admin/Kundenverwaltung
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Login und Passkeys auf Prepared Statements umgebaut

Browse Source 
- sites/start.php: ein Query statt zwei, Passwortvergleich per hash_equals
  in PHP statt im SQL, Updates per id. Die Eingaben gehen nicht mehr durch
  htmlspecialchars(): Passwoerter werden beim Anlegen roh gehasht, mit
  & < > " ' konnte man sich deshalb bisher nie anmelden.
- getUserSetting/updateUserSetting mit Platzhaltern; behoben: INSERT-Zweig
  rief mysqli_real_escape_string ohne Verbindung auf (Fatal Error),
  $mysqli_error als Variable, ungewolltes echo "update". Aufrufer escapen
  nicht mehr vor (sonst doppelt), settings.php: Tippfehler
  mysqi_real_escape_string beim Speichern von show_sks behoben, style nur
  als Dateiname ohne Pfad.
- authServer.php, addKey.php, userkeys.php, checkAdduser(): Platzhalter.
  Passkey-INSERT setzt lastAuth/authKey (Pflichtfelder im strikten Modus).
  addKey nur als reine Ziffern, sonst passte "12345678xyz" per Typumwandlung.
- checkLogin() entfernt: nirgends aufgerufen, fragte die nicht existierende
  Tabelle users ab.
- userkeys.tpl: Passkey-Name escaped.

Getestet gegen die migrierte Testdatenbank im strikten Modus.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
admin
2026-09-17 10:24:17 +02:00
co-authored by Claude Opus 5
parent e2596b6e1c
commit 6306bfba17
10 changed files with 108 additions and 158 deletions
Download Patch File Download Diff File Expand all files Collapse all files
addKey.php
+2 -6
View File
@@ -16,14 +16,10 @@ if($settings == "valid")
}
// Wie sites/userkeys.php: nur Superadmins dürfen Passkeys vergeben
if($_SESSION["login"] == "valid" && isset($_GET["id"]) && ((int)substr($_SESSION["rights"], RIGHTS_SUPERADMIN, 1) & RIGHTS_CHANGE)){
if(!mysqli_query($dbconn,"DELETE FROM addKey WHERE datetime < DATE_SUB(NOW(), INTERVAL 1 MINUTE);")){
echo mysqli_error($dbconn);
}
db_abfrage($dbconn, "DELETE FROM addKey WHERE datetime < DATE_SUB(NOW(), INTERVAL 1 MINUTE)") or print(mysqli_error($dbconn));
if(isLocal()){
$accessKey = strval(random_int(0,99999999));
if(!mysqli_query($dbconn,"INSERT INTO addKey SET accesskey=".$accessKey.", datetime=NOW();")){
echo mysqli_error($dbconn);
}
db_abfrage($dbconn, "INSERT INTO addKey SET accesskey = ?, datetime = NOW()", array($accessKey)) or print(mysqli_error($dbconn));
header('Location: https://wm.el-wa.org/kunden?action=userkeys&id='.(int)$_GET["id"].'&addKey='.$accessKey);
echo 'https://wm.el-wa.org/kunden?action=userkeys&id='.(int)$_GET["id"].'&addKey='.$accessKey;
}else{
ajax/searchkdnrech.php
+1 -1
View File
@@ -123,7 +123,7 @@ if(!isset($err))
//OLD SKS RECHNUNGEN!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
if(getUserSetting($dbconn,"show_sks", mysql_escape_string($_SESSION["user"]), 1)) //show sks rechnungen????
if(getUserSetting($dbconn,"show_sks", $_SESSION["user"], 1)) //show sks rechnungen????
{
echo "<h3>SKS Dokumente:</h3><div class='line'></div>";
$queries="";
ajax/searchrech.php
+1 -1
View File
@@ -118,7 +118,7 @@ if(!isset($err))
//OLD SKS RECHNUNGEN!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
if(getUserSetting($dbconn,"show_sks", mysql_escape_string($_SESSION["user"]), 1)) //show sks rechnungen????
if(getUserSetting($dbconn,"show_sks", $_SESSION["user"], 1)) //show sks rechnungen????
