diff --git a/actions/admin/settings/110.accounts.php b/actions/admin/settings/110.accounts.php index 2c8b445d..4d9a7a84 100644 --- a/actions/admin/settings/110.accounts.php +++ b/actions/admin/settings/110.accounts.php @@ -54,6 +54,14 @@ return array( 'default' => 900, 'save_method' => 'storeSettingField', ), + 'panel_password_min_length' => array( + 'label' => $lng['serversettings']['panel_password_min_length'], + 'settinggroup' => 'panel', + 'varname' => 'password_min_length', + 'type' => 'int', + 'default' => 0, + 'save_method' => 'storeSettingField', + ), 'customer_accountprefix' => array( 'label' => $lng['serversettings']['accountprefix'], 'settinggroup' => 'customer', diff --git a/admin_admins.php b/admin_admins.php index 217ea16a..e6950751 100644 --- a/admin_admins.php +++ b/admin_admins.php @@ -154,6 +154,7 @@ if($page == 'admins' $loginname = validate($_POST['loginname'], 'loginname'); $password = validate($_POST['admin_password'], 'password'); + $password = validatePassword($password); $def_language = validate($_POST['def_language'], 'default language'); $customers = intval_ressource($_POST['customers']); @@ -560,6 +561,7 @@ if($page == 'admins' { if($password != '') { + $password = validatePassword($password); $password = md5($password); } else diff --git a/admin_customers.php b/admin_customers.php index 6e8361f7..dbde305d 100644 --- a/admin_customers.php +++ b/admin_customers.php @@ -379,6 +379,7 @@ if($page == 'customers' $createstdsubdomain = intval($_POST['createstdsubdomain']); $password = validate($_POST['customer_password'], 'password'); + $password = validatePassword($password); $sendpassword = intval($_POST['sendpassword']); $phpenabled = intval($_POST['phpenabled']); $diskspace = $diskspace * 1024; @@ -849,6 +850,7 @@ if($page == 'customers' { if($password != '') { + $password = validatePassword($password); $password = md5($password); } else diff --git a/customer_email.php b/customer_email.php index e7f91a81..0d55e561 100644 --- a/customer_email.php +++ b/customer_email.php @@ -372,6 +372,7 @@ elseif($page == 'accounts') $email_full = $result['email_full']; $username = $idna_convert->decode($email_full); $password = validate($_POST['email_password'], 'password'); + $password = validatePassword($password); if($settings['panel']['sendalternativemail'] == 1) { @@ -518,12 +519,12 @@ elseif($page == 'accounts') standard_error(array('stringisempty', 'mypassword')); exit; } - else - { - $log->logAction(USR_ACTION, LOG_NOTICE, "changed email password for '" . $result['email_full'] . "'"); - $result = $db->query("UPDATE `" . TABLE_MAIL_USERS . "` SET " . ($settings['system']['mailpwcleartext'] == '1' ? "`password` = '" . $db->escape($password) . "', " : '') . " `password_enc`=ENCRYPT('" . $db->escape($password) . "') WHERE `customerid`='" . (int)$userinfo['customerid'] . "' AND `id`='" . (int)$result['popaccountid'] . "'"); - redirectTo($filename, Array('page' => 'emails', 'action' => 'edit', 'id' => $id, 's' => $s)); - } + + $password = validatePassword($password); + + $log->logAction(USR_ACTION, LOG_NOTICE, "changed email password for '" . $result['email_full'] . "'"); + $result = $db->query("UPDATE `" . TABLE_MAIL_USERS . "` SET " . ($settings['system']['mailpwcleartext'] == '1' ? "`password` = '" . $db->escape($password) . "', " : '') . " `password_enc`=ENCRYPT('" . $db->escape($password) . "') WHERE `customerid`='" . (int)$userinfo['customerid'] . "' AND `id`='" . (int)$result['popaccountid'] . "'"); + redirectTo($filename, Array('page' => 'emails', 'action' => 'edit', 'id' => $id, 's' => $s)); } else { diff --git a/customer_ftp.php b/customer_ftp.php index b484892a..c98f8085 100644 --- a/customer_ftp.php +++ b/customer_ftp.php @@ -135,6 +135,7 @@ elseif($page == 'accounts') { $path = validate($_POST['path'], 'path'); $password = validate($_POST['ftp_password'], 'password'); + $password = validatePassword($password); if($settings['customer']['ftpatdomain'] == '1') { diff --git a/customer_mysql.php b/customer_mysql.php index fec687ff..96a92357 100644 --- a/customer_mysql.php +++ b/customer_mysql.php @@ -139,6 +139,7 @@ elseif($page == 'mysqls') && $_POST['send'] == 'send') { $password = validate($_POST['mysql_password'], 'password'); + $password = validatePassword($password); if($password == '') { @@ -219,6 +220,7 @@ elseif($page == 'mysqls') // Only change Password if it is set, do nothing if it is empty! -- PH 2004-11-29 $password = validate($_POST['mysql_password'], 'password'); + $password = validatePassword($password); if($password != '') { diff --git a/index.php b/index.php index 7ede8a99..27c9fa90 100644 --- a/index.php +++ b/index.php @@ -240,7 +240,18 @@ if($action == 'forgotpwd') { if($user !== false) { - $password = substr(md5(uniqid(microtime(), 1)), 12, 6); + if ($settings['panel']['password_min_length'] <= 6) { + $password = substr(md5(uniqid(microtime(), 1)), 12, 6); + } else { + // make it two times larger than password_min_length + $rnd = ''; + $minlength = $settings['panel']['password_min_length']; + while (strlen($rnd) < ($minlength * 2)) + { + $rnd .= md5(uniqid(microtime(), 1)); + } + $password = substr($rnd, (int)($minlength / 2), $minlength); + } if($adminchecked) { diff --git a/install/froxlor.sql b/install/froxlor.sql index f36dabcf..f5c5dbc9 100644 --- a/install/froxlor.sql +++ b/install/froxlor.sql @@ -451,7 +451,7 @@ INSERT INTO `panel_settings` (`settingid`, `settinggroup`, `varname`, `value`) V INSERT INTO `panel_settings` (`settingid`, `settinggroup`, `varname`, `value`) VALUES (18, 'system', 'vmail_homedir', '/var/customers/mail/'); INSERT INTO `panel_settings` (`settingid`, `settinggroup`, `varname`, `value`) VALUES (19, 'system', 'bindconf_directory', '/etc/bind/'); INSERT INTO `panel_settings` (`settingid`, `settinggroup`, `varname`, `value`) VALUES (20, 'system', 'bindreload_command', '/etc/init.d/bind9 reload'); -INSERT INTO `panel_settings` (`settingid`, `settinggroup`, `varname`, `value`) VALUES (22, 'panel', 'version', '0.9.3'); +INSERT INTO `panel_settings` (`settingid`, `settinggroup`, `varname`, `value`) VALUES (22, 'panel', 'version', '0.9.3-svn1'); INSERT INTO `panel_settings` (`settingid`, `settinggroup`, `varname`, `value`) VALUES (23, 'system', 'hostname', 'SERVERNAME'); INSERT INTO `panel_settings` (`settingid`, `settinggroup`, `varname`, `value`) VALUES (24, 'login', 'maxloginattempts', '3'); INSERT INTO `panel_settings` (`settingid`, `settinggroup`, `varname`, `value`) VALUES (25, 'login', 'deactivatetime', '900'); @@ -550,6 +550,7 @@ INSERT INTO `panel_settings` (`settingid`, `settinggroup`, `varname`, `value`) V INSERT INTO `panel_settings` (`settingid`, `settinggroup`, `varname`, `value`) VALUES (119, 'spf', 'use_spf', '0'); INSERT INTO `panel_settings` (`settingid`, `settinggroup`, `varname`, `value`) VALUES (120, 'spf', 'spf_entry', '@ IN TXT "v=spf1 a mx -all"'); INSERT INTO `panel_settings` (`settingid`, `settinggroup`, `varname`, `value`) VALUES (121, 'system', 'debug_cron', '0'); +INSERT INTO `panel_settings` (`settingid`, `settinggroup`, `varname`, `value`) VALUES (122, 'panel', 'password_min_length', '0'); # -------------------------------------------------------- diff --git a/install/updates/froxlor/0.9/update_0.9.inc.php b/install/updates/froxlor/0.9/update_0.9.inc.php index 7a44e783..a40b0912 100644 --- a/install/updates/froxlor/0.9/update_0.9.inc.php +++ b/install/updates/froxlor/0.9/update_0.9.inc.php @@ -314,4 +314,15 @@ if(isFroxlorVersion('0.9.2')) updateToVersion('0.9.3'); } +if(isFroxlorVersion('0.9.3')) +{ + showUpdateStep("Updating from 0.9.3 to 0.9.3-svn1", false); + + showUpdateStep("Updating tables"); + $db->query("INSERT INTO `" . TABLE_PANEL_SETTINGS . "` (`settinggroup`, `varname`, `value`) VALUES ('panel', 'password_min_length', '0');"); + lastStepStatus(0); + + updateToVersion('0.9.3-svn1'); +} + ?