admin/Kundenverwaltung
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Login und Passkeys auf Prepared Statements umgebaut

Browse Source 
- sites/start.php: ein Query statt zwei, Passwortvergleich per hash_equals
  in PHP statt im SQL, Updates per id. Die Eingaben gehen nicht mehr durch
  htmlspecialchars(): Passwoerter werden beim Anlegen roh gehasht, mit
  & < > " ' konnte man sich deshalb bisher nie anmelden.
- getUserSetting/updateUserSetting mit Platzhaltern; behoben: INSERT-Zweig
  rief mysqli_real_escape_string ohne Verbindung auf (Fatal Error),
  $mysqli_error als Variable, ungewolltes echo "update". Aufrufer escapen
  nicht mehr vor (sonst doppelt), settings.php: Tippfehler
  mysqi_real_escape_string beim Speichern von show_sks behoben, style nur
  als Dateiname ohne Pfad.
- authServer.php, addKey.php, userkeys.php, checkAdduser(): Platzhalter.
  Passkey-INSERT setzt lastAuth/authKey (Pflichtfelder im strikten Modus).
  addKey nur als reine Ziffern, sonst passte "12345678xyz" per Typumwandlung.
- checkLogin() entfernt: nirgends aufgerufen, fragte die nicht existierende
  Tabelle users ab.
- userkeys.tpl: Passkey-Name escaped.

Getestet gegen die migrierte Testdatenbank im strikten Modus.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
admin
2026-09-17 10:24:17 +02:00
co-authored by Claude Opus 5
parent e2596b6e1c
commit 6306bfba17
10 changed files with 108 additions and 158 deletions
Download Patch File Download Diff File Expand all files Collapse all files
authServer.php
+20 -23
View File
@@ -139,22 +139,20 @@ try {
// ------------------------------------
} else if ($fn === 'getGetArgs') {
$result = mysqli_query($dbconn,"SELECT id FROM user WHERE nick = '".mysqli_real_escape_string($dbconn,$_GET["user"])."';");
if ($result->num_rows > 0) {
$row = $result->fetch_assoc();
$userId = $row["id"];
}else{
$userId = db_wert($dbconn, "SELECT id FROM user WHERE nick = ?", array((string)filter_input(INPUT_GET, 'user')));
if ($userId === false) {
throw new Exception(mysqli_error($dbconn));
}
if ($userId === null) {
throw new Exception('Username not found');
}
$ids = [];
$result = mysqli_query($dbconn,"SELECT credentialId FROM passkeys WHERE userId = '".$userId."';");
if(!$result){
$msg = "Error:<br>".mysqli_error($dbconn)."<br />";
$zeilen = db_zeilen($dbconn, "SELECT credentialId FROM passkeys WHERE userId = ?", array($userId));
if ($zeilen === false) {
throw new Exception(mysqli_error($dbconn));
}
if ($result->num_rows > 0) {
while($row = $result->fetch_assoc()) {
$ids[] = base64_decode($row["credentialId"]);
}
foreach ($zeilen as $row) {
$ids[] = base64_decode($row["credentialId"]);
}
if (count($ids) === 0) {
@@ -197,7 +195,8 @@ try {
if (!isset($_SESSION['registrations']) || !array_key_exists('registrations', $_SESSION) || !is_array($_SESSION['registrations'])) {
$_SESSION['registrations'] = [];
}*/
if(!mysqli_query($dbconn,"INSERT INTO passkeys SET credentialId = '".base64_encode($data->credentialId)."', credentialPublicKey = '".base64_encode($data->credentialPublicKey)."', signatureCounter = '".base64_encode($data->signatureCounter)."', name = '".mysqli_real_escape_string($mysql,filter_input(INPUT_GET, 'name'))."', userId = '".(int)$passkeyFreigabe["user"]."';")){
if(!db_abfrage($dbconn, "INSERT INTO passkeys SET credentialId = ?, credentialPublicKey = ?, signatureCounter = ?, name = ?, userId = ?, lastAuth = NOW(), authKey = 0",
array(base64_encode($data->credentialId), base64_encode($data->credentialPublicKey), base64_encode($data->signatureCounter), (string)filter_input(INPUT_GET, 'name'), $passkeyFreigabe["user"]))){
$msg = "Error:<br>".mysqli_error($dbconn)."<br />";
}
else{
@@ -236,12 +235,11 @@ try {
// looking up correspondending public key of the credential id
// you should also validate that only ids of the given user name
// are taken for the login.
$result = mysqli_query($dbconn,"SELECT credentialPublicKey, userId, name FROM passkeys WHERE credentialId = '".base64_encode($id)."';");
if(!$result){
$msg = "Error:<br>".mysqli_error($dbconn)."<br />";
$row = db_zeile($dbconn, "SELECT credentialPublicKey, userId, name FROM passkeys WHERE credentialId = ?", array(base64_encode((string)$id)));
if ($row === false) {
throw new Exception(mysqli_error($dbconn));
}
if ($result->num_rows > 0) {
$row = $result->fetch_assoc();
if ($row) {
$userId = $row["userId"];
$credentialPublicKey = base64_decode($row["credentialPublicKey"]);
$reg = (object) ['userId' => base64_decode($row["userId"])];
@@ -270,16 +268,15 @@ try {
$authKey = strval(random_int(0,99999999));
$result = mysqli_query($dbconn,"UPDATE passkeys SET authKey=".$authKey.", lastAuth=NOW() WHERE credentialId = '".base64_encode($id)."';");
db_abfrage($dbconn, "UPDATE passkeys SET authKey = ?, lastAuth = NOW() WHERE credentialId = ?", array($authKey, base64_encode($id)));
// Gesperrte Benutzer bleiben gesperrt, auch mit gültigem Passkey
$qry= mysqli_query($dbconn, "SELECT * FROM user WHERE id = '".mysqli_real_escape_string($dbconn,$userId)."' AND blocked = 0");
if(!$qry || mysqli_num_rows($qry) != 1)
$udata = db_zeile($dbconn, "SELECT * FROM user WHERE id = ? AND blocked = 0", array($userId));
if(!$udata)
{
throw new Exception('Benutzer nicht gefunden oder gesperrt.');
}
else
{
$udata = mysqli_fetch_assoc($qry);
session_regenerate_id(true);
$_SESSION["login"] = "valid";
$_SESSION["logedout"] = $udata["logedout"];
@@ -299,7 +296,7 @@ try {
$_SESSION["zoom"] = getUserSetting($dbconn,"zoom", $_SESSION["user"], 1);
$_SESSION["privateNotes"] = getUserSetting($dbconn,"privnotes", $_SESSION["user"], "");
mysqli_query($dbconn, "UPDATE user SET wrongpw = 0, lastlogin = NOW(), numlogins = numlogins + 1, logedout = 0 WHERE id = '".mysqli_real_escape_string($dbconn,$userId)."'");
db_abfrage($dbconn, "UPDATE user SET wrongpw = 0, lastlogin = NOW(), numlogins = numlogins + 1, logedout = 0 WHERE id = ?", array($userId));
}
$return = new stdClass();
$return->success = true;