Skip to content
This repository was archived by the owner on Nov 19, 2024. It is now read-only.

Commit 98da842

Browse files
FlyingmanaFlyingmana
authored
Merge pull request #86 from willcodeforfood/1.9.4.5
Updated to pristine copy of 1.9.4.5 from magento.com
2 parents 1920a54 + c1938e7 commit 98da842

File tree

88 files changed

+790
-399
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

88 files changed

+790
-399
lines changed

‎RELEASE_NOTES.txt‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,13 @@
1+
==== 1.9.4.5 ====
2+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
3+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
4+
] NOTE: Current Release Notes are maintained at: [
5+
] [
6+
] http://devdocs.magento.com/guides/m1x/ce19-ee114/ce1.9_release-notes.html [
7+
] [
8+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
9+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
10+
111
==== 1.9.4.4 ====
212
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
313
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

‎app/Mage.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -174,7 +174,7 @@ public static function getVersionInfo()
174174
'major' => '1',
175175
'minor' => '9',
176176
'revision' => '4',
177-
'patch' => '4',
177+
'patch' => '5',
178178
'stability' => '',
179179
'number' => '',
180180
);

‎app/code/core/Mage/Admin/Model/Observer.php‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -123,4 +123,34 @@ public function actionPreDispatchAdmin($observer)
123123
public function actionPostDispatchAdmin($event)
124124
{
125125
}
126+
127+
/**
128+
* Validate admin password and upgrade hash version
129+
*
130+
* @param Varien_Event_Observer $observer
131+
*/
132+
public function actionAdminAuthenticate($observer)
133+
{
134+
$password = $observer->getEvent()->getPassword();
135+
$user = $observer->getEvent()->getUser();
136+
$authResult = $observer->getEvent()->getResult();
137+
138+
if (!$authResult) {
139+
return;
140+
}
141+
142+
if (
143+
!(bool) $user->getPasswordUpgraded()
144+
&& !Mage::helper('core')->getEncryptor()->validateHashByVersion(
145+
$password,
146+
$user->getPassword(),
147+
Mage_Core_Model_Encryption::HASH_VERSION_SHA256
148+
)
149+
) {
150+
Mage::getModel('admin/user')->load($user->getId())
151+
->setNewPassword($password)->setForceNewPassword(true)
152+
->save();
153+
$user->setPasswordUpgraded(true);
154+
}
155+
}
126156
}

‎app/code/core/Mage/Admin/Model/Session.php‎

Lines changed: 23 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,13 @@
3535
class Mage_Admin_Model_Session extends Mage_Core_Model_Session_Abstract
3636
{
3737

38+
/**
39+
* Session admin SID config path
40+
*
41+
* @const
42+
*/
43+
const XML_PATH_ALLOW_SID_FOR_ADMIN_AREA = 'web/session/use_admin_sid';
44+
3845
/**
3946
* Whether it is the first page after successfull login
4047
*
@@ -107,7 +114,12 @@ protected function logoutIndirect()
107114
$user = $this->getUser();
108115
if ($user) {
109116
$extraData = $user->getExtra();
110-
if (isset($extraData['indirect_login']) && $this->getIndirectLogin()) {
117+
if (
118+
!is_null(Mage::app()->getRequest()->getParam('SID'))
119+
&& !$this->allowAdminSid()
120+
|| isset($extraData['indirect_login'])
121+
&& $this->getIndirectLogin()
122+
) {
111123
$this->unsetData('user');
112124
$this->setIndirectLogin(false);
113125
}
@@ -299,4 +311,14 @@ protected function _loginFailed($e, $request, $username, $message)
299311
$request->setParam('messageSent', true);
300312
}
301313
}
314+
315+
/**
316+
* Check is allowed to use SID for admin area
317+
*
318+
* @return bool
319+
*/
320+
protected function allowAdminSid()
321+
{
322+
return (bool) Mage::getStoreConfig(self::XML_PATH_ALLOW_SID_FOR_ADMIN_AREA);
323+
}
302324
}

‎app/code/core/Mage/Admin/Model/User.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -470,7 +470,7 @@ public function hasAssigned2Role($user)
470470
*/
471471
protected function _getEncodedPassword($password)
472472
{
473-
return $this->_getHelper('core')->getHashPassword($password, self::HASH_SALT_LENGTH);
473+
return $this->_getHelper('core')->getHash($password, self::HASH_SALT_LENGTH);
474474
}
475475

