<?php
$timestamp = time();
// $time =
-$signature = md5( $timestamp . '' );
-// $signature = ""
+$signature = hash('sha256', $timestamp . '' );
+// $signature = ""
?>
signature and timestamp in your API requests. Example:' ); ?>
diff --git a/composer.json b/composer.json index 9dd04fe..0dade84 100644 --- a/composer.json +++ b/composer.json @@ -1,6 +1,6 @@ { - "name": "utcweb/utctiny", - "description": "UTC: Your Own URL Shortener", + "name": "yourls/yourls", + "description": "Your Own URL Shortener", "type": "project", "keywords": [ "shortener", @@ -9,11 +9,11 @@ "url", "bitly" ], - "homepage": "https://go.utc.edu", + "homepage": "https://yourls.org", "license": "MIT", "support": { - "issues": "https://github.com/UTCWeb/utctiny/issues", - "source": "https://github.com/UTCWeb/utctiny" + "issues": "https://github.com/YOURLS/YOURLS/issues", + "source": "https://github.com/YOURLS/YOURLS" }, "require": { "php": "^8.1", @@ -27,25 +27,12 @@ "rmccue/requests" : "^2.0", "pomo/pomo" : "^1.4", "geoip2/geoip2" : "^2.10", - "aura/sql": "^5.0 | ^6.0", + "aura/sql": "^6.0", "jakeasmith/http_build_url": "^1.0", "symfony/polyfill-mbstring": "^1.15", "symfony/polyfill-intl-idn": "^1.17", - "spatie/array-to-xml": "^3.4", - "yourls/seans-qrcode": "dev-develop as 1.x-dev", - "yourls/yourls-saml": "dev-develop as 1.x-dev", - "platformsh/laravel-bridge": "^1.1" + "spatie/array-to-xml": "^3.4" }, - "repositories": [ - { - "type": "path", - "url": "user/plugins/seans-qrcode" - }, - { - "type": "path", - "url": "user/plugins/yourls-saml" - } - ], "require-dev": { "ext-ctype": "*" }, @@ -53,7 +40,8 @@ "vendor-dir": "includes/vendor", "platform": { "php": "8.1.0" - } + }, + "platform-check": false }, "autoload": { "psr-4": { @@ -72,12 +60,6 @@ "ext-zlib": "For best performance" }, "scripts": { - "install-plugin-deps": [ - "bash -c \"find user/plugins -name \\\"composer.json\\\" -type f -exec dirname {} \\; | xargs -I{} bash -c 'echo \\\"Installing dependencies for {}\\\" && cd {} && composer install && cd - > /dev/null'\"" - ], - "post-install-cmd": [ - "@install-plugin-deps" - ], "post-update-cmd": "bash ./includes/vendor/build-script/yourls-build.sh ./includes/vendor" } } diff --git a/composer.lock b/composer.lock index d8919ca..c2030a0 100644 --- a/composer.lock +++ b/composer.lock @@ -4,25 +4,25 @@ "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies", "This file is @generated automatically" ], - "content-hash": "58d57b4c8cbf687a308bed29678dcc59", + "content-hash": "9aaa57cfc41c85172bc72eb82b7ae94e", "packages": [ { "name": "aura/sql", - "version": "5.0.3", + "version": "6.0.0", "source": { "type": "git", "url": "https://github.com/auraphp/Aura.Sql.git", - "reference": "fd7a6dd1c9d2a1da5754c50f287f8be8a27db0e7" + "reference": "8e2bb362e8953198df3682c9122e8b9edab5ff20" }, "dist": { "type": "zip", - "url": "https://api.github.com/repos/auraphp/Aura.Sql/zipball/fd7a6dd1c9d2a1da5754c50f287f8be8a27db0e7", - "reference": "fd7a6dd1c9d2a1da5754c50f287f8be8a27db0e7", + "url": "https://api.github.com/repos/auraphp/Aura.Sql/zipball/8e2bb362e8953198df3682c9122e8b9edab5ff20", + "reference": "8e2bb362e8953198df3682c9122e8b9edab5ff20", "shasum": "" }, "require": { "ext-pdo": "*", - "php": ">=8.1", + "php": "^8.4", "psr/log": "^1.0 || ^2.0 || ^3.0" }, "require-dev": { @@ -60,155 +60,9 @@ ], "support": { "issues": "https://github.com/auraphp/Aura.Sql/issues", - "source": "https://github.com/auraphp/Aura.Sql/tree/5.0.3" + "source": "https://github.com/auraphp/Aura.Sql/tree/6.0.0" }, - "time": "2025-01-22T06:39:17+00:00" - }, - { - "name": "chillerlan/php-qrcode", - "version": "4.4.2", - "source": { - "type": "git", - "url": "https://github.com/chillerlan/php-qrcode.git", - "reference": "345ed8e4ffb56e6b3fcd9f42e3970b9026fa6ce4" - }, - "dist": { - "type": "zip", - "url": "https://api.github.com/repos/chillerlan/php-qrcode/zipball/345ed8e4ffb56e6b3fcd9f42e3970b9026fa6ce4", - "reference": "345ed8e4ffb56e6b3fcd9f42e3970b9026fa6ce4", - "shasum": "" - }, - "require": { - "chillerlan/php-settings-container": "^2.1.6 || ^3.2.1", - "ext-mbstring": "*", - "php": "^7.4 || ^8.0" - }, - "require-dev": { - "phan/phan": "^5.4.5", - "phpmd/phpmd": "^2.15", - "phpunit/phpunit": "^9.6", - "setasign/fpdf": "^1.8.2", - "squizlabs/php_codesniffer": "^3.11" - }, - "suggest": { - "chillerlan/php-authenticator": "Yet another Google authenticator! Also creates URIs for mobile apps.", - "setasign/fpdf": "Required to use the QR FPDF output.", - "simple-icons/simple-icons": "SVG icons that you can use to embed as logos in the QR Code" - }, - "type": "library", - "autoload": { - "psr-4": { - "chillerlan\\QRCode\\": "src/" - } - }, - "notification-url": "https://packagist.org/downloads/", - "license": [ - "MIT" - ], - "authors": [ - { - "name": "Kazuhiko Arase", - "homepage": "https://github.com/kazuhikoarase" - }, - { - "name": "Smiley", - "email": "smiley@chillerlan.net", - "homepage": "https://github.com/codemasher" - }, - { - "name": "Contributors", - "homepage": "https://github.com/chillerlan/php-qrcode/graphs/contributors" - } - ], - "description": "A QR code generator with a user friendly API. PHP 7.4+", - "homepage": "https://github.com/chillerlan/php-qrcode", - "keywords": [ - "phpqrcode", - "qr", - "qr code", - "qrcode", - "qrcode-generator" - ], - "support": { - "issues": "https://github.com/chillerlan/php-qrcode/issues", - "source": "https://github.com/chillerlan/php-qrcode/tree/4.4.2" - }, - "funding": [ - { - "url": "https://ko-fi.com/codemasher", - "type": "ko_fi" - } - ], - "time": "2024-11-15T15:36:24+00:00" - }, - { - "name": "chillerlan/php-settings-container", - "version": "3.3.0", - "source": { - "type": "git", - "url": "https://github.com/chillerlan/php-settings-container.git", - "reference": "a0a487cbf5344f721eb504bf0f59bada40c381b7" - }, - "dist": { - "type": "zip", - "url": "https://api.github.com/repos/chillerlan/php-settings-container/zipball/a0a487cbf5344f721eb504bf0f59bada40c381b7", - "reference": "a0a487cbf5344f721eb504bf0f59bada40c381b7", - "shasum": "" - }, - "require": { - "ext-json": "*", - "php": "^8.1" - }, - "require-dev": { - "phan/phan": "^5.5.2", - "phpmd/phpmd": "^2.15", - "phpstan/phpstan": "^2.1.31", - "phpstan/phpstan-deprecation-rules": "^2.0.3", - "phpunit/phpunit": "^10.5", - "slevomat/coding-standard": "^8.22", - "squizlabs/php_codesniffer": "^4.0" - }, - "type": "library", - "autoload": { - "psr-4": { - "chillerlan\\Settings\\": "src" - } - }, - "notification-url": "https://packagist.org/downloads/", - "license": [ - "MIT" - ], - "authors": [ - { - "name": "Smiley", - "email": "smiley@chillerlan.net", - "homepage": "https://github.com/codemasher" - } - ], - "description": "A container class for immutable settings objects. Not a DI container.", - "homepage": "https://github.com/chillerlan/php-settings-container", - "keywords": [ - "Settings", - "configuration", - "container", - "helper", - "property hook" - ], - "support": { - "issues": "https://github.com/chillerlan/php-settings-container/issues", - "source": "https://github.com/chillerlan/php-settings-container" - }, - "funding": [ - { - "url": "https://www.paypal.com/donate?hosted_button_id=WLYUNAT9ZTJZ4", - "type": "custom" - }, - { - "url": "https://ko-fi.com/codemasher", - "type": "ko_fi" - } - ], - "time": "2026-03-20T21:10:52+00:00" + "time": "2025-01-22T06:43:21+00:00" }, { "name": "composer/ca-bundle", @@ -492,70 +346,6 @@ }, "time": "2026-01-13T17:56:03+00:00" }, - { - "name": "onelogin/php-saml", - "version": "4.3.2", - "source": { - "type": "git", - "url": "https://github.com/SAML-Toolkits/php-saml.git", - "reference": "26b3a47349415e5b7aa300ba4ab7fc316c65f19e" - }, - "dist": { - "type": "zip", - "url": "https://api.github.com/repos/SAML-Toolkits/php-saml/zipball/26b3a47349415e5b7aa300ba4ab7fc316c65f19e", - "reference": "26b3a47349415e5b7aa300ba4ab7fc316c65f19e", - "shasum": "" - }, - "require": { - "php": ">=7.3", - "robrichards/xmlseclibs": "^3.1.5" - }, - "require-dev": { - "pdepend/pdepend": "^2.8.0", - "php-coveralls/php-coveralls": "^2.0", - "phploc/phploc": "^4.0 || ^5.0 || ^6.0 || ^7.0", - "phpunit/phpunit": "^9.5", - "sebastian/phpcpd": "^4.0 || ^5.0 || ^6.0 ", - "squizlabs/php_codesniffer": "^3.5.8" - }, - "suggest": { - "ext-curl": "Install curl lib to be able to use the IdPMetadataParser for parsing remote XMLs", - "ext-dom": "Install xml lib", - "ext-openssl": "Install openssl lib in order to handle with x509 certs (require to support sign and encryption)", - "ext-zlib": "Install zlib" - }, - "type": "library", - "autoload": { - "psr-4": { - "OneLogin\\": "src/" - } - }, - "notification-url": "https://packagist.org/downloads/", - "license": [ - "MIT" - ], - "description": "PHP SAML Toolkit", - "homepage": "https://github.com/SAML-Toolkits/php-saml", - "keywords": [ - "Federation", - "SAML2", - "SSO", - "identity", - "saml" - ], - "support": { - "email": "sixto.martin.garcia@gmail.com", - "issues": "https://github.com/onelogin/SAML-Toolkits/issues", - "source": "https://github.com/onelogin/SAML-Toolkits/" - }, - "funding": [ - { - "url": "https://github.com/SAML-Toolkits", - "type": "github" - } - ], - "time": "2026-05-07T22:38:04+00:00" - }, { "name": "ozh/bookmarkletgen", "version": "1.3", @@ -601,94 +391,6 @@ }, "time": "2025-11-07T17:20:10+00:00" }, - { - "name": "platformsh/config-reader", - "version": "3.0.1", - "source": { - "type": "git", - "url": "https://github.com/platformsh/config-reader-php.git", - "reference": "cab2b6c0cdfc318df09a64136957dc1fc308f418" - }, - "dist": { - "type": "zip", - "url": "https://api.github.com/repos/platformsh/config-reader-php/zipball/cab2b6c0cdfc318df09a64136957dc1fc308f418", - "reference": "cab2b6c0cdfc318df09a64136957dc1fc308f418", - "shasum": "" - }, - "require": { - "php": ">=7.4" - }, - "require-dev": { - "phpunit/phpunit": "^8.5" - }, - "type": "library", - "autoload": { - "psr-4": { - "Platformsh\\ConfigReader\\": "src" - } - }, - "notification-url": "https://packagist.org/downloads/", - "license": [ - "MIT" - ], - "authors": [ - { - "name": "Larry Garfield", - "email": "larry@platform.sh" - } - ], - "description": "Small helper to access Platform.sh environment