UTCT-265: YOURLS 1.10.6

admin/tools.php

@@ -318,8 +318,8 @@
 <pre><code>&lt;?php
 $timestamp = time();
 <tt>// <?php yourls_e( 'actual value:' ); ?> $time = <?php $time = time(); echo $time; ?></tt>
-$signature = md5( $timestamp . '<?php echo yourls_auth_signature(); ?>' );
-<tt>// <?php yourls_e( 'actual value:' ); ?> $signature = "<?php $sign = md5( $time. yourls_auth_signature() ); echo $sign; ?>"</tt>
+$signature = hash('sha256', $timestamp . '<?php echo yourls_auth_signature(); ?>' );
+<tt>// <?php yourls_e( 'actual value:' ); ?> $signature = "<?php $sign = hash( 'sha256',$time. yourls_auth_signature() ); echo $sign; ?>"</tt>
 ?>
 </code></pre>
         <p><?php yourls_e( 'Now use parameters <tt>signature</tt> and <tt>timestamp</tt> in your API requests. Example:' ); ?></p>

includes/Config/Config.php

@@ -20,6 +20,29 @@ class Config {
      */
     protected string $config;
 
+    /**
+     * Constants that must be defined in config.php
+     */
+    protected const MANDATORY_CONSTANTS = [
+        'YOURLS_DB_USER',
+        'YOURLS_DB_PASS',
+        'YOURLS_DB_NAME',
+        'YOURLS_DB_HOST',
+        'YOURLS_DB_PREFIX',
+        'YOURLS_SITE',
+    ];
+
+    /**
+     * Publicly known values that are not acceptable for YOURLS_COOKIEKEY
+     */
+    protected const INVALID_COOKIEKEYS = [
+        '',
+        'modify this text with something random', // default value in config-sample.php
+        'qQ4KhL_pu|s@Zm7n#%:b^{A[vhm',            // suggested value in the documentation
+    ];
+
+
+
     /**
      * @since  1.7.3
      * @param string $config Optional user defined config path
@@ -93,26 +116,52 @@ public function find_config(): string {
     }
 
     /**
-     * Define core constants that have not been user defined in config.php
+     * Check that all mandatory constants are defined
      *
-     * @since  1.7.3
+     * @since  1.10.5
+     * @param string[] $must_haves Constant names to check, defaults to self::MANDATORY_CONSTANTS
      * @return void
      * @throws ConfigException
      */
-    public function define_core_constants(): void {
-        // Check minimal config job has been properly done
-        $must_haves = array('YOURLS_DB_USER', 'YOURLS_DB_PASS', 'YOURLS_DB_NAME', 'YOURLS_DB_HOST', 'YOURLS_DB_PREFIX', 'YOURLS_SITE');
-        foreach($must_haves as $must_have) {
+    public function check_mandatory_constants(array $must_haves = self::MANDATORY_CONSTANTS): void {
+        foreach ($must_haves as $must_have) {
             if (!defined($must_have)) {
                 throw new ConfigException('Config is incomplete (missing at least '.$must_have.') Check config-sample.php and edit your config accordingly');
             }
         }
+    }
+
+    /**
+     * Check that the cookie key is defined and is not a publicly known value
+     *
+     * @since  1.10.5
+     * @param mixed $key Cookie key value, or null if the constant is undefined
+     * @return void
+     * @throws ConfigException
+     */
+    public function check_cookie_key(mixed $key): void {
+        if (!is_string($key) || in_array($key, self::INVALID_COOKIEKEYS, true)) {
+            throw new ConfigException('YOURLS_COOKIEKEY is undefined or still set to the sample value. Set it to a long random string, see https://yourls.org/cookiedoc');
+        }
+    }
+
+    /**
+     * Define core constants that have not been user defined in config.php
+     *
+     * @since  1.7.3
+     * @return void
+     * @throws ConfigException
+     */
+    public function define_core_constants(): void {
+        // Check minimal config job has been properly done
+        $this->check_mandatory_constants();
+        $this->check_cookie_key(defined('YOURLS_COOKIEKEY') ? YOURLS_COOKIEKEY : null);
 
         /**
          * The following has an awful CRAP index and it would be much shorter reduced to something like
          * defining an array of ('YOURLS_SOMETHING' => 'default value') and then a simple loop over the
          * array, checking if $current is defined as a constant and otherwise define said constant with
-         * its default value. I did not wrote it that way because that would make it difficult for code
+         * its default value. I did not write it that way because that would make it difficult for code
          * parsers to identify which constants are defined and where. So, here it is, that long list of
          * if (!defined) define(). Ho and by the way, such beautiful comment, much right aligned, wow !
          */
@@ -177,30 +226,6 @@ public function define_core_constants(): void {
         if (!defined( 'YOURLS_DB_TABLE_LOG' ))
             define( 'YOURLS_DB_TABLE_LOG', YOURLS_DB_PREFIX.'log' );
 