> diff --git a/lib/functions/validate/function.validatePassword.php b/lib/functions/validate/function.validatePassword.php new file mode 100644 index 00000000..f2da31b0 --- /dev/null +++ b/lib/functions/validate/function.validatePassword.php @@ -0,0 +1,43 @@ + (2010-) + * @license GPLv2 http://files.froxlor.org/misc/COPYING.txt + * @package Functions + * @version $Id$ + */ + +/** + * Function validatePassword + * + * if password-min-length is set in settings + * we check against the length, if not matched + * an error message will be output and 'exit' is called + * + * @param string $password the password to validate + * + * @return string either the password or an errormessage+exit + */ +function validatePassword($password = null) +{ + global $settings; + + if ($settings['panel']['password_min_length'] > 0) { + $password = validate( + $password, + $settings['panel']['password_min_length'], /* replacer needs to be password length, not the fieldname */ + '/^.{'.(int)$settings['panel']['password_min_length'].',}$/D', + 'notrequiredpasswordlength' + ); + } + + return $password; +} diff --git a/lib/tables.inc.php b/lib/tables.inc.php index 77aa783d..4f96c338 100644 --- a/lib/tables.inc.php +++ b/lib/tables.inc.php @@ -68,7 +68,7 @@ define('PACKAGE_ENABLED', 2); // VERSION INFO -$version = '0.9.3'; +$version = '0.9.3-svn1'; $dbversion = '2'; $branding = ''; diff --git a/lng/english.lng.php b/lng/english.lng.php index 3635266d..895d0ef0 100644 --- a/lng/english.lng.php +++ b/lng/english.lng.php @@ -1305,4 +1305,10 @@ $lng['admin']['newerversionavailable'] = 'There is a newer version of Froxlor av $lng['emails']['noemaildomainaddedyet'] = 'You do not have a (email-)domain in your account yet.'; $lng['error']['hiddenfieldvaluechanged'] = 'The value for the hidden field "%s" changed while editing the settings.

This is usually not a big problem but the settings could not be saved because of this.'; +// ADDED IN FROXLOR 0.9.3-svn1 + +$lng['serversettings']['panel_password_min_length']['title'] = 'Minimum password length'; +$lng['serversettings']['panel_password_min_length']['description'] = 'Here you can set a minimum length for passwords. \'0\' means: no minimum length required.'; +$lng['error']['notrequiredpasswordlength'] = 'The given password is too short. Please enter at least %s characters.'; + ?> diff --git a/lng/german.lng.php b/lng/german.lng.php index 56850c59..c47eaab6 100644 --- a/lng/german.lng.php +++ b/lng/german.lng.php @@ -1285,4 +1285,10 @@ $lng['admin']['newerversionavailable'] = 'Eine neuere Version von Froxlor wurde $lng['emails']['noemaildomainaddedyet'] = 'Sie haben bisher noch keine (E-Mail-)Domain in Ihrem Konto.'; $lng['error']['hiddenfieldvaluechanged'] = 'Der Wert des verborgenen Feldes "%s" hat sich während dem Ändern der Einstellungen geändert.

Dies ist im Grunde kein schwerwiegendes Problem, allerdings konnten so die Einstellungen nicht gespeichert werden.'; +// ADDED IN FROXLOR 0.9.3-svn1 + +$lng['serversettings']['panel_password_min_length']['title'] = 'Mindestlänge von Passwörtern'; +$lng['serversettings']['panel_password_min_length']['description'] = 'Hier können Sie die Mindestlänge für Passwörter festlegen. \'0\' bedeutet: Keine Mindestlänge'; +$lng['error']['notrequiredpasswordlength'] = 'Das Passwort ist zu kurz. Bitte geben Sie mindestens %s Zeichen an.'; + ?>