commit 91c0875d1e44fc5f1f1302e30dd64c155c45822c
Author: Elan Ruusamäe <[email protected]>
Date: Sun Nov 16 14:57:05 2014 +0200
add master password support. usable when basic auth is set
authpassword.patch | 47 +++++++++++++++++++++++++++++++++++++++++++++++
w3pw.spec | 6 +++++-
2 files changed, 52 insertions(+), 1 deletion(-)
---
diff --git a/w3pw.spec b/w3pw.spec
index e778e09..3eb77b4 100644
--- a/w3pw.spec
+++ b/w3pw.spec
@@ -1,5 +1,5 @@
-%include /usr/lib/rpm/macros.php
%define php_min_version 5.0.0
+%include /usr/lib/rpm/macros.php
Summary: Web-based password wallet manager
Name: w3pw
Version: 1.40
@@ -11,6 +11,7 @@ Source0:
http://downloads.sourceforge.net/w3pw/%{name}-%{version}.tar.gz
Source1: apache.conf
Source2: lighttpd.conf
Source3: init.sql
+Patch0: authpassword.patch
URL: http://w3pw.sourceforge.net/
BuildRequires: rpm-php-pearprov >= 4.4.2-11
BuildRequires: rpmbuild(macros) >= 1.268
@@ -53,6 +54,9 @@ Features:
%prep
%setup -q
+mv index.php login.php
+mv main.php index.php
+%patch0 -p1
# simple sql to create and load db schema
cp -p %{SOURCE3} .
diff --git a/authpassword.patch b/authpassword.patch
new file mode 100644
index 0000000..9f8d19b
--- /dev/null
+++ b/authpassword.patch
@@ -0,0 +1,47 @@
+--- ./main.php 2014-11-16 14:53:38.235094774 +0200
++++ ./index.php 2014-11-16 14:52:37.000000000 +0200
+@@ -15,6 +15,20 @@
+
+ <?php
+
++function setup_session(&$cleartext_pw) {
++ $_SESSION['logged_in'] = 1;
++ $_SESSION['key'] =
md5("%dJ9&".strtolower($cleartext_pw)."(/&k.=".strtoupper($cleartext_pw)."1x&%");
++ // delete cleartext pw in memory
++ $cleartext_pw = "";
++ unset($cleartext_pw);
++}
++
++// use master password if HTTP Basic Auth is set
++$authenticated = !empty($_SERVER['PHP_AUTH_USER']) &&
!empty($_SERVER['PHP_AUTH_PW']);
++if ($authenticated && isset($master_password)) {
++ setup_session($master_password);
++}
++
+ // session active?
+ if (!isset($_SESSION['logged_in']))
+ {
+@@ -38,8 +52,9 @@
+ if ($crypt_pw == $db_pw)
+ {
+ // password match - proceed
+- $_SESSION['logged_in'] = 1;
+- $_SESSION['key'] =
md5("%dJ9&".strtolower($cleartext_pw)."(/&k.=".strtoupper($cleartext_pw)."1x&%");
++
++ setup_session($cleartext_pw);
++
+ // delete cleartext pw in memory
+ unset($cleartext_pw);
+ $_SESSION['version']=$entries->version;
+--- w3pw-1.40/include/config.php 2014-11-16 14:55:26.126783112 +0200
++++ w3pw-1.40/include/config.php 2014-11-16 14:40:39.000000000 +0200
+@@ -22,6 +22,9 @@
+ // generated when adding a new entry
+ $random_pw_length = 12;
+
++// master password -- used when $_SERVER PHP_AUTH_USER and PHP_AUTH_PW are set
++#$master_password = "secret";
++
+ // don't report Database-Errors on Frontend
+ //error_reporting(E_ERROR);
+ ?>
================================================================
---- gitweb:
http://git.pld-linux.org/gitweb.cgi/packages/w3pw.git/commitdiff/ea6944e85251e920925d8efe8445f3242a896365
_______________________________________________
pld-cvs-commit mailing list
[email protected]
http://lists.pld-linux.org/mailman/listinfo/pld-cvs-commit
