From cae9fc70fe05515c42dbdda911a0c640182358e7 Mon Sep 17 00:00:00 2001 From: ljacqu Date: Sat, 13 Feb 2016 10:56:15 +0100 Subject: [PATCH] #518 Create injection-safe website integration and demo form --- samples/website_integration/form.php | 52 ++++++++++++++++ samples/website_integration/integration.php | 67 +++++++++++++++++++++ 2 files changed, 119 insertions(+) create mode 100644 samples/website_integration/form.php create mode 100644 samples/website_integration/integration.php diff --git a/samples/website_integration/form.php b/samples/website_integration/form.php new file mode 100644 index 00000000..120d4287 --- /dev/null +++ b/samples/website_integration/form.php @@ -0,0 +1,52 @@ + + + + + AuthMe Integration Sample + + + +Hello, %s!', htmlspecialchars($user)); + echo 'Successful login. Nice to have you back!' + . '
Back to form'; + $was_successful = true; + } else { + echo '

Error

Invalid username or password.'; + } +} + +if (!$was_successful) { + echo '

Login sample

+This is a demo form for AuthMe website integration. Enter your AuthMe login details +into the following form to test it. +
+ + + +
Name
Pass
+
+
'; +} + +function get_from_post_or_empty($index_name) { + return trim( + filter_input(INPUT_POST, $index_name, FILTER_UNSAFE_RAW, FILTER_REQUIRE_SCALAR | FILTER_FLAG_STRIP_LOW) + ?: ''); +} +?> + + + diff --git a/samples/website_integration/integration.php b/samples/website_integration/integration.php new file mode 100644 index 00000000..56d51d36 --- /dev/null +++ b/samples/website_integration/integration.php @@ -0,0 +1,67 @@ +prepare("SELECT password FROM $authme_table WHERE username = ?"); + $stmt->bind_param('s', $username); + $stmt->execute(); + $stmt->bind_result($password); + if ($stmt->fetch()) { + return $password; + } + } + return null; +} + +/** + * Checks the given clear-text password against the hash. + * + * @param string $password the clear-text password to check + * @param string $hash the hash to check the password against + * @return bool true iff the password matches the hash, false otherwise + */ +function authme_check_hash($password, $hash) { + // $SHA$salt$hash, where hash := sha256(sha256(password) . salt) + $parts = explode('$', $hash); + return count($parts) === 4 + && $parts[3] === hash('sha256', hash('sha256', $password) . $parts[2]); +}