{
echo "<h3>SKS Dokumente:</h3><div class='line'></div>";
$queries = createRechQry($skspage,$pagesize,$src,$combiner,1);
authServer.php
+19 -22
View File
@@ -139,23 +139,21 @@ try {
// ------------------------------------
} else if ($fn === 'getGetArgs') {
$result = mysqli_query($dbconn,"SELECT id FROM user WHERE nick = '".mysqli_real_escape_string($dbconn,$_GET["user"])."';");
if ($result->num_rows > 0) {
$row = $result->fetch_assoc();
$userId = $row["id"];
}else{
$userId = db_wert($dbconn, "SELECT id FROM user WHERE nick = ?", array((string)filter_input(INPUT_GET, 'user')));
if ($userId === false) {
throw new Exception(mysqli_error($dbconn));
}
if ($userId === null) {
throw new Exception('Username not found');
}
$ids = [];
$result = mysqli_query($dbconn,"SELECT credentialId FROM passkeys WHERE userId = '".$userId."';");
if(!$result){
$msg = "Error:<br>".mysqli_error($dbconn)."<br />";
$zeilen = db_zeilen($dbconn, "SELECT credentialId FROM passkeys WHERE userId = ?", array($userId));
if ($zeilen === false) {
throw new Exception(mysqli_error($dbconn));
}
if ($result->num_rows > 0) {
while($row = $result->fetch_assoc()) {
foreach ($zeilen as $row) {
$ids[] = base64_decode($row["credentialId"]);
}
}
if (count($ids) === 0) {
throw new Exception('no registrations in session for userId ' . $userId);
@@ -197,7 +195,8 @@ try {
if (!isset($_SESSION['registrations']) || !array_key_exists('registrations', $_SESSION) || !is_array($_SESSION['registrations'])) {
$_SESSION['registrations'] = [];
}*/
if(!mysqli_query($dbconn,"INSERT INTO passkeys SET credentialId = '".base64_encode($data->credentialId)."', credentialPublicKey = '".base64_encode($data->credentialPublicKey)."', signatureCounter = '".base64_encode($data->signatureCounter)."', name = '".mysqli_real_escape_string($mysql,filter_input(INPUT_GET, 'name'))."', userId = '".(int)$passkeyFreigabe["user"]."';")){
if(!db_abfrage($dbconn, "INSERT INTO passkeys SET credentialId = ?, credentialPublicKey = ?, signatureCounter = ?, name = ?, userId = ?, lastAuth = NOW(), authKey = 0",
array(base64_encode($data->credentialId), base64_encode($data->credentialPublicKey), base64_encode($data->signatureCounter), (string)filter_input(INPUT_GET, 'name'), $passkeyFreigabe["user"]))){
$msg = "Error:<br>".mysqli_error($dbconn)."<br />";
}
else{
@@ -236,12 +235,11 @@ try {
// looking up correspondending public key of the credential id
// you should also validate that only ids of the given user name
// are taken for the login.
