Project

General

Profile

Download (2.18 KB)

Bug #16314 » 16312_16314.patch

Jim Pingle, 11/11/2025 06:10 PM

View differences:

src/etc/inc/auth.inc
return $authenticated;
}
/*
* Function to remove problematic characters from a username before using it in
* logs or other sensitive contexts.
*
* These usernames are not valid, so there is little use in printing them as-is.
*/
function cleanup_invalid_username($username) {
$clean_username = "";
/* Trim to 32 chars, add string indicate text was removed */
if (strlen($username) > 32) {
$username = substr($username, 0, 32);
$username .= "__truncated__";
}
/* Replace any non-word characters */
for ($i=0; $i < strlen($username); $i++) {
if (preg_match('/\w/', $username[$i])) {
$clean_username .= $username[$i];
} else {
$clean_username .= "_";
}
}
return $clean_username;
}
function session_auth() {
global $_SESSION, $page;
......
} else {
/* give the user an error message */
$_SESSION['Login_Error'] = gettext("Username or Password incorrect");
log_auth(sprintf(gettext("webConfigurator authentication error for user '%1\$s' from: %2\$s"), $_POST['usernamefld'], get_user_remote_address(false)));
log_auth(sprintf("webConfigurator authentication error for user '%1\$s' from: %2\$s",
cleanup_invalid_username($_POST['usernamefld']),
get_user_remote_address(false)));
if (isAjax()) {
echo "showajaxmessage('{$_SESSION['Login_Error']}');";
return;
src/usr/local/www/xmlrpc.php
}
if (!$login_ok) {
log_auth(sprintf(gettext("webConfigurator authentication error for user '%1\$s' from: %2\$s"),
$username,
log_auth(sprintf("webConfigurator authentication error for user '%1\$s' from: %2\$s",
cleanup_invalid_username($username),
$this->remote_addr));
require_once("XML/RPC2/Exception.php");
(2-2/2)