From 191b839102ee056cab5dcda292ee44d24b79309e Mon Sep 17 00:00:00 2001
From: =?utf8?q?Tim=20D=C3=BCsterhus?= <duesterhus@woltlab.com>
Date: Fri, 10 May 2013 15:37:34 +0200
Subject: [PATCH] Fix master password

---
 wcfsetup/install/files/acp/templates/header.tpl  |  2 +-
 .../lib/acp/form/MasterPasswordForm.class.php    |  9 +++++++--
 .../acp/form/MasterPasswordInitForm.class.php    | 16 ++++++++--------
 .../install/files/lib/system/WCFACP.class.php    |  2 +-
 .../lib/system/request/LinkHandler.class.php     | 15 ++++++++++-----
 5 files changed, 27 insertions(+), 17 deletions(-)

diff --git a/wcfsetup/install/files/acp/templates/header.tpl b/wcfsetup/install/files/acp/templates/header.tpl
index 0c6990ff4e..b9dd0e7c53 100644
--- a/wcfsetup/install/files/acp/templates/header.tpl
+++ b/wcfsetup/install/files/acp/templates/header.tpl
@@ -139,7 +139,7 @@
 			{/if}
 			
 			<div id="logo" class="logo">
-				<a href="{link controller='Index'}{/link}">
+				<a href="{link}{/link}">
 					<h1>{lang}wcf.global.acp{/lang}</h1>
 					{if PACKAGE_ID > 1}
 						{event name='headerLogo'}
diff --git a/wcfsetup/install/files/lib/acp/form/MasterPasswordForm.class.php b/wcfsetup/install/files/lib/acp/form/MasterPasswordForm.class.php
index 6ab8106484..8da439081b 100755
--- a/wcfsetup/install/files/lib/acp/form/MasterPasswordForm.class.php
+++ b/wcfsetup/install/files/lib/acp/form/MasterPasswordForm.class.php
@@ -6,6 +6,7 @@ use wcf\system\request\LinkHandler;
 use wcf\system\WCF;
 use wcf\util\HeaderUtil;
 use wcf\util\PasswordUtil;
+use wcf\util\StringUtil;
 
 /**
  * Shows the master password form.
@@ -39,6 +40,10 @@ class MasterPasswordForm extends AbstractForm {
 		if (file_exists(WCF_DIR.'acp/masterPassword.inc.php')) {
 			require_once(WCF_DIR.'acp/masterPassword.inc.php');
 		}
+		else {
+			HeaderUtil::redirect(LinkHandler::getInstance()->getLink('MasterPasswordInit'));
+			exit;
+		}
 	}
 	
 	/**
@@ -62,7 +67,7 @@ class MasterPasswordForm extends AbstractForm {
 		}
 		
 		// check password
-		if (PasswordUtil::secureCompare(PasswordUtil::getSaltedHash($this->masterPassword, MASTER_PASSWORD_SALT), MASTER_PASSWORD)) {
+		if (!PasswordUtil::secureCompare(MASTER_PASSWORD, PasswordUtil::getDoubleSaltedHash($this->masterPassword, MASTER_PASSWORD))) {
 			throw new UserInputException('masterPassword', 'invalid');
 		}
 	}
@@ -92,7 +97,7 @@ class MasterPasswordForm extends AbstractForm {
 	public function readData() {
 		parent::readData();
 		
-		if (empty($_POST)) {
+		if (empty($_POST) && StringUtil::indexOf(WCF::getSession()->requestURI, 'MasterPassword') === false) {
 			$this->url = WCF::getSession()->requestURI;
 		}
 	}
diff --git a/wcfsetup/install/files/lib/acp/form/MasterPasswordInitForm.class.php b/wcfsetup/install/files/lib/acp/form/MasterPasswordInitForm.class.php
index 019bd62752..a6f7724a9d 100755
--- a/wcfsetup/install/files/lib/acp/form/MasterPasswordInitForm.class.php
+++ b/wcfsetup/install/files/lib/acp/form/MasterPasswordInitForm.class.php
@@ -30,10 +30,14 @@ class MasterPasswordInitForm extends MasterPasswordForm {
 	 * @see	wcf\page\IPage::readParameters()
 	 */
 	public function readParameters() {
-		parent::readParameters();
+		AbstractForm::readParameters();
 		
-		if (defined('MASTER_PASSWORD') && defined('MASTER_PASSWORD_SALT')) {
-			throw new IllegalLinkException();
+		if (file_exists(WCF_DIR.'acp/masterPassword.inc.php')) {
+			require_once(WCF_DIR.'acp/masterPassword.inc.php');
+			
+			if (defined('MASTER_PASSWORD')) {
+				throw new IllegalLinkException();
+			}
 		}
 	}
 	
@@ -96,16 +100,12 @@ class MasterPasswordInitForm extends MasterPasswordForm {
 	 * @see	wcf\form\IForm::save()
 	 */
 	public function save() {
-		// generate salt
-		$salt = PasswordUtil::getRandomSalt();
-		
 		// write master password file
 		$file = new File(WCF_DIR.'acp/masterPassword.inc.php');
 		$file->write("<?php
 /** MASTER PASSWORD STORAGE
 DO NOT EDIT THIS FILE */
-define('MASTER_PASSWORD', '".PasswordUtil::getSaltedHash($this->masterPassword, $salt)."');
-define('MASTER_PASSWORD_SALT', '".$salt."');
+define('MASTER_PASSWORD', '".PasswordUtil::getDoubleSaltedHash($this->masterPassword)."');
 ?>");
 		$file->close();
 		@chmod(WCF_DIR.'acp/masterPassword.inc.php', 0777);
diff --git a/wcfsetup/install/files/lib/system/WCFACP.class.php b/wcfsetup/install/files/lib/system/WCFACP.class.php
index 600636e436..e52542ee60 100644
--- a/wcfsetup/install/files/lib/system/WCFACP.class.php
+++ b/wcfsetup/install/files/lib/system/WCFACP.class.php
@@ -142,7 +142,7 @@ class WCFACP extends WCF {
 			if (file_exists(WCF_DIR.'acp/masterPassword.inc.php')) {
 				require_once(WCF_DIR.'acp/masterPassword.inc.php');
 			}
-			if (defined('MASTER_PASSWORD') && defined('MASTER_PASSWORD_SALT')) {
+			if (defined('MASTER_PASSWORD')) {
 				$form = new MasterPasswordForm();
 				$form->__run();
 				exit;
diff --git a/wcfsetup/install/files/lib/system/request/LinkHandler.class.php b/wcfsetup/install/files/lib/system/request/LinkHandler.class.php
index dd38afdf94..6ea96992d0 100644
--- a/wcfsetup/install/files/lib/system/request/LinkHandler.class.php
+++ b/wcfsetup/install/files/lib/system/request/LinkHandler.class.php
@@ -88,11 +88,16 @@ class LinkHandler extends SingletonFactory {
 		
 		// build route
 		if ($controller === null) {
-			// build link to landing page
-			$landingPage = PageMenu::getInstance()->getLandingPage();
-			$controller = $landingPage->getController();
-			$abbreviation = $landingPage->getApplication();
-			$url = $landingPage->menuItemLink;
+			if ($isACP) {
+				$controller = 'Index';
+			}
+			else {
+				// build link to landing page
+				$landingPage = PageMenu::getInstance()->getLandingPage();
+				$controller = $landingPage->getController();
+				$abbreviation = $landingPage->getApplication();
+				$url = $landingPage->menuItemLink;
+			}
 		}
 		
 		// handle object
-- 
2.20.1