$result = mysqli_query($dbconn,"SELECT credentialPublicKey, userId, name FROM passkeys WHERE credentialId = '".base64_encode($id)."';");
if(!$result){
$msg = "Error:<br>".mysqli_error($dbconn)."<br />";
$row = db_zeile($dbconn, "SELECT credentialPublicKey, userId, name FROM passkeys WHERE credentialId = ?", array(base64_encode((string)$id)));
if ($row === false) {
throw new Exception(mysqli_error($dbconn));
}
if ($result->num_rows > 0) {
$row = $result->fetch_assoc();
if ($row) {
$userId = $row["userId"];
$credentialPublicKey = base64_decode($row["credentialPublicKey"]);
$reg = (object) ['userId' => base64_decode($row["userId"])];
@@ -270,16 +268,15 @@ try {
$authKey = strval(random_int(0,99999999));
$result = mysqli_query($dbconn,"UPDATE passkeys SET authKey=".$authKey.", lastAuth=NOW() WHERE credentialId = '".base64_encode($id)."';");
db_abfrage($dbconn, "UPDATE passkeys SET authKey = ?, lastAuth = NOW() WHERE credentialId = ?", array($authKey, base64_encode($id)));
// Gesperrte Benutzer bleiben gesperrt, auch mit gültigem Passkey
$qry= mysqli_query($dbconn, "SELECT * FROM user WHERE id = '".mysqli_real_escape_string($dbconn,$userId)."' AND blocked = 0");
if(!$qry || mysqli_num_rows($qry) != 1)
$udata = db_zeile($dbconn, "SELECT * FROM user WHERE id = ? AND blocked = 0", array($userId));
if(!$udata)
{
throw new Exception('Benutzer nicht gefunden oder gesperrt.');
}
else
{
$udata = mysqli_fetch_assoc($qry);
session_regenerate_id(true);
$_SESSION["login"] = "valid";
$_SESSION["logedout"] = $udata["logedout"];
@@ -299,7 +296,7 @@ try {
$_SESSION["zoom"] = getUserSetting($dbconn,"zoom", $_SESSION["user"], 1);
$_SESSION["privateNotes"] = getUserSetting($dbconn,"privnotes", $_SESSION["user"], "");
mysqli_query($dbconn, "UPDATE user SET wrongpw = 0, lastlogin = NOW(), numlogins = numlogins + 1, logedout = 0 WHERE id = '".mysqli_real_escape_string($dbconn,$userId)."'");
db_abfrage($dbconn, "UPDATE user SET wrongpw = 0, lastlogin = NOW(), numlogins = numlogins + 1, logedout = 0 WHERE id = ?", array($userId));
}
$return = new stdClass();
$return->success = true;
incs/authHelper.php
+8 -32
View File
@@ -84,41 +84,17 @@ function isLocal(){
return $lokal;
}
function checkLogin(){
global $mysql;
//$mysql = new mysqli($GLOBALS["mysql_server"],$GLOBALS["mysql_user"],$GLOBALS["mysql_pass"],$GLOBALS["mysql_db"]);
if(isLocal()){
$_SESSION["local"] =true;
return true;
}
if(isset($_SESSION["authKey"])){
$res = mysqli_query($mysql,"SELECT id FROM users WHERE lastAuth > DATE_SUB(NOW(), INTERVAL 2 DAY) AND authKey = '".mysqli_real_escape_string($mysql,$_SESSION["authKey"])."' AND name = '".mysqli_real_escape_string($mysql,$_SESSION["user"])."';");
if(!$res){
echo mysqli_error($mysql);
return false;
}
if(mysqli_num_rows($res) == 1){
return isset($_SESSION["Logged"]);
}
}else{
return false;
}
}
/* Ist $_GET["addKey"] eine gültige, höchstens eine Minute alte Freigabe? */
function checkAdduser(){
global $mysql;
//$mysql = new mysqli($GLOBALS["mysql_server"],$GLOBALS["mysql_user"],$GLOBALS["mysql_pass"],$GLOBALS["mysql_db"]);
if(!mysqli_query($mysql,"DELETE FROM addKey WHERE datetime < DATE_SUB(NOW(), INTERVAL 1 MINUTE);")){
echo mysqli_error($mysql);
}
$result = mysqli_query($mysql,"SELECT * FROM addKey WHERE accesskey='".mysqli_real_escape_string($mysql,$_GET["addKey"])."';");
if(!$result){
return false;
}
if ($result->num_rows > 0) {
return true;
}
db_abfrage($mysql, "DELETE FROM addKey WHERE datetime < DATE_SUB(NOW(), INTERVAL 1 MINUTE)") or print(mysqli_error($mysql));
// Nur reine Ziffern: accesskey ist eine Zahlenspalte, MariaDB würde
// "12345678xyz" beim Vergleich stillschweigend zu 12345678 machen.
