markzz/aurweb.git/web/lib/acctfuncs.inc.php, branch v2.1.0

Remove checks before calling connection method

2013-02-10T11:10:38Z

Large amount of boilerplate code that checks if a database connection exists is useless now that the new connection method automatically does the same check. Signed-off-by: canyonknight Signed-off-by: Lukas Fleischer

Remove documentation references to database parameter

2013-02-10T11:10:38Z

Signed-off-by: Lukas Fleischer

Remove unnecessary database connection parameter from all functions

2013-02-10T11:10:38Z

All functions now have a database connection method that will use the same database connection. This imitates the functionality of passing a database connection as an argument and makes it redundant. Signed-off-by: canyonknight Signed-off-by: Lukas Fleischer

Add database wrapper class and new connection method

2013-02-10T11:10:37Z

Uses the Singleton pattern to ensure all queries use the same database connection that is released upon script completion. All database connections should now be called with DB::connect() and not db_connect(). Signed-off-by: canyonknight Signed-off-by: Lukas Fleischer

acctfuncs.inc.php: Change wording of account editing message

2013-01-30T08:25:30Z

An error message is printed when the number of affected rows is 0 for an edited account. A count of 0 doesn't imply an error, only that no changes were made in the database. Signed-off-by: canyonknight Signed-off-by: Lukas Fleischer

Clear a user's active sessions following account suspension

2013-01-30T08:25:30Z

A suspended user can stay in active sessions. Introduce new function delete_user_sessions to remove all open sessions for a specific user. Allows suspensions to take effect immediately. Signed-off-by: canyonknight Signed-off-by: Lukas Fleischer

acctfuncs.inc.php: Change return type of valid_username function

2013-01-30T08:25:29Z

The function is only determining whether a username is valid, so it makes more sense to simply return a boolean value. Signed-off-by: canyonknight Signed-off-by: Lukas Fleischer

Fix account privilege escalation vulnerability

2012-11-29T22:23:12Z

A check is only done to verify a Trusted User isn't promoting their account. An attacker can send tampered account type POST data to change their "User" level account to a "Developer" account. Add check so that all users cannot increase their own account permissions. Signed-off-by: canyonknight Signed-off-by: Lukas Fleischer

Fix account editing and hijacking vulnerability

2012-11-29T22:23:10Z

Checks are in place to avoid users getting account editing forms they shouldn't have access to. The appropriate checks before editing the account in the backend are not in place. This vulnerability allows a user to craft malicious POST data to edit other user accounts, thereby allowing account hijacking. Add a new flexible function can_edit_account() to determine if a user has appropriate permissions. Run the permission check before processing any account information in the backend. Signed-off-by: canyonknight Signed-off-by: Lukas Fleischer

Refactor TU voters list

2012-10-08T12:08:06Z

* Change voters_list() to return an array of voters instead of generating HTML code in the library call. * Change the template to generate HTML code for the list of voters instead of displaying the library's return value. * Use HTML lists. Signed-off-by: Lukas Fleischer