-        // minimum delay in sec before a same IP can add another URL. Note: logged in users are not throttled down.
-        if (!defined( 'YOURLS_FLOOD_DELAY_SECONDS' ))
-            define( 'YOURLS_FLOOD_DELAY_SECONDS', 15 );
-
-        // comma separated list of IPs that can bypass flood check.
-        if (!defined( 'YOURLS_FLOOD_IP_WHITELIST' ))
-            define( 'YOURLS_FLOOD_IP_WHITELIST', '' );
-
-        // life span of an auth cookie in seconds (60*60*24*7 = 7 days)
-        if (!defined( 'YOURLS_COOKIE_LIFE' ))
-            define( 'YOURLS_COOKIE_LIFE', 60*60*24*7 );
-
-        // life span of a nonce in seconds
-        if (!defined( 'YOURLS_NONCE_LIFE' ))
-            define( 'YOURLS_NONCE_LIFE', 43200 ); // 3600 * 12
-
-        // if set to true, disable stat logging (no use for it, too busy servers, ...)
-        if (!defined( 'YOURLS_NOSTATS' ))
-            define( 'YOURLS_NOSTATS', false );
-
-        // if set to true, force https:// in the admin area
-        if (!defined( 'YOURLS_ADMIN_SSL' ))
-            define( 'YOURLS_ADMIN_SSL', false );
-
         // if set to true, verbose debug infos
         if (!defined( 'YOURLS_DEBUG' )) {
             define('YOURLS_DEBUG', false);

includes/auth.php

@@ -29,14 +29,23 @@
 
 /*
  * The following code is a shim that helps users store passwords securely in config.php
- * by storing a password hash and removing the plaintext.
+ * by storing a password hash and removing the plaintext or md5
  *
  * TODO: Remove this once real user management is implemented
  */
 
-// Did we just fail at encrypting passwords ?
-if ( isset( $_GET['dismiss'] ) && $_GET['dismiss'] == 'hasherror' ) {
-    yourls_update_option( 'defer_hashing_error', time() + 86400 * 7 ); // now + 1 week
+// Did we just fail at encrypting passwords, or did we just notice md5 passwords?
+if ( isset( $_GET['dismiss'] ) ) {
+    // Bold assumption: the user has either a md5 password or a hashing error. If they have both, they'll
+    // see the 2 messages on successive page loads, and can dismiss each one separately.
+
+    if ($_GET['dismiss'] == 'hasherror' ) {
+        yourls_update_option('defer_hashing_error', time() + 86400 * 7); // now + 1 week
+    }
+
+    if ($_GET['dismiss'] == 'md5warning' ) {
+        yourls_update_option('defer_md5_warning', time() + 86400 * 7); // now + 1 week
+    }
 
 } else {
 
@@ -45,8 +54,9 @@
         $hash = yourls_hash_passwords_now( YOURLS_CONFIGFILE );
         if ( $hash === true ) {
             // Hashing successful. Remove flag from DB if any.
-            if( yourls_get_option( 'defer_hashing_error' ) )
-                yourls_delete_option( 'defer_hashing_error' );
+            if( yourls_get_option( 'defer_hashing_error' ) ) {
+                yourls_delete_option('defer_hashing_error');
+            }
         } else {
             // It failed, display message for first time or if last time was a week ago
             if ( time() > yourls_get_option( 'defer_hashing_error' ) or !yourls_get_option( 'defer_hashing_error' ) ) {
@@ -60,4 +70,23 @@
             }
         }
     }
+
+    // Warn about deprecated MD5 passwords
+    if ( yourls_has_md5_passwords() ) {
+        if ( time() > yourls_get_option( 'defer_md5_warning' ) or !yourls_get_option( 'defer_md5_warning' ) ) {
+            $message  = yourls_s( 'Password stored as MD5 hash. Please update your config.php file to use more secure password hashes.' );
+            $message .= ' ';
+            $message .= yourls_s( '<a href="%s">Get help</a>.', 'http://yourls.org/userpassword' );
+            $message .= '</p><p>';
+            $message .= yourls_s( '<a href="%s">Click here</a> to dismiss this message for one week.', '?dismiss=md5warning' );
+
+            yourls_add_notice( $message );
+        }
+    } else {
+        // No md5 password, remove flag from DB if any.
+        if( yourls_get_option( 'defer_md5_warning' ) ) {
+            yourls_delete_option('defer_md5_warning');
+        }
+    }
+
 }