holm/egroupware
1
1
Fork 0
forked from extern/egroupware
Code Issues Pull Requests Packages Projects Releases Wiki Activity
20,053 Commits 27 Branches 330 Tags 157 MiB
e1241d80f1
Commit Graph

65 Commits

Author SHA1 Message Date
Ralf Becker
9b88b849f6 * SiteMgr: sitewide config to allow proxys and CDNs caching of anonymous requests (Expires and Cache-Control header) 
apps can now enable public caching by either setting $GLOBALS[egw_info][flags][nocachecontrol] to "public" (default php.ini session.cache_expire) or a numeric value in seconds, or call egw_session::cache_control()
 2013-02-19 15:34:19 +00:00
Ralf Becker
d44e448976 include unsuccessfull session creation and reason in debug logging 2013-02-15 16:15:52 +00:00
Klaus Leithoff
6378d289ca use better defaults for some egw_info server values (num_unsuccessful_id, num_unsuccessful_ip, block_time) 2012-11-29 11:13:58 +00:00
Ralf Becker
234a8a8154 check if we use cookies for the session, but no cookie set: happens eg. in sitemgr (when redirecting to a different domain) or with new java notification app 2012-11-12 09:48:31 +00:00
Ralf Becker
7a981eba15 using pseudo-sessionid for ownCloud remote.php url too, as we otherwise generate lots of new sessions 2012-10-25 12:51:28 +00:00
Ralf Becker
4c5b764347 allow to use HTTP_HOST (without optional port) or SERVER_NAME to find matching instance 2012-10-12 15:11:42 +00:00
Ralf Becker
6fa4cc864e not storing $GLOBALS[egw_info][user] twice in session (was also stored as $GLOBALS[egw]->session->user), also removing not used $GLOBALS[egw_info][user][acl], but re-reading preferences in session::verify() so long running sessions get preferences set by an other session, removing nowhere used creditspoint class from api (calls not public available creditspoint app) 2012-08-07 08:55:41 +00:00
Ralf Becker
fb00481043 * eSync/API: update access-log action for eSync, run maintenance only on logout and other changes to speed up access/update to huge access-logs, thought indexes on session_php, (account_id,ip,li), (account_id,loginid,li) will help alot 2012-06-12 06:37:58 +00:00
Ralf Becker
0c6d80d778 * API/Admin: add user-agent to accesslog and sessions, add sessionid to history to better identify what was causing changes in history 2012-06-01 13:13:06 +00:00
Ralf Becker
a1f6f70330 * Admin: remove session timeout from EGroupware config and read it via ini_get("session.gc_maxlifetime") as config fails for many reasons, if different from php.ini setting 2012-05-29 14:43:33 +00:00
Ralf Becker
d9142cca30 allow to specify a custom filter for egw_session::session_(list|count)() 2012-05-19 18:19:43 +00:00
Ralf Becker
bcb9b2f5c9 fixing the fix: api version is not yet read, therefore use modifiction time of phpgwapi/inc/setup.inc.php instead 2012-04-10 07:53:08 +00:00
Ralf Becker
7e2fd95d9e * CalDAV/CardDAV: add API version to pseudo session-id used to invalidate all sessions from the previous version (which eg. give database errors, because using old schema) 2012-04-07 06:53:38 +00:00
Ralf Becker
9d704a7c0d ignore exception while sending notification to admin (eg. SMTP error), to block the account and give a correct error-message to user 2012-02-16 14:35:42 +00:00
Ralf Becker
f6fe40f2d9 fixed forwarding of authentication (ldap or ads) homedirectory attribute to egw_info and vfs 2011-11-15 19:16:09 +00:00
Ralf Becker
8ab9b0d2f2 allow to use homedirectory attribute from LDAP or ADS authentication for VFS mounts 2011-11-15 12:43:59 +00:00
Klaus Leithoff
45468c801a patch to fix problem with ->not able to see mail<- egw_instant_load.html not found. provided by Vladimir Kolobkov; Thanks a lot 2011-07-25 15:52:22 +00:00
Ralf Becker
a7aef6a4da fixed egroupware.org bug #3002: PHP Warning: mb_strpos() in class.egw_session.inc.php on line 1081 2011-07-03 06:54:32 +00:00
Nathan Gray
f736c89bbf Prevent doubling webserver url when building a link 2011-06-29 16:35:24 +00:00
Ralf Becker
574911d077 * Setup/API: new option to enforce ssl (without specifying a domain in Webserver-URL) 2011-05-31 13:33:26 +00:00
Ralf Becker
ce619a8711 do NOT query sessionid_access_log for anonymous sessions, as they get not loged anyway 2011-05-05 15:50:22 +00:00
Nathan Gray
056f61ef72 Fix typo 2011-04-13 17:09:18 +00:00
Ralf Becker
5495491e78 * Admin: session-list is generated now from egw_access_log table independent of readablity of sessions files in filesystem 
- session_(dla|action) is stored in egw_access_log table
- notifications refresh via ajax set notification_heartbeat timestamp in egw_access_log
- if notification_heartbeat is set (happens only for browser sessions with popup notification) sessions get removed from session list one minute after browser is closed
- new static method egw_session::notifications_active($account_id) to check if given user has an open browser with notifications popup checking, to ensure popup notifications can fall back to email
--> REQUIRES DATABASE UPDATE / SETUP
 2011-04-13 14:11:09 +00:00
Ralf Becker
8df8817318 only try sending cookies, if headers are not send, otherwise it gives just a warning 2010-11-26 20:09:50 +00:00
Ralf Becker
73beff54fe an other fix for NTLM and SiteMgr 2010-09-25 08:19:22 +00:00
Ralf Becker
1caead5ea9 "make sure to not double encode &" 2010-05-09 13:58:57 +00:00
