {
             $returnUrl = $this->_defaultPage;
         }
-        
+
         // Add some entropy to the return to make it unique
         // avoind problems with cached pages and proxies
@@ -163 +163 @@
         if($this->auth->status != '') {
             $url .= '&authstatus='.$this->auth->status;
-        }        
+        }
         header('Location:'.$returnUrl);
         print("You could not be redirected to <a href=\"$returnUrl\">$returnUrl</a>");
@@ -170 +170 @@
     // }}}
     // {{{ redirectLogin()
-    
+
     /**
       * Redirects to the login Page if not authorised
-      * 
+      *
       * put return page on the query or in auth
       *
@@ -181 +181 @@
     {
         // Go to the login Page
-        
+
         // For Auth, put some check to avoid infinite redirects, this should at least exclude
         // the login page
-        
+
         $url = $this->_loginPage;
         if(strpos($url, '?') === false) {
@@ -205 +205 @@
     // }}}
     // {{{ start()
-    
+
     /**
       * Starts the Auth Procedure
@@ -227 +227 @@
             // Logged on and on login page
             if(strstr($_SERVER['PHP_SELF'], $this->_loginPage) && $this->auth->checkAuth()){
-                $this->autoRedirectBack ? 
+                $this->autoRedirectBack ?
                     $this->redirectBack() :
                     null ;
             }
         }
-        
-        
+
+
     }
 
     // }}}
     // {{{ isAuthorised()
-  
+
     /**
       * Checks is the user is logged on

OpenPNE/trunk/lib/include/Auth/Frontend/Html.php

@@ -19 +19 @@
  * @copyright  2001-2006 The PHP Group
  * @license    http://www.php.net/license/3_01.txt  PHP License 3.01
- * @version    CVS: $Id: Html.php,v 1.9 2006/03/02 06:53:08 aashley Exp $
+ * @version    CVS: $Id: Html.php,v 1.11 2007/06/12 03:11:26 aashley Exp $
  * @link       http://pear.php.net/package/Auth
  * @since      File available since Release 1.3.0
@@ -26 +26 @@
 /**
  * Standard Html Login form
- * 
+ *
  * @category   Authentication
  * @package    Auth
@@ -33 +33 @@
  * @copyright  2001-2006 The PHP Group
  * @license    http://www.php.net/license/3_01.txt  PHP License 3.01
- * @version    Release: 1.3.0  File: $Revision: 1.9 $
+ * @version    Release: 1.5.4  File: $Revision: 1.11 $
  * @link       http://pear.php.net/package/Auth
  * @since      Class available since Release 1.3.0
  */
 class Auth_Frontend_Html {
-    
+
     // {{{ render()
 
@@ -50 +50 @@
     function render(&$caller, $username = '') {
         $loginOnClick = 'return true;';
-        
+
         // Try To Use Challene response
         // TODO javascript might need some improvement for work on other browsers
@@ -69 +69 @@
             //print '   alert(pass);alert(secret); '."\n";
 
-            // If using md5 for password storage md5 the password before 
+            // If using md5 for password storage md5 the password before
             // we hash it with the secret
             // print '   alert(pass.value);';
@@ -102 +102 @@
             $status = '<i>Security problem detected. </i>'."\n";
         }
-        
+
         print '<form method="post" action="'.$caller->server['PHP_SELF'].'" '
             .'onSubmit="'.$loginOnClick.'">'."\n";
@@ -114 +114 @@
         print '    <td>Username:</td>'."\n";
         print '    <td><input type="text" id="'.$caller->getPostUsernameField()
-            .'" name="'.$caller->getPostUsernameField().'" value="' . $username 
+            .'" name="'.$caller->getPostUsernameField().'" value="' . $username
             .'" /></td>'."\n";
         print '</tr>'."\n";
@@ -123 +123 @@
         print '</tr>'."\n";
         print '<tr>'."\n";
-        
+
         //onClick=" '.$loginOnClick.' "
         print '    <td colspan="2" bgcolor="#eeeeee"><input value="Login" '
@@ -130 +130 @@
         print '</table>'."\n";
 
-        // Might be a good idea to make the variable name variable 
+        // Might be a good idea to make the variable name variable
         print '<input type="hidden" id="authsecret" name="authsecret" value="" />';
         print '</form>'."\n";
+        print '</center>'."\n";
     }
 
     // }}}
-    
+
 }
 

OpenPNE/trunk/webapp/lib/OpenPNE/Auth.php

@@ -56 +56 @@
     function &factory($login = false)
     {
+        @session_start();
         if ($login) {
             $auth = new Auth($this->storage, $this->options, '', false);