variables", - "support": { - "issues": "https://github.com/platformsh/config-reader-php/issues", - "source": "https://github.com/platformsh/config-reader-php/tree/3.0.1" - }, - "time": "2025-02-25T17:22:15+00:00" - }, - { - "name": "platformsh/laravel-bridge", - "version": "1.1", - "source": { - "type": "git", - "url": "https://github.com/platformsh/laravel-bridge.git", - "reference": "9ae82479a36dfb68d2b41bd34f7d3912b929024c" - }, - "dist": { - "type": "zip", - "url": "https://api.github.com/repos/platformsh/laravel-bridge/zipball/9ae82479a36dfb68d2b41bd34f7d3912b929024c", - "reference": "9ae82479a36dfb68d2b41bd34f7d3912b929024c", - "shasum": "" - }, - "require-dev": { - "phpunit/phpunit": "^7.0" - }, - "type": "library", - "extra": { - "branch-alias": { - "dev-master": "1.0.x-dev" - } - }, - "autoload": { - "files": [ - "platformsh-laravel-env.php" - ] - }, - "notification-url": "https://packagist.org/downloads/", - "license": [ - "MIT" - ], - "authors": [ - { - "name": "Larry Garfield", - "email": "larry@platform.sh" - } - ], - "description": "Bridge library for running Symfony Flex on Platform.sh", - "support": { - "issues": "https://github.com/platformsh/laravel-bridge/issues", - "source": "https://github.com/platformsh/laravel-bridge/tree/master" - }, - "time": "2018-10-15T18:09:39+00:00" - }, { "name": "pomo/pomo", "version": "v1.5.0", @@ -893,48 +595,6 @@ }, "time": "2026-04-30T00:41:23+00:00" }, - { - "name": "robrichards/xmlseclibs", - "version": "3.1.5", - "source": { - "type": "git", - "url": "https://github.com/robrichards/xmlseclibs.git", - "reference": "03062be78178cbb5e8f605cd255dc32a14981f92" - }, - "dist": { - "type": "zip", - "url": "https://api.github.com/repos/robrichards/xmlseclibs/zipball/03062be78178cbb5e8f605cd255dc32a14981f92", - "reference": "03062be78178cbb5e8f605cd255dc32a14981f92", - "shasum": "" - }, - "require": { - "ext-openssl": "*", - "php": ">= 5.4" - }, - "type": "library", - "autoload": { - "psr-4": { - "RobRichards\\XMLSecLibs\\": "src" - } - }, - "notification-url": "https://packagist.org/downloads/", - "license": [ - "BSD-3-Clause" - ], - "description": "A PHP library for XML Security", - "homepage": "https://github.com/robrichards/xmlseclibs", - "keywords": [ - "security", - "signature", - "xml", - "xmldsig" - ], - "support": { - "issues": "https://github.com/robrichards/xmlseclibs/issues", - "source": "https://github.com/robrichards/xmlseclibs/tree/3.1.5" - }, - "time": "2026-03-13T10:31:56+00:00" - }, { "name": "spatie/array-to-xml", "version": "3.4.4", @@ -1177,16 +837,16 @@ }, { "name": "symfony/polyfill-mbstring", - "version": "v1.38.2", + "version": "v1.38.1", "source": { "type": "git", "url": "https://github.com/symfony/polyfill-mbstring.git", - "reference": "d3d318bad5e7a1bfbd026009c8bfb8d8f99ae6b6" + "reference": "14c5439eec4ccff081ac14eca2dc57feb2a66d92" }, "dist": { "type": "zip", - "url": "https://api.github.com/repos/symfony/polyfill-mbstring/zipball/d3d318bad5e7a1bfbd026009c8bfb8d8f99ae6b6", - "reference": "d3d318bad5e7a1bfbd026009c8bfb8d8f99ae6b6", + "url": "https://api.github.com/repos/symfony/polyfill-mbstring/zipball/14c5439eec4ccff081ac14eca2dc57feb2a66d92", + "reference": "14c5439eec4ccff081ac14eca2dc57feb2a66d92", "shasum": "" }, "require": { @@ -1238,7 +898,7 @@ "shim" ], "support": { - "source": "https://github.com/symfony/polyfill-mbstring/tree/v1.38.2" + "source": "https://github.com/symfony/polyfill-mbstring/tree/v1.38.1" }, "funding": [ { @@ -1258,67 +918,13 @@ "type": "tidelift" } ], - "time": "2026-05-27T06:59:30+00:00" - }, - { - "name": "yourls/seans-qrcode", - "version": "dev-develop", - "dist": { - "type": "path", - "url": "user/plugins/seans-qrcode", - "reference": "3e788bc8c3c0079257114a51b0c9f3b4d44dd7cf" - }, - "require": { - "chillerlan/php-qrcode": "^4.4.0", - "ext-gd": "*", - "ext-mbstring": "*", - "php": "^8.0" - }, - "type": "yourls-plugin", - "description": "QR Code plugin for YOURLS", - "transport-options": { - "relative": true - } - }, - { - "name": "yourls/yourls-saml", - "version": "dev-develop", - "dist": { - "type": "path", - "url": "user/plugins/yourls-saml", - "reference": "4df0a07eac5bca340fd5f814af24daf5d6a316c2" - }, - "require": { - "onelogin/php-saml": "^4.0", - "platformsh/config-reader": "^3.0" - }, - "type": "yourls-plugin", - "description": "SAML Authentication for YOURLS", - "transport-options": { - "relative": true - } + "time": "2026-05-26T12:51:13+00:00" } ], "packages-dev": [], - "aliases": [ - { - "package": "yourls/seans-qrcode", - "version": "dev-develop", - "alias": "1.x-dev", - "alias_normalized": "1.9999999.9999999.9999999-dev" - }, - { - "package": "yourls/yourls-saml", - "version": "dev-develop", - "alias": "1.x-dev", - "alias_normalized": "1.9999999.9999999.9999999-dev" - } - ], + "aliases": [], "minimum-stability": "stable", - "stability-flags": { - "yourls/seans-qrcode": 20, - "yourls/yourls-saml": 20 - }, + "stability-flags": {}, "prefer-stable": false, "prefer-lowest": false, "platform": { diff --git a/includes/Config/Config.php b/includes/Config/Config.php index 2f726d2..e07cbfe 100644 --- a/includes/Config/Config.php +++ b/includes/Config/Config.php @@ -20,6 +20,29 @@ class Config { */ protected string $config; + /** + * Constants that must be defined in config.php + */ + protected const MANDATORY_CONSTANTS = [ + 'YOURLS_DB_USER', + 'YOURLS_DB_PASS', + 'YOURLS_DB_NAME', + 'YOURLS_DB_HOST', + 'YOURLS_DB_PREFIX', + 'YOURLS_SITE', + ]; + + /** + * Publicly known values that are not acceptable for YOURLS_COOKIEKEY + */ + protected const INVALID_COOKIEKEYS = [ + '', + 'modify this text with something random', // default value in config-sample.php + 'qQ4KhL_pu|s@Zm7n#%:b^{A[vhm', // suggested value in the documentation + ]; + + + /** * @since 1.7.3 * @param string $config Optional user defined config path @@ -93,26 +116,52 @@ public function find_config(): string { } /** - * Define core constants that have not been user defined in config.php + * Check that all mandatory constants are defined * - * @since 1.7.3 + * @since 1.10.5 + * @param string[] $must_haves Constant names to check, defaults to self::MANDATORY_CONSTANTS * @return void * @throws ConfigException */ - public function define_core_constants(): void { - // Check minimal config job has been properly done - $must_haves = array('YOURLS_DB_USER', 'YOURLS_DB_PASS', 'YOURLS_DB_NAME', 'YOURLS_DB_HOST', 'YOURLS_DB_PREFIX', 'YOURLS_SITE'); - foreach($must_haves as $must_have) { + public function check_mandatory_constants(array $must_haves = self::MANDATORY_CONSTANTS): void { + foreach ($must_haves as $must_have) { if (!defined($must_have)) { throw new ConfigException('Config is incomplete (missing at least '.