Changeset 3437 for branches/2.2/phpgwapi

Timestamp:

10/29/10 10:14:12 (14 years ago)

Author:

rafaelraymundo

Message:

Ticket #990 - Vulnerabilidades no Anti robo Captcha do Login.

Location:

branches/2.2/phpgwapi

Files:

• inc/common_functions.inc.php (modified) (1 diff)
• setup/phpgw_en.lang (modified) (previous)
• setup/phpgw_pt-br.lang (modified) (previous)
• templates/default/login_default.php (modified) (5 diffs)

branches/2.2/phpgwapi/inc/common_functions.inc.php

@@ -707 +707 @@
 
         /*!
+         @function session_convert
+         @abstract cipher/decipher session id.
+         @Include by Serpro ( Antonio Carlos da Silva).
+         @discussion This function cipher/decipher session id to captcha.
+         */
+        function session_convert($str,$ky='')
+        {
+            if($ky=='') return $str;
+            $ky=str_replace(chr(32),'',$ky);
+            if(strlen($ky)<8) return '';
+            $kl=strlen($ky)<32?strlen($ky):32;
+            $k=array();
+            for($i=0;$i<$kl;$i++)
+                {
+                    $k[$i]=ord($ky{$i})&0x1F;
+                }
+            $j=0;
+            for($i=0;$i<strlen($str);$i++)
+                {
+                    $e=ord($str{$i});
+                    $str{$i}=$e&0xE0?chr($e^$k[$j]):chr($e);
+                    $j++;$j=$j==$kl?0:$j;
+                }
+            return $str;
+        }
+
+        /*!
          @function CreateObject
          @abstract Load a class and include the class file if not done so already.

branches/2.2/phpgwapi/templates/default/login_default.php

@@ -12 +12 @@
         \**************************************************************************/
 
-        function check_logoutcode($code)
+function check_logoutcode($code)
         {
                 switch($code)
@@ -56 +56 @@
                 }
         }
-        
+        
         /* Program starts here */
 
@@ -104 +104 @@
                 unset($sslattributes);
         }
-        session_start(); 
+
+        if( isset( $_GET[ 'cd' ] ) && ( $_GET['cd']=='1' || $_GET['cd'] == 10 ) )
+        {
+            $_SESSION['contador'] = 0;
+        }
+
         if(isset($passwd_type) || $_POST['submitit_x'] || $_POST['submitit_y'] || $submit)
         {
-
-        // Primeiro testa o captcha....se houver......
-        if( $GLOBALS['phpgw_info']['server']['captcha']==1)
-                {
-                if(isset($_POST['codigo']))
-                        {
-                        if ($_SESSION['CAPTCHAString'] != strtoupper($_POST['codigo']))
-                                {
-                                        $GLOBALS['phpgw']->redirect($GLOBALS['phpgw']->link('/login.php','cd=200'));
-                                }
-                        unset($_SESSION['CAPTCHAString']);
-                        }
-                }
+        
+            // Primeiro testa o captcha....se houver......
+            if($GLOBALS['phpgw_info']['server']['captcha']==1)
+              {
+                if(!$_COOKIE['ZABX'])
+                    {
+                        $GLOBALS['phpgw']->redirect($GLOBALS['phpgw']->link('/login.php','cd=5'));
+                    }
+                if($_SESSION['contador'] > $GLOBALS['phpgw_info']['server']['num_badlogin'])
+                    {
+                        if ($_SESSION['CAPTCHAString'] != trim(strtoupper($_POST['codigo'])))
+                                {
+                                        $GLOBALS['phpgw']->redirect($GLOBALS['phpgw']->link('/login.php','cd=200'));
+                                }
+                        unset($_SESSION['CAPTCHAString']);
+                    }
+              }
                 if($_POST['user']) {
                         if($GLOBALS['phpgw_info']['server']['use_prefix_organization']) {
@@ -197 +206 @@
         else
         {
+            $valor_contador = $_SESSION['contador'];
+            $valor_contador = $valor_contador + 1;
+            $_SESSION['contador'] = $valor_contador;
                 // !!! DONT CHANGE THESE LINES !!!
                 // If there is something wrong with this code TELL ME!
@@ -402 +414 @@
         $tmpl->set_var('autocomplete', ($GLOBALS['phpgw_info']['server']['autocomplete_login'] ? 'autocomplete="off"' : ''));
 
-$aux_captcha = '';
 // soh mostra o captcha se for login sem certificado....
 if($GLOBALS['phpgw_info']['server']['captcha'] && $_GET['cd']!='300' )
-        {
-                if($valor_cookie > $GLOBALS['phpgw_info']['server']['num_badlogin'])
-                        {
-                                $aux_captcha = '<div class="login_label" >
- <input type="hidden" name="' . session_name() .'" value="' . session_id() . '" > 
- <img src="./security/captcha.php?xsid='.session_id().'" title="'.lang('Security code').'" alt="'.lang('Security code').'" style="width:60;">  
-<br />
-                <input class="input" type="text" maxlength="50" size="20" name="codigo" id="codigo" value="" >
-              </div>';
-                                $tmpl->set_var('captcha',$aux_captcha);
-                        }
-        }
-
+    {
+        $aux_captcha = '';
+        setcookie(session_name(),base64_encode(session_convert($key_convert . session_id(),$key_convert)),0);
+        if($valor_contador > $GLOBALS['phpgw_info']['server']['num_badlogin'])
+            {
+                $aux_captcha = '<div class="login_label" >
+                   <img src="./security/captcha.php" title="'.lang('Security code').'" alt="'.lang('Security code').'" style="width:60;"><br/>
+                   <input class="input" type="text" maxlength="50" size="20" name="codigo" id="codigo" value="" >
+                   </div>';
+                $tmpl->set_var('captcha',$aux_captcha);
+            }
+    }
+    
 // Testa se deve incluir applet para login com certificado......
 if ($_GET['cd']=='300' && $GLOBALS['phpgw_info']['server']['certificado']==1)
         {
                 //Zera o Cookie contador, responsavel pelo captcha
-                $valor_cookie = 1;
-                setcookie("contador", 1,0);
-
+                $_SESSION['contador'] = 0;
+                $valor_contador = 0;
                 $link_alterna_login = '<img border=0 style="padding: 0px 5px 0px 0px" src="phpgwapi/templates/default/images/warning.gif"/><a href="login.php" style="margin: 0px; padding: 0px; text-decoration:none;"><font color="#ffffff" face="Verdana, Arial, Helvetica, sans-serif" size="1">' . lang('Access without Digital Certificate') . '</a>';
                 $tmpl->set_var('show','none');