diff --git a/boot.php b/boot.php
index 392b34039..842113c31 100755
--- a/boot.php
+++ b/boot.php
@@ -51,12 +51,21 @@ define ( 'ZOT_REVISION', 1 );
define ( 'DB_UPDATE_VERSION', 1131 );
+/**
+ * Constant with a HTML line break.
+ *
+ * Contains a HTML line break (br) element and a real carriage return with line
+ * feed for the source.
+ * This can be used in HTML and JavaScript where needed a line break.
+ *
+ * @var string
+ */
define ( 'EOL', '
' . "\r\n" );
define ( 'ATOM_TIME', 'Y-m-d\TH:i:s\Z' );
//define ( 'NULL_DATE', '0000-00-00 00:00:00' );
define ( 'TEMPLATE_BUILD_PATH', 'store/[data]/smarty3' );
-define ( 'DIRECTORY_MODE_NORMAL', 0x0000); // This is technically DIRECTORY_MODE_TERTIARY, but it's the default, hence 0x0000
+define ( 'DIRECTORY_MODE_NORMAL', 0x0000); // This is technically DIRECTORY_MODE_TERTIARY, but it's the default, hence 0x0000
define ( 'DIRECTORY_MODE_PRIMARY', 0x0001);
define ( 'DIRECTORY_MODE_SECONDARY', 0x0002);
define ( 'DIRECTORY_MODE_STANDALONE', 0x0100);
diff --git a/include/RedDAV/RedBasicAuth.php b/include/RedDAV/RedBasicAuth.php
index 2f86d4f82..19dd9a5f0 100644
--- a/include/RedDAV/RedBasicAuth.php
+++ b/include/RedDAV/RedBasicAuth.php
@@ -118,8 +118,11 @@ class RedBasicAuth extends DAV\Auth\Backend\AbstractBasic {
}
}
}
- logger('password failed for ' . $username);
- // @TODO add security logger
+
+ $error = 'password failed for ' . $username;
+ logger($error);
+ log_failed_login($error);
+
return false;
}
diff --git a/include/RedDAV/RedBrowser.php b/include/RedDAV/RedBrowser.php
index 21ea76aed..eb08fd79f 100644
--- a/include/RedDAV/RedBrowser.php
+++ b/include/RedDAV/RedBrowser.php
@@ -182,10 +182,10 @@ class RedBrowser extends DAV\Browser\Plugin {
}
}
}
-
- $parentHash = "";
+
+ $parentHash = '';
$owner = $this->auth->owner_id;
- $splitPath = split("/", $fullPath);
+ $splitPath = split('/', $fullPath);
if (count($splitPath) > 3) {
for ($i = 3; $i < count($splitPath); $i++) {
$attachName = urldecode($splitPath[$i]);
@@ -233,6 +233,7 @@ class RedBrowser extends DAV\Browser\Plugin {
}
// prepare quota for template
+ $quota = array();
$quota['used'] = $used;
$quota['limit'] = $limit;
$quota['desc'] = $quotaDesc;
@@ -257,7 +258,7 @@ class RedBrowser extends DAV\Browser\Plugin {
$this->server->broadcastEvent('onHTMLActionsPanel', array($parent, &$output));
}
$html .= $output;
-
+
get_app()->page['content'] = $html;
load_pdl(get_app());
construct_page(get_app());
diff --git a/include/auth.php b/include/auth.php
index 94c64e58d..545fbe8c9 100644
--- a/include/auth.php
+++ b/include/auth.php
@@ -41,6 +41,9 @@ function nuke_session() {
/**
* @brief Verify login credentials.
*
+ * If system authlog is set a log entry will be added for failed login
+ * attempts.
+ *
* @param string $email
* The email address to verify.
* @param string $pass
@@ -88,14 +91,25 @@ function account_verify_password($email, $pass) {
if($record['account_flags'] & ACCOUNT_PENDING)
logger('Account is pending. account_flags = ' . $record['account_flags']);
- // Also log failed logins to a separate auth log to reduce overhead for server side intrusion prevention
- $authlog = get_config('system', 'authlog');
- if ($authlog)
- @file_put_contents($authlog, datetime_convert() . ':' . session_id() . ' ' . $error . "\n", FILE_APPEND);
+ log_failed_login($error);
return null;
}
+/**
+ * @brief Log failed logins to a separate auth log.
+ *
+ * Can be used to reduce overhead for server side intrusion prevention, like
+ * parse the authlog file with something like fail2ban, OSSEC, etc.
+ *
+ * @param string $errormsg
+ * Error message to display for failed login.
+ */
+function log_failed_login($errormsg) {
+ $authlog = get_config('system', 'authlog');
+ if ($authlog)
+ @file_put_contents($authlog, datetime_convert() . ':' . session_id() . ' ' . $errormsg . PHP_EOL, FILE_APPEND);
+}
/**
* Inline - not a function
diff --git a/include/text.php b/include/text.php
index 70a8f1179..3a7c02362 100644
--- a/include/text.php
+++ b/include/text.php
@@ -181,34 +181,34 @@ function autoname($len) {
'kh', 'kl','kr','mn','pl','pr','rh','tr','qu','wh');
$start = mt_rand(0,2);
- if($start == 0)
- $table = $vowels;
- else
- $table = $cons;
+ if($start == 0)
+ $table = $vowels;
+ else
+ $table = $cons;
$word = '';
for ($x = 0; $x < $len; $x ++) {
- $r = mt_rand(0,count($table) - 1);
- $word .= $table[$r];
-
- if($table == $vowels)
- $table = array_merge($cons,$midcons);
- else
- $table = $vowels;
+ $r = mt_rand(0,count($table) - 1);
+ $word .= $table[$r];
+
+ if($table == $vowels)
+ $table = array_merge($cons,$midcons);
+ else
+ $table = $vowels;
}
$word = substr($word,0,$len);
foreach($noend as $noe) {
- if((strlen($word) > 2) && (substr($word,-2) == $noe)) {
- $word = substr($word,0,-1);
- break;
- }
+ if((strlen($word) > 2) && (substr($word,-2) == $noe)) {
+ $word = substr($word,0,-1);
+ break;
+ }
}
if(substr($word,-1) == 'q')
- $word = substr($word,0,-1);
+ $word = substr($word,0,-1);
return $word;
}
@@ -224,11 +224,11 @@ function autoname($len) {
*/
function xmlify($str) {
$buffer = '';
-
+
$len = mb_strlen($str);
for($x = 0; $x < $len; $x ++) {
$char = mb_substr($str,$x,1);
-
+
switch( $char ) {
case "\r" :
@@ -267,7 +267,7 @@ function xmlify($str) {
function unxmlify($s) {
$ret = str_replace('&','&', $s);
$ret = str_replace(array('<','>','"','''),array('<','>','"',"'"),$ret);
- return $ret;
+ return $ret;
}
// convenience wrapper, reverse the operation "bin2hex"
@@ -314,8 +314,7 @@ function paginate(&$a) {
$pagenum = $a->pager['page'];
$url = $a->get_baseurl() . '/' . $stripped;
-
- if($a->pager['total'] > $a->pager['itemspage']) {
+ if($a->pager['total'] > $a->pager['itemspage']) {
$o .= '