Secure cookie key

git-svn-id: https://svn.sourceforge.jp/svnroot/nucleus-jp/nucleus-jp/trunk@250 1ca29b6e-896d-4ea0-84a5-967f57386b96

diff --git a/euc/nucleus/libs/globalfunctions.php b/euc/nucleus/libs/globalfunctions.php
index f3bd59e..1ab48ee 100755 (executable)
--- a/euc/nucleus/libs/globalfunctions.php
+++ b/euc/nucleus/libs/globalfunctions.php
@@ -13,8 +13,8 @@
 /**
  * @license http://nucleuscms.org/license.txt GNU General Public License
  * @copyright Copyright (C) 2002-2007 The Nucleus Group
- * @version $Id: globalfunctions.php,v 1.10 2007-04-04 21:00:14 kmorimatsu Exp $
- * $NucleusJP: globalfunctions.php,v 1.9 2007/03/27 12:13:56 kimitake Exp $
+ * @version $Id: globalfunctions.php,v 1.11 2007-04-06 21:25:58 kmorimatsu Exp $
+ * $NucleusJP: globalfunctions.php,v 1.10 2007/04/04 21:00:14 kmorimatsu Exp $
  */
 
 // needed if we include globalfunctions from install.php
@@ -171,6 +171,25 @@ if (($CONF['DisableJsTools'] == 0) && strstr(serverVar('HTTP_USER_AGENT'), 'Mozi
 // login if cookies set
 $member = new MEMBER();
 
+// secure cookie key settings (either 'none', 0, 8, 16, 24, or 32)
+if (!isset($CONF['secureCookieKey'])) $CONF['secureCookieKey']=24;
+switch($CONF['secureCookieKey']){
+case 8:
+       $CONF['secureCookieKeyIP']=preg_replace('/\.[0-9]?\.[0-9]?\.[0-9]?$/','',serverVar('REMOTE_ADDR'));
+       break;
+case 16:
+       $CONF['secureCookieKeyIP']=preg_replace('/\.[0-9]?\.[0-9]?$/','',serverVar('REMOTE_ADDR'));
+       break;
+case 24:
+       $CONF['secureCookieKeyIP']=preg_replace('/\.[0-9]?$/','',serverVar('REMOTE_ADDR'));
+       break;
+case 32:
+       $CONF['secureCookieKeyIP']=serverVar('REMOTE_ADDR');
+       break;
+default:
+       $CONF['secureCookieKeyIP']='';
+}
+
 // login/logout when required or renew cookies
 if ($action == 'login') {
        // Form Authentication
@@ -183,6 +202,12 @@ if ($action == 'login') {
                $member->newCookieKey();
                $member->setCookies($shared);
 
+               if ($CONF['secureCookieKey']!=='none') {
+                       // secure cookie key
+                       $member->setCookieKey(md5($member->getCookieKey().$CONF['secureCookieKeyIP']));
+                       $member->write();
+               }
+
                // allows direct access to parts of the admin area after logging in
                if ($nextaction) {
                        $action = $nextaction;
@@ -229,10 +254,15 @@ Backed out for now: See http://forum.nucleuscms.org/viewtopic.php?t=3684 for det
        $manager->notify('Logout', array('username' => cookieVar($CONF['CookiePrefix'] . 'user') ) );
 } elseif (cookieVar($CONF['CookiePrefix'] . 'user') ) {
        // Cookie Authentication
-       $res = $member->cookielogin(cookieVar($CONF['CookiePrefix'] . 'user'), cookieVar($CONF['CookiePrefix'] . 'loginkey') );
+       $ck=cookieVar($CONF['CookiePrefix'] . 'loginkey');
+       // secure cookie key
+       if ($CONF['secureCookieKey']!=='none') $ck=md5($ck.$CONF['secureCookieKeyIP']);
+       $res = $member->cookielogin(cookieVar($CONF['CookiePrefix'] . 'user'), $ck );
+       unset($ck);
 
