Файловый менеджер

Файловый менеджер - Редактировать - /home/wuectly/www/03cbe/cookie.php.tar

Назад
home/wuectly/www/plugins/authentication/cookie/cookie.php��0000604��00000026743�15245573416�0017773 0��ustar�00��<?php /** * @package Joomla.Plugin * @subpackage Authentication.cookie * * @copyright (C) 2013 Open Source Matters, Inc. <https://www.joomla.org> * @license GNU General Public License version 2 or later; see LICENSE.txt / defined('_JEXEC') or die; /* * Joomla Authentication plugin * * @since 3.2 * @note Code based on http://jaspan.com/improved_persistent_login_cookie_best_practice * and http://fishbowl.pastiche.org/2004/01/19/persistent_login_cookie_best_practice/ / class PlgAuthenticationCookie extends JPlugin { /* * Application object * * @var JApplicationCms * @since 3.2 / protected $app; /* * Database object * * @var JDatabaseDriver * @since 3.2 / protected $db; /* * Reports the privacy related capabilities for this plugin to site administrators. * * @return array * * @since 3.9.0 / public function onPrivacyCollectAdminCapabilities() { $this->loadLanguage(); return array( JText::_('PLG_AUTHENTICATION_COOKIE') => array( JText::_('PLG_AUTH_COOKIE_PRIVACY_CAPABILITY_COOKIE'), ) ); } /* * This method should handle any authentication and report back to the subject * * @param array $credentials Array holding the user credentials * @param array $options Array of extra options * @param object &$response Authentication response object * * @return boolean * * @since 3.2 / public function onUserAuthenticate($credentials, $options, &$response) { // No remember me for admin if ($this->app->isClient('administrator')) { return false; } // Get cookie $cookieName = 'joomla_remember_me_' . JUserHelper::getShortHashedUserAgent(); $cookieValue = $this->app->input->cookie->get($cookieName); // Try with old cookieName (pre 3.6.0) if not found if (!$cookieValue) { $cookieName = JUserHelper::getShortHashedUserAgent(); $cookieValue = $this->app->input->cookie->get($cookieName); } if (!$cookieValue) { return false; } $cookieArray = explode('.', $cookieValue); // Check for valid cookie value if (count($cookieArray) !== 2) { // Destroy the cookie in the browser. $this->app->input->cookie->set($cookieName, '', 1, $this->app->get('cookie_path', '/'), $this->app->get('cookie_domain', '')); JLog::add('Invalid cookie detected.', JLog::WARNING, 'error'); return false; } $response->type = 'Cookie'; // Filter series since we're going to use it in the query $filter = new JFilterInput; $series = $filter->clean($cookieArray[1], 'ALNUM'); // Remove expired tokens $query = $this->db->getQuery(true) ->delete('#__user_keys') ->where($this->db->quoteName('time') . ' < ' . $this->db->quote(time())); try { $this->db->setQuery($query)->execute(); } catch (RuntimeException $e) { // We aren't concerned with errors from this query, carry on } // Find the matching record if it exists. $query = $this->db->getQuery(true) ->select($this->db->quoteName(array('user_id', 'token', 'series', 'time'))) ->from($this->db->quoteName('#__user_keys')) ->where($this->db->quoteName('series') . ' = ' . $this->db->quote($series)) ->where($this->db->quoteName('uastring') . ' = ' . $this->db->quote($cookieName)) ->order($this->db->quoteName('time') . ' DESC'); try { $results = $this->db->setQuery($query)->loadObjectList(); } catch (RuntimeException $e) { $response->status = JAuthentication::STATUS_FAILURE; return false; } if (count($results) !== 1) { // Destroy the cookie in the browser. $this->app->input->cookie->set($cookieName, '', 1, $this->app->get('cookie_path', '/'), $this->app->get('cookie_domain', '')); $response->status = JAuthentication::STATUS_FAILURE; return false; } // We have a user with one cookie with a valid series and a corresponding record in the database. if (!JUserHelper::verifyPassword($cookieArray[0], $results[0]->token)) { / * This is a real attack! * Either the series was guessed correctly or a cookie was stolen and used twice (once by attacker and once by victim). * Delete all tokens for this user! / $query = $this->db->getQuery(true) ->delete('#__user_keys') ->where($this->db->quoteName('user_id') . ' = ' . $this->db->quote($results[0]->user_id)); try { $this->db->setQuery($query)->execute(); } catch (RuntimeException $e) { // Log an alert for the site admin JLog::add( sprintf('Failed to delete cookie token for user %s with the following error: %s', $results[0]->user_id, $e->getMessage()), JLog::WARNING, 'security' ); } // Destroy the cookie in the browser. $this->app->input->cookie->set($cookieName, '', 1, $this->app->get('cookie_path', '/'), $this->app->get('cookie_domain', '')); // Issue warning by email to user and/or admin? JLog::add(JText::sprintf('PLG_AUTH_COOKIE_ERROR_LOG_LOGIN_FAILED', $results[0]->user_id), JLog::WARNING, 