$key = $_GET["addKey"] ?? "";
if(!is_string($key) || !ctype_digit($key))
return false;
$anzahl = db_wert($mysql, "SELECT COUNT(*) FROM addKey WHERE accesskey = ?", array((int)$key));
return $anzahl > 0;
}
?>
incs/settings.php
+14 -17
View File
@@ -18,30 +18,27 @@ function readsettings()
}
/*
* Benutzereinstellungen. Werte und ids roh übergeben - nicht escapen, das
* erledigen die Platzhalter.
*/
function getUserSetting($dbconn,$setting, $user, $default = 0)
{
$qry2 = mysqli_query($dbconn, "SELECT val FROM setting WHERE opt = '".mysqli_real_escape_string($dbconn, $setting)."' AND user_id = '".mysqli_real_escape_string($dbconn, $user)."'") or die(mysqli_error($dbconn));
if($res = mysqli_fetch_array($qry2))
$ret = $res[0];
else
$ret = $default;
return $ret;
$wert = db_wert($dbconn, "SELECT val FROM setting WHERE opt = ? AND user_id = ?", array($setting, $user));
if($wert === false)
die(mysqli_error($dbconn));
return $wert === null ? $default : $wert;
}
function updateUserSetting($dbconn,$setting, $value, $user)
{
$qry = mysqli_query($dbconn,"SELECT id FROM setting WHERE opt = '".mysqli_real_escape_string($dbconn, $setting)."' AND user_id = '".mysqli_real_escape_string($dbconn, $user)."'") or die(mysqli_error($dbconn));
if(mysqli_num_rows($qry))
{
$res = mysqli_fetch_array($qry);
mysqli_query($dbconn, "UPDATE setting SET val = '".mysqli_real_escape_string($dbconn, $value)."' WHERE id = ".$res[0]) or die($mysqli_error($dbconn));
echo "update";
}
$id = db_wert($dbconn, "SELECT id FROM setting WHERE opt = ? AND user_id = ?", array($setting, $user));
if($id === false)
die(mysqli_error($dbconn));
if($id !== null)
db_abfrage($dbconn, "UPDATE setting SET val = ? WHERE id = ?", array($value, $id)) or die(mysqli_error($dbconn));
else
{
mysqli_query($dbconn, "INSERT INTO setting SET val = '".mysqli_real_escape_string($dbconn, $value)."', user_id = '".mysqli_real_escape_string($dbconn, $user)."', opt = '".mysqli_real_escape_string($setting)."'") or die(mysqli_error($dbconn));
}
db_abfrage($dbconn, "INSERT INTO setting SET val = ?, user_id = ?, opt = ?", array($value, $user, $setting)) or die(mysqli_error($dbconn));
}
sites/settings.php
+5 -4
View File
@@ -76,12 +76,13 @@ else
{
if($_GET["formsent"] == 1)
{
if(is_file("./styles/".$_POST["style"]))
// nur Dateien direkt in styles/, kein ../
if(basename($_POST["style"]) === $_POST["style"] && is_file("./styles/".$_POST["style"]))
{
updateUserSetting($dbconn,"style", mysqli_real_escape_string($dbconn,$_POST["style"]), mysqli_real_escape_string($dbconn,$_SESSION["user"]));
updateUserSetting($dbconn,"style", $_POST["style"], $_SESSION["user"]);
$_SESSION["style"] = $_POST["style"];
}
updateUserSetting($dbconn,"show_sks", mysqi_real_escape_string($dbconn,$_POST["show_sks"]), mysqli_real_escape_string($dbconn,$_SESSION["user"]));
updateUserSetting($dbconn,"show_sks", (int)$_POST["show_sks"], $_SESSION["user"]);
}
if(substr($_SESSION["rights"],RIGHTS_SUPERADMIN,1) & RIGHTS_CHANGE || substr($_SESSION["rights"],RIGHTS_SUPERADMIN,1) & RIGHTS_ADD)
$smarty->assign("superadmin","add");
@@ -129,7 +130,7 @@ else
}