$must_have.') Check config-sample.php and edit your config accordingly'); } } + } + + /** + * Check that the cookie key is defined and is not a publicly known value + * + * @since 1.10.5 + * @param mixed $key Cookie key value, or null if the constant is undefined + * @return void + * @throws ConfigException + */ + public function check_cookie_key(mixed $key): void { + if (!is_string($key) || in_array($key, self::INVALID_COOKIEKEYS, true)) { + throw new ConfigException('YOURLS_COOKIEKEY is undefined or still set to the sample value. Set it to a long random string, see https://yourls.org/cookiedoc'); + } + } + + /** + * Define core constants that have not been user defined in config.php + * + * @since 1.7.3 + * @return void + * @throws ConfigException + */ + public function define_core_constants(): void { + // Check minimal config job has been properly done + $this->check_mandatory_constants(); + $this->check_cookie_key(defined('YOURLS_COOKIEKEY') ? YOURLS_COOKIEKEY : null); /** * The following has an awful CRAP index and it would be much shorter reduced to something like * defining an array of ('YOURLS_SOMETHING' => 'default value') and then a simple loop over the * array, checking if $current is defined as a constant and otherwise define said constant with - * its default value. I did not wrote it that way because that would make it difficult for code + * its default value. I did not write it that way because that would make it difficult for code * parsers to identify which constants are defined and where. So, here it is, that long list of * if (!defined) define(). Ho and by the way, such beautiful comment, much right aligned, wow ! */ @@ -177,30 +226,6 @@ public function define_core_constants(): void { if (!defined( 'YOURLS_DB_TABLE_LOG' )) define( 'YOURLS_DB_TABLE_LOG', YOURLS_DB_PREFIX.'log' ); - // minimum delay in sec before a same IP can add another URL. Note: logged in users are not throttled down. - if (!defined( 'YOURLS_FLOOD_DELAY_SECONDS' )) - define( 'YOURLS_FLOOD_DELAY_SECONDS', 15 ); - - // comma separated list of IPs that can bypass flood check. - if (!defined( 'YOURLS_FLOOD_IP_WHITELIST' )) - define( 'YOURLS_FLOOD_IP_WHITELIST', '' ); - - // life span of an auth cookie in seconds (60*60*24*7 = 7 days) - if (!defined( 'YOURLS_COOKIE_LIFE' )) - define( 'YOURLS_COOKIE_LIFE', 60*60*24*7 ); - - // life span of a nonce in seconds - if (!defined( 'YOURLS_NONCE_LIFE' )) - define( 'YOURLS_NONCE_LIFE', 43200 ); // 3600 * 12 - - // if set to true, disable stat logging (no use for it, too busy servers, ...) - if (!defined( 'YOURLS_NOSTATS' )) - define( 'YOURLS_NOSTATS', false ); - - // if set to true, force https:// in the admin area - if (!defined( 'YOURLS_ADMIN_SSL' )) - define( 'YOURLS_ADMIN_SSL', false ); - // if set to true, verbose debug infos if (!defined( 'YOURLS_DEBUG' )) { define('YOURLS_DEBUG', false); diff --git a/includes/auth.php b/includes/auth.php index be98a87..1d2016f 100644 --- a/includes/auth.php +++ b/includes/auth.php @@ -29,14 +29,23 @@ /* * The following code is a shim that helps users store passwords securely in config.php - * by storing a password hash and removing the plaintext. + * by storing a password hash and removing the plaintext or md5 * * TODO: Remove this once real user management is implemented */ -// Did we just fail at encrypting passwords ? -if ( isset( $_GET['dismiss'] ) && $_GET['dismiss'] == 'hasherror' ) { - yourls_update_option( 'defer_hashing_error', time() + 86400 * 7 ); // now + 1 week +// Did we just fail at encrypting passwords, or did we just notice md5 passwords? +if ( isset( $_GET['dismiss'] ) ) { + // Bold assumption: the user has either a md5 password or a hashing error. If