476476
/**

‎app/code/core/Mage/Admin/etc/config.xml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -79,6 +79,16 @@
7979
<class>Mage_Admin_Block</class>
8080
</admin>
8181
</blocks>
82+
<events>
83+
<admin_user_authenticate_after>
84+
<observers>
85+
<admin_user_login>
86+
<class>Mage_Admin_Model_Observer</class>
87+
<method>actionAdminAuthenticate</method>
88+
</admin_user_login>
89+
</observers>
90+
</admin_user_authenticate_after>
91+
</events>
8292
</global>
8393
<default>
8494
<admin>

‎app/code/core/Mage/Api/Model/User.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -342,7 +342,7 @@ public function hasAssigned2Role($user)
342342
*/
343343
protected function _getEncodedApiKey($apiKey)
344344
{
345-
return $this->_getHelper('core')->getHashPassword($apiKey, Mage_Admin_Model_User::HASH_SALT_LENGTH);
345+
return $this->_getHelper('core')->getHash($apiKey, Mage_Admin_Model_User::HASH_SALT_LENGTH);
346346
}
347347

348348
/**

‎app/code/core/Mage/Api2/Model/Observer.php‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -83,4 +83,26 @@ public function catalogAttributeSaveAfter(Varien_Event_Observer $observer)
8383

8484
return $this;
8585
}
86+
87+
/**
88+
* Upgrade API key hash when api user has logged in
89+
*
90+
* @param Varien_Event_Observer $observer
91+
*/
92+
public function upgradeApiKey($observer)
93+
{
94+
$apiKey = $observer->getEvent()->getApiKey();
95+
$model = $observer->getEvent()->getModel();
96+
if (
97+
!(bool) $model->getApiPasswordUpgraded()
98+
&& !Mage::helper('core')->getEncryptor()->validateHashByVersion(
99+
$apiKey,
100+
$model->getApiKey(),
101+
Mage_Core_Model_Encryption::HASH_VERSION_SHA256
102+
)
103+
) {
104+
Mage::getModel('api/user')->load($model->getId())->setNewApiKey($apiKey)->save();
105+
$model->setApiPasswordUpgraded(true);
106+
}
107+
}
86108
}

‎app/code/core/Mage/Api2/etc/config.xml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -91,6 +91,14 @@
9191
</api2>
9292
</observers>
9393
</admin_user_save_after>
94+
<api_user_authenticated>
95+
<observers>
96+
<api2_upgrade_key>
97+
<class>Mage_Api2_Model_Observer</class>
98+
<method>upgradeApiKey</method>
99+
</api2_upgrade_key>
100+
</observers>
101+
</api_user_authenticated>
94102
</events>
95103
<api2>
96104
<auth_adapters>

‎app/code/core/Mage/Core/Model/Encryption.php‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,7 @@
3434
class Mage_Core_Model_Encryption
3535
{
3636
const HASH_VERSION_MD5 = 0;
37+
const HASH_VERSION_SHA256 = 1;
3738
const HASH_VERSION_SHA512 = 2;
3839

3940
/**
@@ -79,7 +80,9 @@ public function getHash($password, $salt = false)
7980
if (is_integer($salt)) {
8081
$salt = $this->_helper->getRandomString($salt);
8182
}
82-
return $salt === false ? $this->hash($password) : $this->hash($salt . $password) . ':' . $salt;
83+
return $salt === false
84+
? $this->hash($password)
85+
: $this->hash($salt . $password, self::HASH_VERSION_SHA256) . ':' . $salt;
8386
}
8487

8588
/**
@@ -110,6 +113,8 @@ public function hash($data, $version = self::HASH_VERSION_MD5)
110113
{
111114
if (self::HASH_VERSION_LATEST === $version && $version === $this->_helper->getVersionHash($this)) {
112115
return password_hash($data, PASSWORD_DEFAULT);
116+
} elseif (self::HASH_VERSION_SHA256 == $version) {
117+
return hash('sha256', $data);
113118
} elseif (self::HASH_VERSION_SHA512 == $version) {
114119
return hash('sha512', $data);
115120
}
@@ -128,6 +133,7 @@ public function validateHash($password, $hash)
128133
{
129134
return $this->validateHashByVersion($password, $hash, self::HASH_VERSION_LATEST)
130135
|| $this->validateHashByVersion($password, $hash, self::HASH_VERSION_SHA512)
136+
|| $this->validateHashByVersion($password, $hash, self::HASH_VERSION_SHA256)
131137
|| $this->validateHashByVersion($password, $hash, self::HASH_VERSION_MD5);
132138
}
133139

0 commit comments

Comments
 (0)