$show_sks = getUserSetting($dbconn,"show_sks", mysqli_real_escape_string($dbconn,$_SESSION["user"]), 1);
$show_sks = getUserSetting($dbconn,"show_sks", $_SESSION["user"], 1);
$smarty->assign("show_sks",$show_sks);
$smarty->assign("styles",$styles);
sites/start.php
+17 -33
View File
@@ -1,25 +1,21 @@
<?php
if(!isset($_POST["user"]))
$_POST["user"] = "";
else
$_POST["user"] = htmlspecialchars($_POST["user"]);
if(!isset($_POST["pass"]))
$_POST["pass"] = "";
else
$_POST["pass"] = htmlspecialchars($_POST["pass"]);
$smarty->display("heading.tpl");
$smarty->assign("local",isLocal());
if(isset($_GET["formsent"]) && $_SESSION["login"] != "valid" && isLocal())
{
$qry= mysqli_query($dbconn, "SELECT salt FROM user WHERE LOWER(nick) = '".mysql_escape_string(strtolower($_POST["user"]))."' AND blocked = 0") or error("Es ist ein Fehler in der abfrage der Benutzerdaten: <br />".formaterror(mysqli_error($dbconn)));
if(mysqli_num_rows($qry) == 1)
// Eingaben unverändert verwenden: Passwörter werden beim Anlegen roh
// gehasht, ein htmlspecialchars() hier ließ Passwörter mit & < > " '
// nie passen. Ausgabe-Escaping übernimmt das Template.
$nick = isset($_POST["user"]) && is_string($_POST["user"]) ? $_POST["user"] : "";
$pass = isset($_POST["pass"]) && is_string($_POST["pass"]) ? $_POST["pass"] : "";
$udata = db_zeile($dbconn, "SELECT * FROM user WHERE nick = ? AND blocked = 0", array($nick));
if($udata === false)
error("Es ist ein Fehler in der abfrage der Benutzerdaten: <br />".formaterror(mysqli_error($dbconn)));
elseif($udata === null)
error("Dieser Benutzername existiert nicht.");
elseif(hash_equals($udata["pass"], crypt($pass, $udata["salt"])))
{
$res = mysqli_fetch_array($qry);
$qry= mysqli_query($dbconn, "SELECT * FROM user WHERE nick = '".mysql_escape_string($_POST["user"])."' AND pass = '".crypt($_POST["pass"],$res[0])."'") or error("Es ist ein Fehler in der abfrage der Benutzerdaten: <br />".formaterror(mysqli_error($dbconn)));
if(mysqli_num_rows($qry) == 1)
{
$udata = mysqli_fetch_assoc($qry);
// neue Session-ID nach dem Login, sonst ist Session-Fixation möglich
session_regenerate_id(true);
$_SESSION["login"] = "valid";
@@ -40,18 +36,12 @@ if(isset($_GET["formsent"]) && $_SESSION["login"] != "valid" && isLocal())
$_SESSION["zoom"] = getUserSetting($dbconn,"zoom", $_SESSION["user"], 1);
$_SESSION["privateNotes"] = getUserSetting($dbconn,"privnotes", $_SESSION["user"], "");
mysqli_query($dbconn, "UPDATE user SET wrongpw = 0, lastlogin = NOW(), numlogins = numlogins + 1, logedout = 0 WHERE nick = '".mysql_escape_string($_POST["user"])."'");
db_abfrage($dbconn, "UPDATE user SET wrongpw = 0, lastlogin = NOW(), numlogins = numlogins + 1, logedout = 0 WHERE id = ?", array($udata["id"]));
}
else
elseif($udata["wrongpw"] < 10)
{
$qry= mysqli_query($dbconn, "SELECT wrongpw FROM user WHERE nick = '".mysql_escape_string($_POST["user"])."'") or error("Es ist ein Fehler in der abfrage der Benutzerdaten: <br />".formaterror(mysqli_error($dbconn)));;
if(mysqli_num_rows($qry))
{
$wrongpw = mysqli_fetch_array($qry);
if($wrongpw[0] < 10)
{
mysqli_query($dbconn, "UPDATE user SET wrongpw = wrongpw + 1 WHERE nick = '".mysql_escape_string($_POST["user"])."'");