'security'); $response->status = JAuthentication::STATUS_FAILURE; return false; } // Make sure there really is a user with this name and get the data for the session. $query = $this->db->getQuery(true) ->select($this->db->quoteName(array('id', 'username', 'password'))) ->from($this->db->quoteName('#__users')) ->where($this->db->quoteName('username') . ' = ' . $this->db->quote($results[0]->user_id)) ->where($this->db->quoteName('requireReset') . ' = 0'); try { $result = $this->db->setQuery($query)->loadObject(); } catch (RuntimeException $e) { $response->status = JAuthentication::STATUS_FAILURE; return false; } if ($result) { // Bring this in line with the rest of the system $user = JUser::getInstance($result->id); // Set response data. $response->username = $result->username; $response->email = $user->email; $response->fullname = $user->name; $response->password = $result->password; $response->language = $user->getParam('language'); // Set response status. $response->status = JAuthentication::STATUS_SUCCESS; $response->error_message = ''; } else { $response->status = JAuthentication::STATUS_FAILURE; $response->error_message = JText::_('JGLOBAL_AUTH_NO_USER'); } } /* * We set the authentication cookie only after login is successfully finished. * We set a new cookie either for a user with no cookies or one * where the user used a cookie to authenticate. * * @param array $options Array holding options * * @return boolean True on success * * @since 3.2 / public function onUserAfterLogin($options) { // No remember me for admin if ($this->app->isClient('administrator')) { return false; } if (isset($options['responseType']) && $options['responseType'] === 'Cookie') { // Logged in using a cookie $cookieName = 'joomla_remember_me_' . JUserHelper::getShortHashedUserAgent(); // We need the old data to get the existing series $cookieValue = $this->app->input->cookie->get($cookieName); // Try with old cookieName (pre 3.6.0) if not found if (!$cookieValue) { $oldCookieName = JUserHelper::getShortHashedUserAgent(); $cookieValue = $this->app->input->cookie->get($oldCookieName); // Destroy the old cookie in the browser $this->app->input->cookie->set($oldCookieName, '', 1, $this->app->get('cookie_path', '/'), $this->app->get('cookie_domain', '')); } $cookieArray = explode('.', $cookieValue); // Filter series since we're going to use it in the query $filter = new JFilterInput; $series = $filter->clean($cookieArray[1], 'ALNUM'); } elseif (!empty($options['remember'])) { // Remember checkbox is set $cookieName = 'joomla_remember_me_' . JUserHelper::getShortHashedUserAgent(); // Create a unique series which will be used over the lifespan of the cookie $unique = false; $errorCount = 0; do { $series = JUserHelper::genRandomPassword(20); $query = $this->db->getQuery(true) ->select($this->db->quoteName('series')) ->from($this->db->quoteName('#__user_keys')) ->where($this->db->quoteName('series') . ' = ' . $this->db->quote($series)); try { $results = $this->db->setQuery($query)->loadResult(); if ($results === null) { $unique = true; } } catch (RuntimeException $e) { $errorCount++; // We'll let this query fail up to 5 times before giving up, there's probably a bigger issue at this point if ($errorCount === 5) { return false; } } } while ($unique === false); } else { return false; } // Get the parameter values $lifetime = $this->params->get('cookie_lifetime', 60) 24 * 60 * 60; $length = $this->params->get('key_length', 16); // Generate new cookie $token = JUserHelper::genRandomPassword($length); $cookieValue = $token . '.' . $series; // Overwrite existing cookie with new value $this->app->input->cookie->set( $cookieName, $cookieValue, time() + $lifetime, $this->app->get('cookie_path', '/'), $this->app->get('cookie_domain', ''), $this->app->isHttpsForced(), true ); $query = $this->db->getQuery(true); if (!empty($options['remember'])) { // Create new record $query ->insert($this->db->quoteName('#__user_keys')) ->set($this->db->quoteName('user_id') . ' = ' . $this->db->quote($options['user']->username)) ->set($this->db->quoteName('series') . ' = ' . $this->db->quote($series)) ->set($this->db->quoteName('uastring') . ' = ' . $this->db->quote($cookieName)) ->set($this->db->quoteName('time') . ' = ' . (time() + $lifetime)); } else { // Update existing record with new token $query ->update($this->db->quoteName('#__user_keys')) ->where($this->db->quoteName('user_id') . ' = ' . $this->db->quote($options['user']->username)) ->where($this->db->quoteName('series') . ' = ' . $this->db->quote($series)) ->where($this->db->quoteName('uastring') . ' = ' . $this->db->quote($cookieName)); } $hashedToken = JUserHelper::hashPassword($token); $query->set($this->db->quoteName('token') . ' = ' . $this->db->quote($hashedToken)); try { $this->db->setQuery($query)->execute(); } catch (RuntimeException $e) { return false; } return true; } /** * This is where we delete any authentication cookie when a user logs out * * @param array $options Array holding options (length, timeToExpiration) * * @return boolean True on success * * @since 3.2 / public function onUserAfterLogout($options) { // No remember me for admin if ($this->app->isClient('administrator')) { return false; } $cookieName = 'joomla_remember_me_' . JUserHelper::getShortHashedUserAgent(); $cookieValue = $this->app->input->cookie->get($cookieName); // There are no cookies to delete. if (!