Log in with username/password: lyceum/lyceum

Changeset 1231

Show
Ignore:
Timestamp:
10/21/07 02:15:23 (2 years ago)
Author:
jjb
Message:

Tracking and logging token failures. #729

Files:

Legend:

Unmodified
Added
Removed
Modified
Copied
Moved
  • branches/1.0/src/config/wp-config-sample.php

    r1177 r1231  
    3737define('ERRORLOG', LOGDIR . 'lyceum_error_log'); 
    3838define('QUERYLOG', LOGDIR . 'lyceum_query_log'); 
     39define('TOKENLOG', LOGDIR . 'lyceum_token_log'); 
    3940 
    4041// Change this to localize WordPress.  A corresponding MO file for the 
  • branches/1.0/src/lib/functions.php

    r1185 r1231  
    1212      } 
    1313   } 
     14} 
     15 
     16function token_log($event, $information){ 
     17      $time = date('i:s'); 
     18      $message = "\n".$time." - [$event]: $information"; 
     19      error_log($message, 3, TOKENLOG); 
    1420} 
    1521 
     
    196202   $key = sha1($targetscript.$action.$id.$userdata->ID); 
    197203//trace('checking token: $token, $targetscript, $action, $id, user, $key', "$token, $targetscript, $action, $id, $userdata->ID, $key"); 
    198    if (!array_key_exists($token, $_SESSION['formtokens'][$key])) 
     204   if (!array_key_exists($token, $_SESSION['formtokens'][$key])){ 
     205      token_log('Token does not exist',  
     206         "Key: " . $key . "\n" . 
     207         "Token: " . $token . "\n" 
     208      ); 
    199209      return false; 
    200  
    201    $token_age = time() - $_SESSION['formtokens'][$key][$token]; 
    202  
    203    if ($token_age >= 86400)//86400 seconds = 24 hours 
     210   } 
     211   $current_time = time(); 
     212   $token_age = $current_time - $_SESSION['formtokens'][$key][$token]; 
     213 
     214   if ($token_age >= 86400){//86400 seconds = 24 hours 
     215      token_log('Token age failure', 
     216         "Key: " . $key . "\n" . 
     217         "Token: " . $token . "\n" . 
     218         "Current time: " . $current_time . "\n" . 
     219         "Token age: " . $token_age . "\n" 
     220      ); 
    204221      return false; 
     222   } 
    205223 
    206224   if (!$keep) 
Log in with username/password: lyceum/lyceum