Set char limits on usernames/passwords. Switched mt_rand to openssl_r…

…andom_pseudo_bytes.
PolyCash · Aug 12, 2016 · 5f9b0ba · 5f9b0ba
1 parent 8cdd84c
commit 5f9b0ba
Show file tree

Hide file tree

Showing 10 changed files with 171 additions and 124 deletions.
diff --git a/.htaccess b/.htaccess
@@ -1,3 +1,4 @@
+Options -Indexes
 RewriteEngine On
 RewriteBase /
 RewriteCond %{REQUEST_FILENAME} !-f

diff --git a/ajax/check_alias.php b/ajax/check_alias.php
@@ -9,24 +9,29 @@
 else {
 	$alias = $app->normalize_username($_REQUEST['alias']);
 
-	$q = "SELECT * FROM users WHERE username=".$app->quote_escape($alias).";";
-	$r = $app->run_query($q);
-
-	if ($r->rowCount() == 0) {
-		$app->output_message(1, "Thanks for joining ".$GLOBALS['coin_brand_name']."!", false);
-	}
-	else if ($r->rowCount() == 1) {
-		$matched_user = $r->fetch();
+	if (strlen($alias) >= 6) {
+		$q = "SELECT * FROM users WHERE username=".$app->quote_escape($alias).";";
+		$r = $app->run_query($q);
 
-		if (!empty($GLOBALS['login_by_email_enabled']) && $matched_user['login_method'] == "email") {
-			$app->output_message(4, "We have sent a login link to your inbox. Please open that email to log in.", false);
+		if ($r->rowCount() == 0) {
+			$app->output_message(1, "Thanks for joining ".$GLOBALS['coin_brand_name']."!", false);
+		}
+		else if ($r->rowCount() == 1) {
+			$matched_user = $r->fetch();
+
+			if (!empty($GLOBALS['login_by_email_enabled']) && $matched_user['login_method'] == "email") {
+				$app->output_message(4, "We have sent a login link to your inbox. Please open that email to log in.", false);
+			}
+			else {
+				$app->output_message(5, "To log in, please enter your password.", false);
+			}
 		}
 		else {
-			$app->output_message(5, "To log in, please enter your password.", false);
+			$app->output_message(3, "Error: the alias that you entered matches more than one account.", false);
 		}
 	}
 	else {
-		$app->output_message(3, "Error: the alias that you entered matches more than one account.", false);
+		$app->output_message(6, "Error: the alias that you entered is too short. Aliases must be at least 6 characters.", false);
 	}
 }
 ?>
diff --git a/ajax/newsletter.php b/ajax/newsletter.php
@@ -3,7 +3,7 @@
 include("../includes/get_session.php");
 if ($GLOBALS['pageview_tracking_enabled']) $viewer_id = $pageview_controller->insert_pageview($thisuser);
 
-$email = $_REQUEST['email'];
+$email = $app->normalize_username($_REQUEST['email']);
 $match_r = $app->run_query("SELECT * FROM newsletter_subscribers WHERE email_address=".$app->quote_escape($email).";");
 if ($match_r->rowCount() > 0) {
 	echo $app->output_message(2, "That email address has already been subscribed.", false);

diff --git a/ajax/register.php b/ajax/register.php
@@ -8,101 +8,112 @@
 }
 else {
 	$alias = $app->normalize_username($_REQUEST['alias']);
-	$password = strip_tags($_REQUEST['password']);
-	$email = strip_tags($_REQUEST['email']);
-
-	$q = "SELECT * FROM users WHERE username=".$app->quote_escape($alias).";";
-	$r = $app->run_query($q);
-
-	if ($r->rowCount() == 0) {
-		$verify_code = $app->random_string(32);
+	if (strlen($alias) >= 6) {
+		$password = strip_tags($_REQUEST['password']);
 