$cookieValue) { return true; } $cookieArray = explode('.', $cookieValue); // Filter series since we're going to use it in the query $filter = new JFilterInput; $series = $filter->clean($cookieArray[1], 'ALNUM'); // Remove the record from the database $query = $this->db->getQuery(true) ->delete('#__user_keys') ->where($this->db->quoteName('series') . ' = ' . $this->db->quote($series)); try { $this->db->setQuery($query)->execute(); } catch (RuntimeException $e) { // We aren't concerned with errors from this query, carry on } // Destroy the cookie $this->app->input->cookie->set($cookieName, '', 1, $this->app->get('cookie_path', '/'), $this->app->get('cookie_domain', '')); return true; } } ��home/wuectly/www/libraries/fof/input/jinput/cookie.php��0000604��00000007621�15245607031�0017201 0��ustar�00��<?php /* * @package Joomla.Platform * @subpackage Input * * @copyright (C) 2016 Open Source Matters, Inc. <https://www.joomla.org> * @license GNU General Public License version 2 or later; see LICENSE / defined('JPATH_PLATFORM') or die; /* * Joomla! Input Cookie Class * * @since 11.1 / class JInputCookie extends JInput { /* * Constructor. * * @param array $source Ignored. * @param array $options Array of configuration parameters (Optional) * * @since 11.1 / public function __construct(array $source = null, array $options = array()) { if (isset($options['filter'])) { $this->filter = $options['filter']; } else { $this->filter = JFilterInput::getInstance(); } // Set the data source. $this->data = & $_COOKIE; // Set the options for the class. $this->options = $options; } /* * Sets a value * * @param string $name Name of the value to set. * @param mixed $value Value to assign to the input. * @param integer $expire The time the cookie expires. This is a Unix timestamp so is in number * of seconds since the epoch. In other words, you'll most likely set this * with the time() function plus the number of seconds before you want it * to expire. Or you might use mktime(). time()+60602430 will set the cookie to expire in 30 days. If set to 0, or omitted, the cookie will * expire at the end of the session (when the browser closes). * @param string $path The path on the server in which the cookie will be available on. If set * to '/', the cookie will be available within the entire domain. If set to * '/foo/', the cookie will only be available within the /foo/ directory and * all sub-directories such as /foo/bar/ of domain. The default value is the * current directory that the cookie is being set in. * @param string $domain The domain that the cookie is available to. To make the cookie available * on all subdomains of example.com (including example.com itself) then you'd * set it to '.example.com'. Although some browsers will accept cookies without * the initial ., RFC 2109 requires it to be included. Setting the domain to * 'www.example.com' or '.www.example.com' will make the cookie only available * in the www subdomain. * @param boolean $secure Indicates that the cookie should only be transmitted over a secure HTTPS * connection from the client. When set to TRUE, the cookie will only be set * if a secure connection exists. On the server-side, it's on the programmer * to send this kind of cookie only on secure connection (e.g. with respect * to $_SERVER["HTTPS"]). * @param boolean $httpOnly When TRUE the cookie will be made accessible only through the HTTP protocol. * This means that the cookie won't be accessible by scripting languages, such * as JavaScript. This setting can effectively help to reduce identity theft * through XSS attacks (although it is not supported by all browsers). * * @return void * * @link http://www.ietf.org/rfc/rfc2109.txt * @see setcookie() * @since 11.1 */ public function set($name, $value, $expire = 0, $path = '', $domain = '', $secure = false, $httpOnly = false) { setcookie($name, $value, $expire, $path, $domain, $secure, $httpOnly); $this->data[$name] = $value; } } ��

| ver. 1.4 | Github | . | PHP 8.1.34 | Генерация страницы: 0 | proxy | phpinfo | Настройка