$triesleft = 10 - $wrongpw[0];
db_abfrage($dbconn, "UPDATE user SET wrongpw = wrongpw + 1 WHERE id = ?", array($udata["id"]));
$triesleft = 10 - $udata["wrongpw"];
if($triesleft > 1)
error("Der Benuzername oder das Passwort sind falsch, bitte versuchen Sie es erneut (Nach weiteren $triesleft Versuchen wird der Benutzer deaktiviert und muss vom Hauptbenutzer wieder aktiviert werden, damit er sich anmelden kann.)");
else
@@ -59,15 +49,9 @@ if(isset($_GET["formsent"]) && $_SESSION["login"] != "valid" && isLocal())
}
else
{
mysqli_query($dbconn, "UPDATE user SET blocked = 1 WHERE nick = '".mysql_escape_string($_POST["user"])."'");
db_abfrage($dbconn, "UPDATE user SET blocked = 1 WHERE id = ?", array($udata["id"]));
error("Der Benuzer wurde deaktiviert, er muss vom Hauptbenutzer wieder aktiviert werden, damit er sich anmelden kann.");
}
}
}
}
else
error("Dieser Benutzername existiert nicht.");
}
if($_SESSION["login"]=="valid"){
header('Location:?action=kunden');
sites/userkeys.php
+7 -8
View File
@@ -7,7 +7,7 @@ if(isset($_GET["id"]) && isset($_GET["addKey"])){
// in dieser Session (geprüft in authServer.php). Der addKey ist damit
// verbraucht.
$_SESSION["passkey_freigabe"] = array("user" => (int)$_GET["id"], "bis" => time() + 300);
mysqli_query($mysql, "DELETE FROM addKey WHERE accesskey = '".mysqli_real_escape_string($mysql, $_GET["addKey"])."'");
db_abfrage($mysql, "DELETE FROM addKey WHERE accesskey = ?", array((int)$_GET["addKey"]));
echo <<<ENDE
<html>
<head></head>
@@ -78,15 +78,14 @@ if(isset($_GET["id"]) && isset($_GET["addKey"])){
$smarty->assign("heading","Passkeys für externen Zugang verwalten");
$smarty->display("heading.tpl");
$qry = mysqli_query($_SESSION["dbconn"],"SELECT id, vname, nname FROM user WHERE blocked = 0 AND user.id = ".(int)$_GET["id"]) or die("Datenbank fehler: ".mysqli_error($_SESSION["dbconn"]));
$row=mysqli_fetch_array($qry);
$row = db_zeile($dbconn, "SELECT id, vname, nname FROM user WHERE blocked = 0 AND user.id = ?", array($_GET["id"]));
if($row === false)
die("Datenbank fehler: ".mysqli_error($dbconn));
$smarty->assign("user",$row);
$qry = mysqli_query($_SESSION["dbconn"],"SELECT passkeys.id , passkeys.name FROM user JOIN passkeys ON user.id = passkeys.userId WHERE blocked = 0 AND user.id = ".(int)$_GET["id"]) or die("Datenbank fehler: ".mysqli_error($_SESSION["dbconn"]));
$keys = array();
while($row=mysqli_fetch_array($qry)){
$keys[] = $row;
}
$keys = db_zeilen($dbconn, "SELECT passkeys.id, passkeys.name FROM user JOIN passkeys ON user.id = passkeys.userId WHERE blocked = 0 AND user.id = ?", array($_GET["id"]));
if($keys === false)
die("Datenbank fehler: ".mysqli_error($dbconn));
$smarty->assign("keys",$keys);
$smarty->assign("local",isLocal());
$smarty->display("userkeys.tpl");
templates/userkeys.tpl
+1 -1
View File
@@ -10,7 +10,7 @@
<table><tr><th>Name</th><th>Aktion</th></tr>
{foreach $keys as $key}
<tr>
<td>{$key.name}</td>
<td>{$key.name|escape}</td>
<td><a href="?action=userkeys&amp;id={$user.id}&amp;del={$key.id}"><span class="del" title="Passkey löschen"></span></a></td>
</tr>
{/foreach}