markzz/aurweb.git/web/lib/aur.inc.php, branch v1.9.0

Use secure and httponly session cookies

2011-08-11T22:09:24Z

As discussed on the mailing list, enable "secure" and "httponly" for session cookies to prevent them from being transferred over insecure connections. Signed-off-by: Lukas Fleischer

Add a configuration setting to disallow HTTP login

2011-08-11T19:04:38Z

If this is enabled, do not show the login form and display a note suggesting to switch to a secure connection if a user accesses the site via HTTP. Signed-off-by: Lukas Fleischer

aur.inc.php: allow all functions using DB to take handle as arg

2011-08-11T14:17:08Z

This prevents needless calls to db_connect() if we already have a reference to a handle we can pass into a function. Although the current underlying implementation using mysql_connect() will return the same connection if all parameters are the same, this might not be true if we switch to a more modern (e.g. PDO) interface. In the face of safe transactions, it is extremely important all actions are being taken over the same connection to the database. Signed-off-by: Dan McGee Signed-off-by: Lukas Fleischer

Allow SQL_DEBUG to be undefined

2011-08-10T12:34:07Z

We shouldn't require this as it is a new config parameter and it causes PHP warnings to be spewed everywhere. Signed-off-by: Dan McGee Signed-off-by: Lukas Fleischer

Simplify session ID generation

2011-06-25T09:58:20Z

There was too much voodoo going on in new_sid(). Just use uniqid() with a random seed and the optional entropy parameter to generate MD5 input. Use the remote IP address as a salt to reduce the chance of two clients getting the same ID if they login at exactly the same time. Thanks-to: Florian Pritz Signed-off-by: Lukas Fleischer

Stricter email address validation

2011-06-25T09:58:13Z

Use PHP's filter extension to validate mail addresses. The filter extension is enabled by default as of PHP 5.2.0. Thanks-to: Florian Pritz Thanks-to: Cédric Girard Signed-off-by: Lukas Fleischer

Make cache type selectable based on config value

2011-06-22T13:21:21Z

Provie a mechanism to specify cache type from NONE, APC, or MEMCACHE based on a config variable. If MEMCACHE type is selected, a list of servers can be specified to provide multiserver support. Note that php-memcaced is required for MEMCACHE support. Lukas: Minor commenting style fixes. Signed-off-by: Lukas Fleischer

rename .inc files to .inc.php and adjust imports and references

2011-06-22T13:15:04Z

Lukas: Add note to "UPGRADING". Signed-off-by: Lukas Fleischer