-		$q = "INSERT INTO users SET username=".$app->quote_escape($alias).", notification_email=".$app->quote_escape($email).", api_access_code=".$app->quote_escape($app->random_string(32)).", password=".$app->quote_escape($password);
-		if ($GLOBALS['pageview_tracking_enabled']) {
-			$q .= ", ip_address=".$app->quote_escape($_SERVER['REMOTE_ADDR']);
-		}
-		if ($GLOBALS['new_games_per_user'] != "unlimited" && $GLOBALS['new_games_per_user'] > 0) {
-			$q .= ", authorized_games=".$app->quote_escape($GLOBALS['new_games_per_user']);
-		}
-		$q .= ", time_created='".time()."', verify_code='".$verify_code."';";
-		$r = $app->run_query($q);
-		$user_id = $app->last_insert_id();
-
-		$bitcoin_address = "";
-		if (!empty($_REQUEST['bitcoin_address'])) $bitcoin_address = $_REQUEST['bitcoin_address'];
-
-		if (!empty($bitcoin_address)) {
-			$qq = "INSERT INTO external_addresses SET user_id='".$user_id."', currency_id=2, address=".$app->quote_escape($bitcoin_address).", time_created='".time()."';";
-			$rr = $app->run_query($qq);
-			$address_id = $app->last_insert_id();
-			$app->run_query("UPDATE users SET bitcoin_address_id='".$address_id."' WHERE user_id=".$user_id.";");
-		}
-
-		$thisuser = new User($app, $user_id);
-
-		$session_key = session_id();
-		$expire_time = time()+3600*24;
-
-		if ($GLOBALS['pageview_tracking_enabled']) {
-			$q = "SELECT * FROM viewer_connections WHERE type='viewer2user' AND from_id='".$viewer_id."' AND to_id='".$thisuser->db_user['user_id']."';";
-			$r = $app->run_query($q);
-			if ($r->rowCount() == 0) {
-				$q = "INSERT INTO viewer_connections SET type='viewer2user', from_id='".$viewer_id."', to_id='".$thisuser->db_user['user_id']."';";
-				$r = $app->run_query($q);
-			}
+		if (strlen($password) >= 6) {
+			$email = strip_tags($_REQUEST['email']);
 
-			$q = "UPDATE users SET ip_address=".$app->quote_escape($_SERVER['REMOTE_ADDR'])." WHERE user_id='".$thisuser->db_user['user_id']."';";
+			$q = "SELECT * FROM users WHERE username=".$app->quote_escape($alias).";";
 			$r = $app->run_query($q);
-		}
-
-		// Send an email if the username includes
-		if ($GLOBALS['outbound_email_enabled'] && !empty($notification_email) && strpos($notification_email, '@')) {
-			$email_message = "<p>A new ".$GLOBALS['site_name_short']." web wallet has been created for <b>".$alias."</b>.</p>";
-			$email_message .= "<p>Thanks for signing up!</p>";
-			$email_message .= "<p>To log in any time please visit ".$GLOBALS['base_url']."/wallet/</p>";
-			$email_message .= "<p>This message was sent to you by ".$GLOBALS['base_url']."</p>";
 
