Merge commit from fork

[2.1] Multiple Bugs

Author: jdarwood007

Sources/Reminder.php

@@ -145,7 +145,7 @@ function RemindPick()
 		sendmail($row['email_address'], $emaildata['subject'], $emaildata['body'], null, 'reminder', $emaildata['is_html'], 1);
 
 		// Set the password in the database.
-		updateMemberData($row['id_member'], array('validation_code' => substr(md5($password), 0, 10)));
+		updateMemberData($row['id_member'], array('validation_code' => substr(md5($password), 0, 10)) . '|' . time());
 
 		// Set up the template.
 		$context['sub_template'] = 'sent';
@@ -236,7 +236,9 @@ function setPassword2()
 	if ($smcFunc['db_num_rows']($request) == 0)
 		fatal_lang_error('invalid_userid', false);
 
-	list ($realCode, $username, $email, $flood_value) = $smcFunc['db_fetch_row']($request);
+	list ($code, $username, $email, $flood_value) = $smcFunc['db_fetch_row']($request);
+	list ($realCode, $issuedTime) = explode('|', $realCode);
+	$issuedTime = empty($issuedTime) ? 0 : (int) $issuedTime;
 	$smcFunc['db_free_result']($request);
 
 	// Is the password actually valid?
@@ -253,7 +255,7 @@ function setPassword2()
 	require_once($sourcedir . '/LogInOut.php');
 
 	// Quit if this code is not right.
-	if (empty($_POST['code']) || substr($realCode, 0, 10) !== substr(md5($_POST['code']), 0, 10))
+	if (empty($_POST['code']) || substr($realCode, 0, 10) !== substr(md5($_POST['code']), 0, 10) || $issuedTime + 3600 < time())
 	{
 		// Stop brute force attacks like this.
 		validatePasswordFlood($_POST['u'], $flood_value, false);

Sources/Subs-Auth.php

@@ -128,8 +128,7 @@ function setLoginCookie($cookie_length, $id, $password = '')
 
 		// Recreate and restore the new session.
 		loadSession();
-		// @todo should we use session_regenerate_id(true); now that we are 5.1+
-		session_regenerate_id();
+		session_regenerate_id(true);
 		$_SESSION = $oldSessionData;
 
 		$_SESSION['login_' . $cookiename] = $data;

Sources/Subs-Package.php

@@ -171,7 +171,17 @@ function read_tgz_data($data, $destination, $single_file = false, $overwrite = f
 		elseif ($destination !== null && !$single_file)
 		{
 			// Protect from accidental parent directory writing...
-			$current['filename'] = strtr($current['filename'], array('../' => '', '/..' => ''));
+			do {
+				$prev = $current['filename'];
+				$current['filename'] = strtr($current['filename'], array(
+					'../' => '',
+					'/..' => '',
+					'..' . DIRECTORY_SEPARATOR => '',
+					DIRECTORY_SEPARATOR . '..' => '',
+					'..\\' => '',
+					'\\..' => '',
+				));
+			} while ($prev !== $current['filename']);
 
 			if (!file_exists($destination . '/' . $current['filename']))
 				mktree($destination . '/' . $current['filename'], 0777);

proxy.php

@@ -117,7 +117,7 @@ public function checkRequest()
 	{
 		global $boardurl;
 
-		if (!$this->enabled)
+		if (!$this->enabled || $this->secret === 'smfisawesome')
 			return false;
 
 		// Try to create the image cache directory if it doesn't exist
@@ -144,7 +144,7 @@ public function checkRequest()
 			return false;
 		}
 
-		if (hash_hmac('sha1', $request, $this->secret) != $hash)
+		if (!hash_equals(hash_hmac('sha1', $request, $this->secret), $hash))
 			return false;
 
 		// Ensure any non-ASCII characters in the URL are encoded correctly