        // renew cookies when not on a shared computer
        if ($res && (cookieVar($CONF['CookiePrefix'] . 'sharedpc') != 1) && (!headers_sent() ) ) {
+               $member->setCookieKey(cookieVar($CONF['CookiePrefix'] . 'loginkey'));
                $member->setCookies();
        }
 }

diff --git a/utf8/nucleus/libs/globalfunctions.php b/utf8/nucleus/libs/globalfunctions.php
index 607cfbb..c16b7ac 100755 (executable)
--- a/utf8/nucleus/libs/globalfunctions.php
+++ b/utf8/nucleus/libs/globalfunctions.php
@@ -13,8 +13,8 @@
 /**
  * @license http://nucleuscms.org/license.txt GNU General Public License
  * @copyright Copyright (C) 2002-2007 The Nucleus Group
- * @version $Id: globalfunctions.php,v 1.20 2007-04-04 20:59:34 kmorimatsu Exp $
- * $NucleusJP: globalfunctions.php,v 1.19 2007/03/22 03:30:14 kmorimatsu Exp $
+ * @version $Id: globalfunctions.php,v 1.21 2007-04-06 21:25:30 kmorimatsu Exp $
+ * $NucleusJP: globalfunctions.php,v 1.20 2007/04/04 20:59:34 kmorimatsu Exp $
  */
 
 // needed if we include globalfunctions from install.php
@@ -171,6 +171,25 @@ if (($CONF['DisableJsTools'] == 0) && strstr(serverVar('HTTP_USER_AGENT'), 'Mozi
 // login if cookies set
 $member = new MEMBER();
 
+// secure cookie key settings (either 'none', 0, 8, 16, 24, or 32)
+if (!isset($CONF['secureCookieKey'])) $CONF['secureCookieKey']=24;
+switch($CONF['secureCookieKey']){
+case 8:
+       $CONF['secureCookieKeyIP']=preg_replace('/\.[0-9]?\.[0-9]?\.[0-9]?$/','',serverVar('REMOTE_ADDR'));
+       break;
+case 16:
+       $CONF['secureCookieKeyIP']=preg_replace('/\.[0-9]?\.[0-9]?$/','',serverVar('REMOTE_ADDR'));
+       break;
+case 24:
+       $CONF['secureCookieKeyIP']=preg_replace('/\.[0-9]?$/','',serverVar('REMOTE_ADDR'));
+       break;
+case 32:
+       $CONF['secureCookieKeyIP']=serverVar('REMOTE_ADDR');
+       break;
+default:
+       $CONF['secureCookieKeyIP']='';
+}
+
 // login/logout when required or renew cookies
 if ($action == 'login') {
        // Form Authentication
@@ -183,6 +202,12 @@ if ($action == 'login') {
                $member->newCookieKey();
                $member->setCookies($shared);
 
+               if ($CONF['secureCookieKey']!=='none') {
+                       // secure cookie key
+                       $member->setCookieKey(md5($member->getCookieKey().$CONF['secureCookieKeyIP']));
+                       $member->write();
+               }
+
                // allows direct access to parts of the admin area after logging in
                if ($nextaction) {
                        $action = $nextaction;
@@ -229,10 +254,15 @@ Backed out for now: See http://forum.nucleuscms.org/viewtopic.php?t=3684 for det
        $manager->notify('Logout', array('username' => cookieVar($CONF['CookiePrefix'] . 'user') ) );
 } elseif (cookieVar($CONF['CookiePrefix'] . 'user') ) {
        // Cookie Authentication
-       $res = $member->cookielogin(cookieVar($CONF['CookiePrefix'] . 'user'), cookieVar($CONF['CookiePrefix'] . 'loginkey') );
+       $ck=cookieVar($CONF['CookiePrefix'] . 'loginkey');
+       // secure cookie key
+       if ($CONF['secureCookieKey']!=='none') $ck=md5($ck.$CONF['secureCookieKeyIP']);
+       $res = $member->cookielogin(cookieVar($CONF['CookiePrefix'] . 'user'), $ck );
+       unset($ck);
 
        // renew cookies when not on a shared computer
        if ($res && (cookieVar($CONF['CookiePrefix'] . 'sharedpc') != 1) && (!headers_sent() ) ) {
+               $member->setCookieKey(cookieVar($CONF['CookiePrefix'] . 'loginkey'));
                $member->setCookies();
        }
 }