Fix master password

diff --git a/wcfsetup/install/files/acp/templates/header.tpl b/wcfsetup/install/files/acp/templates/header.tpl
index 0c6990ff4e83d80f66608ffeab5a051c7caeb226..b9dd0e7c5368ba3186a2448163baf9b517f1ca02 100644 (file)
--- a/wcfsetup/install/files/acp/templates/header.tpl
+++ b/wcfsetup/install/files/acp/templates/header.tpl
@@ -139,7 +139,7 @@
                        {/if}
                        
                        <div id="logo" class="logo">
-                               <a href="{link controller='Index'}{/link}">
+                               <a href="{link}{/link}">
                                        <h1>{lang}wcf.global.acp{/lang}</h1>
                                        {if PACKAGE_ID > 1}
                                                {event name='headerLogo'}

diff --git a/wcfsetup/install/files/lib/acp/form/MasterPasswordForm.class.php b/wcfsetup/install/files/lib/acp/form/MasterPasswordForm.class.php
index 6ab8106484e15ffcc92ca0cdb652de1ad1212e56..8da439081bfb37175d0a4ebb975c0097ada69a43 100755 (executable)
--- a/wcfsetup/install/files/lib/acp/form/MasterPasswordForm.class.php
+++ b/wcfsetup/install/files/lib/acp/form/MasterPasswordForm.class.php
@@ -6,6 +6,7 @@ use wcf\system\request\LinkHandler;
 use wcf\system\WCF;
 use wcf\util\HeaderUtil;
 use wcf\util\PasswordUtil;
+use wcf\util\StringUtil;
 
 /**
  * Shows the master password form.
@@ -39,6 +40,10 @@ class MasterPasswordForm extends AbstractForm {
                if (file_exists(WCF_DIR.'acp/masterPassword.inc.php')) {
                        require_once(WCF_DIR.'acp/masterPassword.inc.php');
                }
+               else {
+                       HeaderUtil::redirect(LinkHandler::getInstance()->getLink('MasterPasswordInit'));
+                       exit;
+               }
        }
        
        /**
@@ -62,7 +67,7 @@ class MasterPasswordForm extends AbstractForm {
                }
                
                // check password
-               if (PasswordUtil::secureCompare(PasswordUtil::getSaltedHash($this->masterPassword, MASTER_PASSWORD_SALT), MASTER_PASSWORD)) {
+               if (!PasswordUtil::secureCompare(MASTER_PASSWORD, PasswordUtil::getDoubleSaltedHash($this->masterPassword, MASTER_PASSWORD))) {
                        throw new UserInputException('masterPassword', 'invalid');
                }
        }
@@ -92,7 +97,7 @@ class MasterPasswordForm extends AbstractForm {
        public function readData() {
                parent::readData();
                
-               if (empty($_POST)) {
+               if (empty($_POST) && StringUtil::indexOf(WCF::getSession()->requestURI, 'MasterPassword') === false) {
                        $this->url = WCF::getSession()->requestURI;
                }
        }

diff --git a/wcfsetup/install/files/lib/acp/form/MasterPasswordInitForm.class.php b/wcfsetup/install/files/lib/acp/form/MasterPasswordInitForm.class.php
index 019bd627529314e3f2094dc25ccef1057ba8fd3a..a6f7724a9d380af9ff8cc6e2b1acbfa13464e81a 100755 (executable)
--- a/wcfsetup/install/files/lib/acp/form/MasterPasswordInitForm.class.php
+++ b/wcfsetup/install/files/lib/acp/form/MasterPasswordInitForm.class.php
@@ -30,10 +30,14 @@ class MasterPasswordInitForm extends MasterPasswordForm {
         * @see wcf\page\IPage::readParameters()
         */
        public function readParameters() {
-               parent::readParameters();
+               AbstractForm::readParameters();
                
-               if (defined('MASTER_PASSWORD') && defined('MASTER_PASSWORD_SALT')) {
-                       throw new IllegalLinkException();
+               if (file_exists(WCF_DIR.'acp/masterPassword.inc.php')) {
+                       require_once(WCF_DIR.'acp/masterPassword.inc.php');
+                       
+                       if (defined('MASTER_PASSWORD')) {
+                               throw new IllegalLinkException();
+                       }
                }
        }
        
@@ -96,16 +100,12 @@ class MasterPasswordInitForm extends MasterPasswordForm {
         * @see wcf\form\IForm::save()
         */
        public function save() {
-               // generate salt
-               $salt = PasswordUtil::getRandomSalt();
-               
                // write master password file
                $file = new File(WCF_DIR.'acp/masterPassword.inc.php');
                $file->write("<?php
 /** MASTER PASSWORD STORAGE
 DO NOT EDIT THIS FILE */
-define('MASTER_PASSWORD', '".PasswordUtil::getSaltedHash($this->masterPassword, $salt)."');
-define('MASTER_PASSWORD_SALT', '".$salt."');
+define('MASTER_PASSWORD', '".PasswordUtil::getDoubleSaltedHash($this->masterPassword)."');
 ?>");
                $file->close();
                @chmod(WCF_DIR.'acp/masterPassword.inc.php', 0777);

diff --git a/wcfsetup/install/files/lib/system/WCFACP.class.php b/wcfsetup/install/files/lib/system/WCFACP.class.php
index 600636e43663acf3b45b83d61e359e6c3687482e..e52542ee6039e4077b7fb95e1285954cd5c41ec3 100644 (file)
--- a/wcfsetup/install/files/lib/system/WCFACP.class.php
+++ b/wcfsetup/install/files/lib/system/WCFACP.class.php
@@ -142,7 +142,7 @@ class WCFACP extends WCF {
                        if (file_exists(WCF_DIR.'acp/masterPassword.inc.php')) {
                                require_once(WCF_DIR.'acp/masterPassword.inc.php');
                        }
-                       if (defined('MASTER_PASSWORD') && defined('MASTER_PASSWORD_SALT')) {
+                       if (defined('MASTER_PASSWORD')) {
                                $form = new MasterPasswordForm();
                                $form->__run();
                                exit;

diff --git a/wcfsetup/install/files/lib/system/request/LinkHandler.class.php b/wcfsetup/install/files/lib/system/request/LinkHandler.class.php
index dd38afdf94f2209c34e5de6fdc142fc5c280a5f0..6ea96992d01547d8fb91a670ee834dec8ff8305d 100644 (file)
--- a/wcfsetup/install/files/lib/system/request/LinkHandler.class.php
+++ b/wcfsetup/install/files/lib/system/request/LinkHandler.class.php
@@ -88,11 +88,16 @@ class LinkHandler extends SingletonFactory {
                
                // build route
                if ($controller === null) {
-                       // build link to landing page
-                       $landingPage = PageMenu::getInstance()->getLandingPage();
-                       $controller = $landingPage->getController();
-                       $abbreviation = $landingPage->getApplication();
-                       $url = $landingPage->menuItemLink;
+                       if ($isACP) {
+                               $controller = 'Index';
+                       }
+                       else {
+                               // build link to landing page
+                               $landingPage = PageMenu::getInstance()->getLandingPage();
+                               $controller = $landingPage->getController();
+                               $abbreviation = $landingPage->getApplication();
+                               $url = $landingPage->menuItemLink;
+                       }
                }
                
                // handle object