Merge pull request #4861 from fabrixxm/issue/3395

[friendica.git] / include / security.php

diff --git a/include/security.php b/include/security.php
index 39846a8328bce31f73cf4fa351bdd83a978983f3..b13a507cf483c124e5e1de3ed3817b205784d3aa 100644 (file)
--- a/include/security.php
+++ b/include/security.php
@@ -2,7 +2,7 @@
 /**
  * @file include/security.php
  */
-use Friendica\App;
+
 use Friendica\Core\Addon;
 use Friendica\Core\Config;
 use Friendica\Core\L10n;
@@ -10,6 +10,7 @@ use Friendica\Core\PConfig;
 use Friendica\Core\System;
 use Friendica\Database\DBM;
 use Friendica\Model\Group;
+use Friendica\Util\DateTimeFormat;
 
 /**
  * @brief Calculate the hash that is needed for the "Friendica" cookie
@@ -106,12 +107,35 @@ function authenticate_success($user_record, $login_initial = false, $interactive
                }
        }
 
-       $r = dba::select('user', ['uid', 'username', 'nickname'],
-               ['password' => $master_record['password'], 'email' => $master_record['email'], 'account_removed' => false]);
-       if (DBM::is_result($r)) {
-               $a->identities = dba::inArray($r);
+       if ($master_record['parent-uid'] == 0) {
+               // First add our own entry
+               $a->identities = [['uid' => $master_record['uid'],
+                               'username' => $master_record['username'],
+                               'nickname' => $master_record['nickname']]];
+
+               // Then add all the children
+               $r = dba::select('user', ['uid', 'username', 'nickname'],
+                       ['parent-uid' => $master_record['uid'], 'account_removed' => false]);
+               if (DBM::is_result($r)) {
+                       $a->identities = array_merge($a->identities, dba::inArray($r));
+               }
        } else {
+               // Just ensure that the array is always defined
                $a->identities = [];
+
+               // First entry is our parent
+               $r = dba::select('user', ['uid', 'username', 'nickname'],
+                       ['uid' => $master_record['parent-uid'], 'account_removed' => false]);
+               if (DBM::is_result($r)) {
+                       $a->identities = dba::inArray($r);
+               }
+
+               // Then add all siblings
+               $r = dba::select('user', ['uid', 'username', 'nickname'],
+                       ['parent-uid' => $master_record['parent-uid'], 'account_removed' => false]);
+               if (DBM::is_result($r)) {
+                       $a->identities = array_merge($a->identities, dba::inArray($r));
+               }
        }
 
        $r = dba::p("SELECT `user`.`uid`, `user`.`username`, `user`.`nickname`
@@ -141,11 +165,11 @@ function authenticate_success($user_record, $login_initial = false, $interactive
        header('X-Account-Management-Status: active; name="' . $a->user['username'] . '"; id="' . $a->user['nickname'] . '"');
 
        if ($login_initial || $login_refresh) {
-               dba::update('user', ['login_date' => datetime_convert()], ['uid' => $_SESSION['uid']]);
+               dba::update('user', ['login_date' => DateTimeFormat::utcNow()], ['uid' => $_SESSION['uid']]);
 
                // Set the login date for all identities of the user
-               dba::update('user', ['login_date' => datetime_convert()],
-                       ['password' => $master_record['password'], 'email' => $master_record['email'], 'account_removed' => false]);
+               dba::update('user', ['login_date' => DateTimeFormat::utcNow()],
+                       ['parent-uid' => $master_record['uid'], 'account_removed' => false]);
        }
 
        if ($login_initial) {
@@ -381,12 +405,21 @@ function get_form_security_token($typename = '')
 
 function check_form_security_token($typename = '', $formname = 'form_security_token')
 {
-       if (!x($_REQUEST, $formname)) {
-               return false;
+       $hash = null;
+
+       if (!empty($_REQUEST[$formname])) {
+               /// @TODO Careful, not secured!
+               $hash = $_REQUEST[$formname];
        }
 
-       /// @TODO Careful, not secured!
-       $hash = $_REQUEST[$formname];
+       if (!empty($_SERVER['HTTP_X_CSRF_TOKEN'])) {
+               /// @TODO Careful, not secured!
+               $hash = $_SERVER['HTTP_X_CSRF_TOKEN'];
+       }
+
+       if (empty($hash)) {
+               return false;
+       }
 
        $max_livetime = 10800; // 3 hours
 
@@ -404,7 +437,7 @@ function check_form_security_token($typename = '', $formname = 'form_security_to
 
 function check_form_security_std_err_msg()
 {
-       return L10n::t('The form security token was not correct. This probably happened because the form has been opened for too long (>3 hours) before submitting it.') . EOL;
+       return L10n::t("The form security token was not correct. This probably happened because the form has been opened for too long \x28>3 hours\x29 before submitting it.") . EOL;
 }
 
 function check_form_security_token_redirectOnErr($err_redirect, $typename = '', $formname = 'form_security_token')