Ralf Becker
930f1052d5 supporting digest auth (see RFC 2617), which is more secure then basic auth on http (no cleartext password), it currently requires cleartext passwords in the database, to calculate the A1 hash! 2010-05-05 09:19:37 +00:00
Klaus Leithoff
f69c071685 fix for: calling setup, sets some config values to default, all the time 2010-04-06 15:30:36 +00:00
Ralf Becker
07d7b66735 some fixes for session of basic auth clients as sogo connector: 
- added user IP to hash used as session id (so changed IP, different devices force a different session)
- returning false in verify, if domain is changed
- fixed "Wrong IP" message
 2010-01-12 03:55:42 +00:00
Ralf Becker
c743665438 "switching logging off again" 2009-12-03 07:56:34 +00:00
Ralf Becker
4e2a8131c3 "partly reverting r28676, as array2string and function_backtrace is not yet loaded" 2009-12-03 07:44:10 +00:00
Klaus Leithoff
493789cec5 extend some debug infos in egw_sessions; add a 4th param to replaceTagsCompletley in translation class; prepare some more htmlpurifier stuff in order to use it for the activation of links; wrap the creation of the htmlpurifier default config in a function, to be used as config object for changes when about to be used with html::purify 2009-12-02 14:56:41 +00:00
Ralf Becker
6ecac6f650 "removed unnecessary check for NOT allowed apps of anon user from session::verify, as there's an other one in egw::verify_session throwing an exception, which can be used to handle the situation better" 2009-10-25 17:28:30 +00:00
Christian Binder
08efec194f fixed not found user sessions while working with notifications and assured that all_no_sort param gets handed over to handler class 2009-10-23 13:07:11 +00:00
Ralf Becker
cdd5103888 fixing a few more PHP5.3 problems, caused by PHP5.3 behavior to NOT 
register cookies in $_REQUEST any more by default (there's now a php.ini
variable 'request_order' to controll that, but we want to work with a
default configuraltion):
- session restore was not working, as only $_REQUEST[sessionid] was checked
- multi domain installs not working, as domain cookie was not checked
- encrypted session were not working, because kp3 cookie was not checked
--> there's now a static method egw_session::get_request($name), which
checks $_REQUEST[$name], $_COOKIE[$name] and for that Safari bug also
$_COOKIE[ucfirst($name)]
 2009-08-22 19:32:28 +00:00
Ralf Becker
d679a00d1d "fix for bug #2112: fix maybe wrong case in username on login 
makes problems eg. in filemanager (name of homedir)"
 2009-07-18 13:14:13 +00:00
Ralf Becker
232252475f patch fixing many depricated functions (eg. posix regular expressions) and features, which fill up the error_log under php5.3 (and will no longer be available under php6). 
Patch is mostly created by script in egroupware/doc/fix_depricated.php in separate commit.
I do NOT advice to apply this patch to a production system (it's commited to trunk!), as the automatic modified regular expressions have a good change to break something ...
 2009-06-08 16:21:14 +00:00
Ralf Becker
f601537b95 fix for php5.3, which by default seems NOT include content of $_COOKIE in 
$_REQUEST (request_order php.ini variable)
 2009-06-07 15:49:12 +00:00
Ralf Becker
1597cdc533 "adding path (EGW_SERVER_ROOT) to hash for basic auth pseudo sesion id 
(otherwise different installs in different pathes using identical credentials would share the session, which is no good idea)"
 2009-04-30 07:36:07 +00:00
Ralf Becker
96f5529abf "log failed login because of hook 'session_creation' with account_id, to not block the account in that case" 2009-04-28 10:39:57 +00:00
Ralf Becker
aca05a32e3 using new check_load_extension function 2009-04-20 12:43:44 +00:00
Ralf Becker
1c11bfcf55 using a session for basic auth (not session aware) clients for WebDAV 
and GroupDAV. The "sessionid" get's constructed from the basic auth
credentials and is not random (as the clients dont store them).
--> speeds up the use of *DAV
--> stops *DAV handlers to created numerious sessions
 2009-04-04 08:38:56 +00:00
Ralf Becker
b976659346 "removed unnecessary ambersand in url creation, if no extravars" 2009-03-30 08:17:28 +00:00
Klaus Leithoff
0ec64072a2 enabling more info FOR THE ERROR_LOG 2008-12-09 14:02:22 +00:00
Ralf Becker
0123dc5d89 "dont log failed login attempts for the anon user, as it is a simple dos to sitemgr" 2008-11-22 08:14:59 +00:00
Ralf Becker
505fe07669 "function to analyse memory usage in the session" 2008-11-13 16:57:16 +00:00
Ralf Becker
a658d7c8ed Store config_user&_passwd of domain as hash, to be able to use them 
inside eGW (without having them in cleartext available)
 2008-11-09 16:15:42 +00:00
Ralf Becker
814eb013f1 Allow HTTP basic auth user to contain a domain to switch instances, as 
it's done in the webgui login (for WebDAV or GroupDAV)
 2008-10-26 12:18:57 +00:00
Ralf Becker
5322acf455 "fixed type causing sitemgr reloads to fail: PHP Fatal error: The script tried to execute a method or access a property of an incomplete object." 2008-10-10 13:11:37 +00:00
Ralf Becker
71063707a4 "found and fixed the real cause, appsession got called after session was commited (and therefore encrypted), these calles get now silently ignored" 2008-10-09 12:24:41 +00:00