mag/WMS
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

m3 Security Fixes

Browse Source
This commit is contained in:
Mark Gregory
2026-09-16 17:16:25 +01:00
parent d68687f062
commit 8f37245e13
64 changed files with 4247 additions and 4426 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Modules/M3/Http/Middleware/BasicAuth.php
+28 -23
View File
@@ -10,47 +10,51 @@ class BasicAuth
/**
* Handle an incoming request.
*
* @param \Illuminate\Http\Request $request
* @param \Closure $next
* @param Request $request
* @param Closure $next
*
* @return mixed
*/
public function handle(Request $request, Closure $next)
{
//select md5 or crypt for $mode. md5 is for md5 encoded passwords, crypt is for passwords encoded using apache's httpasswd
$mode = "crypt";
if (!m3_user() !== '') {
// select md5 or crypt for $mode. md5 is for md5 encoded passwords, crypt is for passwords encoded using apache's httpasswd
$mode = 'crypt';
if (! m3_user() !== '') {
$this->authenticate();
} else {
if($this->check_pass(m3_user(), m3_legacy_password(), $mode, "%%SYSTEM%%")) {
if ($this->check_pass(m3_user(), m3_legacy_password(), $mode, '%%SYSTEM%%')) {
return $next($request);
} else {
$this->authenticate();
}
}
}
public static function check_pass($login, $password, $mode, $password_file) {
if(!$fh = fopen($password_file, "r")) { die("<P>Could Not Open Password File"); }
public static function check_pass($login, $password, $mode, $password_file)
{
if (! $fh = fopen($password_file, 'r')) {
exit('<P>Could Not Open Password File');
}
$match = 0;
while(!feof($fh)) {
while (! feof($fh)) {
$line = fgets($fh, 4096);
$from_file = explode(":", $line);
if($from_file[0] == $login) {
if($mode == "crypt"){
$salt = substr($from_file[1],0,2);
$user_pass = crypt($password,$salt);
} elseif ($mode == "md5") {
$user_pass = md5($password);
$from_file = explode(':', $line);
if ($from_file[0] == $login) {
if ($mode == 'crypt') {
$salt = substr($from_file[1], 0, 2);
$user_pass = crypt($password, $salt);
} elseif ($mode == 'md5') {
$user_pass = md5($password);
}
if(rtrim($from_file[1]) == $user_pass) {
if (rtrim($from_file[1]) == $user_pass) {
$match = 1;
break;
}
}
}
if($match) {
if ($match) {
return 1;
} else {
return 0;
@@ -58,10 +62,11 @@ class BasicAuth
fclose($fh);
}
public static function authenticate() {
Header("WWW-Authenticate: Basic realm=\"RESTRICTED ACCESS\"");
Header("HTTP/1.0 401 Unauthorized");
echo ("<h1>INVALID USERNAME OR PASSWORD. ACCESS DENIED<h1>");
public static function authenticate()
{
header('WWW-Authenticate: Basic realm="RESTRICTED ACCESS"');
header('HTTP/1.0 401 Unauthorized');
echo '<h1>INVALID USERNAME OR PASSWORD. ACCESS DENIED<h1>';
exit;
}
}