-			$email_id = $app->mail_async($email, $GLOBALS['site_name'], "no-reply@".$GLOBALS['site_domain'], "New account created", $email_message, "", "");
-		}
-
-		$q = "SELECT * FROM games WHERE game_id='".$app->get_site_constant('primary_game_id')."';";
-		$r = $app->run_query($q);
-
-		if ($r->rowCount() == 1) {
-			$db_primary_game = $r->fetch();
-			$primary_game = new Game($app, $db_primary_game['game_id']);
-
-			if ($primary_game->db_game['giveaway_status'] == "public_free") {
-				$thisuser->ensure_user_in_game($primary_game->db_game['game_id']);
-				$giveaway = $primary_game->new_game_giveaway($user_id, 'initial_purchase', false);
-			}
-		}
-
-		$redirect_url = false;
-
-		if ($GLOBALS['pageview_tracking_enabled']) $thisuser->log_user_in($redirect_url, $viewer_id);
-		else $thisuser->log_user_in($redirect_url, false);
-
-		if ($redirect_url) {
-			$app->output_message(1, $redirect_url['url'], false);
-		}
-		else {
-			if (!empty($_REQUEST['invite_key'])) {
-				$invite_game = false;
-				$success = $app->try_apply_invite_key($thisuser->db_user['user_id'], $_REQUEST['invite_key'], $invite_game);
-				if ($success) {
-					$app->output_message(1, "/wallet/".$invite_game['url_identifier'], false);
-					die();
+			if ($r->rowCount() == 0) {
+				$verify_code = $app->random_string(32);
+
+				$q = "INSERT INTO users SET username=".$app->quote_escape($alias).", notification_email=".$app->quote_escape($email).", api_access_code=".$app->quote_escape($app->random_string(32)).", password=".$app->quote_escape($password);
+				if ($GLOBALS['pageview_tracking_enabled']) {
+					$q .= ", ip_address=".$app->quote_escape($_SERVER['REMOTE_ADDR']);
+				}
+				if ($GLOBALS['new_games_per_user'] != "unlimited" && $GLOBALS['new_games_per_user'] > 0) {
+					$q .= ", authorized_games=".$app->quote_escape($GLOBALS['new_games_per_user']);
+				}
+				$q .= ", time_created='".time()."', verify_code='".$verify_code."';";
+				$r = $app->run_query($q);
+				$user_id = $app->last_insert_id();
+
+				$bitcoin_address = "";
+				if (!empty($_REQUEST['bitcoin_address'])) $bitcoin_address = $_REQUEST['bitcoin_address'];
+
+				if (!empty($bitcoin_address)) {
+					$qq = "INSERT INTO external_addresses SET user_id='".$user_id."', currency_id=2, address=".$app->quote_escape($bitcoin_address).", time_created='".time()."';";
+					$rr = $app->run_query($qq);
+					$address_id = $app->last_insert_id();
+					$app->run_query("UPDATE users SET bitcoin_address_id='".$address_id."' WHERE user_id=".$user_id.";");
+				}
+
+				$thisuser = new User($app, $user_id);
+
+				$session_key = session_id();
+				$expire_time = time()+3600*24;
+
+				if ($GLOBALS['pageview_tracking_enabled']) {
+					$q = "SELECT * FROM viewer_connections WHERE type='viewer2user' AND from_id='".$viewer_id."' AND to_id='".$thisuser->db_user['user_id']."';";
+					$r = $app->run_query($q);
+					if ($r->rowCount() == 0) {
+						$q = "INSERT INTO viewer_connections SET type='viewer2user', from_id='".$viewer_id."', to_id='".$thisuser->db_user['user_id']."';";
+						$r = $app->run_query($q);
+					}
+
+					$q = "UPDATE users SET ip_address=".$app->quote_escape($_SERVER['REMOTE_ADDR'])." WHERE user_id='".$thisuser->db_user['user_id']."';";
+					$r = $app->run_query($q);
+				}
+
+				// Send an email if the username includes
+				if ($GLOBALS['outbound_email_enabled'] && !empty($notification_email) && strpos($notification_email, '@')) {
+					$email_message = "<p>A new ".$GLOBALS['site_name_short']." web wallet has been created for <b>".$alias."</b>.</p>";
+					$email_message .= "<p>Thanks for signing up!</p>";
+					$email_message .= "<p>To log in any time please visit ".$GLOBALS['base_url']."/wallet/</p>";
+					$email_message .= "<p>This message was sent to you by ".$GLOBALS['base_url']."</p>";
+
+					$email_id = $app->mail_async($email, $GLOBALS['site_name'], "no-reply@".$GLOBALS['site_domain'], "New account created", $email_message, "", "");
+				}
+
+				$q = "SELECT * FROM games WHERE game_id='".$app->get_site_constant('primary_game_id')."';";
+				$r = $app->run_query($q);
+
+				if ($r->rowCount() == 1) {
+					$db_primary_game = $r->fetch();
+					$primary_game = new Game($app, $db_primary_game['game_id']);
+
+					if ($primary_game->db_game['giveaway_status'] == "public_free") {
+						$thisuser->ensure_user_in_game($primary_game->db_game['game_id']);
+						$giveaway = $primary_game->new_game_giveaway($user_id, 'initial_purchase', false);
+					}
 				}
+
+				$redirect_url = false;
+
+				if ($GLOBALS['pageview_tracking_enabled']) $thisuser->log_user_in($redirect_url, $viewer_id);
+				else $thisuser->log_user_in($redirect_url, false);
+
+				if ($redirect_url) {
+					$app->output_message(1, $redirect_url['url'], false);
+				}
+				else {
+					if (!empty($_REQUEST['invite_key'])) {
+						$invite_game = false;
+						$success = $app->try_apply_invite_key($thisuser->db_user['user_id'], $_REQUEST['invite_key'], $invite_game);
+						if ($success) {
+							$app->output_message(1, "/wallet/".$invite_game['url_identifier'], false);
+							die();
+						}
+					}
+					else {
+						$app->output_message(1, "/wallet/", false);
+					}
+				}
+				die();
 			}
 			else {
-				$app->output_message(1, "/wallet/", false);
+				$app->output_message(3, "Error: that alias is already registered.", false);
 			}
 		}
-		die();
+		else {
+			$app->output_message(6, "Error: the password you entered is too short. Please enter a password which is at least 6 characters.", false);
+		}
 	}
 	else {
-		$app->output_message(3, "Error: the alias that you entered matches more than one account.", false);
+		$app->output_message(6, "Error: the alias that you entered is too short. Aliases must be at least 6 characters.", false);
 	}
 }
 ?>
diff --git a/ajax/reset_password.php b/ajax/reset_password.php
@@ -12,7 +12,7 @@
 		$q = "SELECT * FROM users WHERE notification_email=".$app->quote_escape($email).";";
 		$r = $app->run_query($q);
 
