Changeset 542

Timestamp:

09/13/06 12:37:54 (2 years ago)

Author:

ben

Message:

A far more secure initialisation method for the news account - users specify an initial password in config.php and are instructed to change it upon first login. Additionally, every time a user logs in with the password 'password', they get a telling off.

Files:

• devel/config-dist.php (modified) (1 diff)
• devel/lib/dbsetup.php (modified) (2 diffs)
• devel/sanitychecks.php (modified) (1 diff)

devel/config-dist.php

@@ -28 +28 @@
-    $CFG->sysadminemail = '';
-
+// Account 1, with username news, is initially administrator. This
+// will be its initial password - UPON INSTALLATION, YOU SHOULD LOG
+// IN AS NEWS AND CHANGE THE PASSWORD IMMEDIATELY.
+
+    $CFG->newsinitialpassword = '';
+    
-// Country code to set language to if you have gettext installed
-// To include new languages, save their compiled .mo gettext

devel/lib/dbsetup.php

@@ -20 +20 @@
-$strdatabasesuccess = "Yay!"; // well, if people leave never-defined variables about the place...
-
+$newinstall = false;
+
-if (!$maintables) {
-    if (file_exists($CFG->dirroot . "lib/db/$CFG->dbtype.sql")) {
@@ -28 +30 @@
-            $db->debug = false;
-            notify($strdatabasesuccess, "green");
+            if (!isset($CFG->newsinitialpassword) || empty($CFG->newsinitialpassword)) {
+                notify("WARNING: the initial password for the news account is 'password'. This account has administrator privileges, and you should log in and change the password as soon as installation is complete.");
+            } else {
+                $newspassword = $db->qstr(md5($CFG->newsinitialpassword));
+                execute_sql("update ".$CFG->prefix."users set password = $newspassword where username = 'news'");
+            }
+            execute_sql("update ".$CFG->prefix."users set email = ". $db->qstr($CFG->sysadminemail) ." where username = 'news'");
-        } else {
-            $db->debug = false;

devel/sanitychecks.php

@@ -29 +29 @@
-        $diemessages[] = 'Configuration problem: The <code>$CFG->dataroot</code> setting in config.php must end with a forward slash (/).';
-    }
-    
-    
-    if (ini_get('register_globals')) {