they have both, they'll + // see the 2 messages on successive page loads, and can dismiss each one separately. + + if ($_GET['dismiss'] == 'hasherror' ) { + yourls_update_option('defer_hashing_error', time() + 86400 * 7); // now + 1 week + } + + if ($_GET['dismiss'] == 'md5warning' ) { + yourls_update_option('defer_md5_warning', time() + 86400 * 7); // now + 1 week + } } else { @@ -45,8 +54,9 @@ $hash = yourls_hash_passwords_now( YOURLS_CONFIGFILE ); if ( $hash === true ) { // Hashing successful. Remove flag from DB if any. - if( yourls_get_option( 'defer_hashing_error' ) ) - yourls_delete_option( 'defer_hashing_error' ); + if( yourls_get_option( 'defer_hashing_error' ) ) { + yourls_delete_option('defer_hashing_error'); + } } else { // It failed, display message for first time or if last time was a week ago if ( time() > yourls_get_option( 'defer_hashing_error' ) or !yourls_get_option( 'defer_hashing_error' ) ) { @@ -60,4 +70,23 @@ } } } + + // Warn about deprecated MD5 passwords + if ( yourls_has_md5_passwords() ) { + if ( time() > yourls_get_option( 'defer_md5_warning' ) or !yourls_get_option( 'defer_md5_warning' ) ) { + $message = yourls_s( 'Password stored as MD5 hash. Please update your config.php file to use more secure password hashes.' ); + $message .= ' '; + $message .= yourls_s( 'Get help.', 'http://yourls.org/userpassword' ); + $message .= '';
+ $message .= yourls_s( 'Click here to dismiss this message for one week.', '?dismiss=md5warning' );
+
+ yourls_add_notice( $message );
+ }
+ } else {
+ // No md5 password, remove flag from DB if any.
+ if( yourls_get_option( 'defer_md5_warning' ) ) {
+ yourls_delete_option('defer_md5_warning');
+ }
+ }
+
}
diff --git a/includes/functions-auth.php b/includes/functions-auth.php
index 8a702b8..528d60a 100644
--- a/includes/functions-auth.php
+++ b/includes/functions-auth.php
@@ -49,7 +49,7 @@ function yourls_is_valid_user() {
// Determine auth method and check credentials
if
// API only: Secure (no login or pwd) and time limited token
- // ?timestamp=12345678&signature=md5(totoblah12345678)
+ // ?timestamp=12345678&signature=some-long-sha256-hash
( yourls_is_API() &&
isset( $_REQUEST['timestamp'] ) && !empty($_REQUEST['timestamp'] ) &&
isset( $_REQUEST['signature'] ) && !empty($_REQUEST['signature'] )
@@ -61,7 +61,7 @@ function yourls_is_valid_user() {
elseif
// API only: Secure (no login or pwd)
- // ?signature=md5(totoblah)
+ // ?signature=some-long-sha256-hash
( yourls_is_API() &&
!isset( $_REQUEST['timestamp'] ) &&
isset( $_REQUEST['signature'] ) && !empty( $_REQUEST['signature'] )
@@ -163,10 +163,10 @@ function yourls_check_password_hash($user, $submitted_password ) {
} else if( yourls_has_md5_password( $user ) ) {
// Stored password is a salted md5 hash: "md5:<$r = rand(10000,99999)>:
\n";
@@ -314,7 +314,7 @@ function yourls_html_tfooter( $params = array() ) {
'less' => yourls__( 'less' ),
);
$_select = yourls_html_select( 'click_filter', $_options, $click_filter, false, yourls__( 'Show links with' ) );
- $_input = ' ';
+ $_input = ' ';
/* //translators: "Show links with
\n";
@@ -326,9 +326,9 @@ function yourls_html_tfooter( $params = array() ) {
'between' => yourls__('between'),
);
$_select = yourls_html_select( 'date_filter', $_options, $date_filter, false, yourls__('Show links created') );
- $_input = '';
+ $_input = '';
$_and = ' & ';
- $_input2 = '';
+ $_input2 = '';
/* //translators: "Show links created