-		if ($r->rowCount() == 1) {
+		if (TRUE || $r->rowCount() == 1) {
 			$user = $r->fetch();
 
 			$token_key = $app->random_string(32);

diff --git a/classes/App.php b/classes/App.php
@@ -46,12 +46,19 @@ public function make_alphanumeric($string, $extrachars) {
 
 	public function random_string($length) {
 		$characters = "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ";
-		$string ="";
-
-		for ($p = 0; $p < $length; $p++) {
-			$string .= $characters[mt_rand(0, strlen($characters)-1)];
+		$bits_per_char = ceil(log(strlen($characters), 2));
+		$hex_chars_per_char = ceil($bits_per_char/4);
+		$hex_chars_needed = $length*$hex_chars_per_char;
+		$rand_data = bin2hex(openssl_random_pseudo_bytes(ceil($hex_chars_needed/2), $crypto_strong));
+		if(!$crypto_strong) $this->log_then_die("An insecure random string of length ".$length." was generated.");
+
+		$string = "";
+		for ($i=0; $i<$length; $i++) {
+			$hex_chars = substr($rand_data, $i*$hex_chars_per_char, $hex_chars_per_char);
+			$rand_num = hexdec($hex_chars);
+			$rand_index = $rand_num%strlen($characters);
+			$string .= $characters[$rand_index];
 		}
-
 		return $string;
 	}
 

diff --git a/includes/get_session.php b/includes/get_session.php
@@ -12,10 +12,10 @@
 $game = FALSE;
 
 if (strlen($session_key) > 0) {
-	$q = "SELECT * FROM user_sessions WHERE session_key='".$session_key."' AND expire_time > '".time()."' AND logout_time=0;";
+	$q = "SELECT * FROM user_sessions WHERE session_key=".$app->quote_escape($session_key)." AND expire_time > '".time()."' AND logout_time=0;";
 	$r = $app->run_query($q);
 
-	if ($r->rowCount() > 0) {
+	if ($r->rowCount() == 1) {
 		$session = $r->fetch();
 
 		$thisuser = new User($app, $session['user_id']);
@@ -36,5 +36,12 @@
 		}
 		else $thisuser = false;
 	}
+	else {
+		while ($session = $r->fetch()) {
+			$qq = "UPDATE user_sessions SET logout_time='".time()."' WHERE session_id='".$session['session_id']."';";
+			$rr = $app->run_query($qq);
+		}
+		$session = false;
+	}
 }
 ?>
diff --git a/includes/html_start.php b/includes/html_start.php
@@ -20,8 +20,10 @@
 	<script type="text/javascript" src="/js/jquery.nouislider.js"></script>
 	<script type="text/javascript" src="/js/sha256.js"></script>
 	<script type="text/javascript" src="/js/main.js"></script>
-
 	<?php
+	if ($nav_tab_selected == "home" && $GLOBALS['site_domain'] != $_SERVER['HTTP_HOST']) {
+		echo '<link rel="canonical" href="http://empirecoin.org">'."\n";
+	}
 	if (!empty($include_crypto_js)) { ?>
 	<script type="text/javascript" src="/js/base64.lib.js" ></script>
 	<script type="text/javascript" src="/js/rsa/prng4.js"></script>

diff --git a/scripts/getinfo.php b/scripts/getinfo.php
@@ -2,25 +2,33 @@
 $host_not_required = TRUE;
 include(realpath(dirname(__FILE__))."/../includes/connect.php");
 
-$coin_rpc = new jsonRPCClient('http://'.$GLOBALS['bitcoin_rpc_user'].':'.$GLOBALS['bitcoin_rpc_password'].'@127.0.0.1:'.$GLOBALS['bitcoin_port'].'/');
-echo "<pre>getinfo()\n";
-print_r($coin_rpc);
-print_r($coin_rpc->getinfo());
-echo "</pre><br/>\n";
+if (!empty($argv)) {
+	$cmd_vars = $app->argv_to_array($argv);
+	if (!empty($cmd_vars['key'])) $_REQUEST['key'] = $cmd_vars['key'];
+	else if (!empty($cmd_vars[0])) $_REQUEST['key'] = $cmd_vars[0];
+}
 
-$real_game_r = $app->run_query("SELECT * FROM games WHERE game_type='real';");
+if ($_REQUEST['key'] == $GLOBALS['cron_key_string']) {
+	$coin_rpc = new jsonRPCClient('http://'.$GLOBALS['bitcoin_rpc_user'].':'.$GLOBALS['bitcoin_rpc_password'].'@127.0.0.1:'.$GLOBALS['bitcoin_port'].'/');
+	echo "<pre>getinfo()\n";
+	print_r($coin_rpc->getinfo());
+	echo "</pre><br/>\n";
 
-while ($db_real_game = $real_game_r->fetch()) {
-	echo $db_real_game['name'].":<br/>\n";
-	try {
-		$coin_rpc = new jsonRPCClient('http://'.$db_real_game['rpc_username'].':'.$db_real_game['rpc_password'].'@127.0.0.1:'.$db_real_game['rpc_port'].'/');
-
-		echo "<pre>getinfo()\n";
-		print_r($coin_rpc->getinfo());
-		echo "</pre><br/>\n";
-	}
-	catch (Exception $e) {
-		echo $e;
+	$real_game_r = $app->run_query("SELECT * FROM games WHERE game_type='real';");
+
+	while ($db_real_game = $real_game_r->fetch()) {
+		echo $db_real_game['name'].":<br/>\n";
+		try {
+			$coin_rpc = new jsonRPCClient('http://'.$db_real_game['rpc_username'].':'.$db_real_game['rpc_password'].'@127.0.0.1:'.$db_real_game['rpc_port'].'/');
+
+			echo "<pre>getinfo()\n";
+			print_r($coin_rpc->getinfo());
+			echo "</pre><br/>\n";
+		}
+		catch (Exception $e) {
+			echo $e;
+		}
 	}
 }
+else echo "Please supply the correct key.";
 ?>
diff --git a/scripts/grant_unclaimed_coins.php b/scripts/grant_unclaimed_coins.php
@@ -2,7 +2,13 @@
 $host_not_required = TRUE;
 include(realpath(dirname(__FILE__))."/../includes/connect.php");
 
-if ($argv) $_REQUEST['key'] = $argv[1];
+if (!empty($argv)) {
+	$cmd_vars = $app->argv_to_array($argv);
+	if (!empty($cmd_vars['key'])) $_REQUEST['key'] = $cmd_vars['key'];
+	else if (!empty($cmd_vars[0])) $_REQUEST['key'] = $cmd_vars[0];
+	if (!empty($cmd_vars['coins'])) $_REQUEST['coins'] = $cmd_vars['coins'];
+	if (!empty($cmd_vars['to'])) $_REQUEST['to'] = $cmd_vars['to'];
+}
 
 if ($_REQUEST['key'] == $GLOBALS['cron_key_string']) {
 	$user_id = false;