diff --git a/README.md b/README.md index 40af619..a6829a5 100644 --- a/README.md +++ b/README.md @@ -9,13 +9,13 @@ can be found here: https://www.ohnekontur.de/category/technik/sync/fsyncms/ -Although the original author has planned further extesnions to this implementation, -the current state of this server implementation is rather stagnant ans missing two +Although the original author has planned further extensions to this implementation, +the current state of this server implementation is rather stagnant and missing two important features: * Delete account from the web * Reset password from the web (similar to reset inside the client) -Current state is the state as-used by the Pale Moon Sync service, which is v0.13 with some minor updates. +Current state is the state as-used by the Pale Moon Sync service, which is v0.13b with some minor updates. If you wish to help complete the missing features, please feel free to clone this repository and make the necessary edits -- kindly submit a pull request after you've tested your changes so it can be merged @@ -23,6 +23,14 @@ back in and improve this software! Release notes for older original versions: +FSyncMS v013b +====== +Password Change Bug-fix + +There has been a bug in FSyncMS v 0.13: if you tried to update your password via Firefox, the wrong hash +was written in the Database. As a result the account was no longer usable, but no data should be lost. +This update fixes the Bug. + FSyncMS v013 ====== Database upgrade diff --git a/index.php b/index.php index e59d393..f424049 100644 --- a/index.php +++ b/index.php @@ -23,6 +23,7 @@ # Contributor(s): # Toby Elliott (telliott@mozilla.com) # Luca Tettamanti +# Christian Wittmer # # Alternatively, the contents of this file may be used under the terms of # either the GNU General Public License Version 2 or later (the "GPL"), or @@ -88,7 +89,7 @@ log_error("start request_____" . $path); // ensure that we got a valid request if ( !$path ) - report_problem("Invalid request, this was not a firefox sync request!", 400); + report_problem("Invalid request!", 400); // split path into parts and make sure that all values are properly initialized list($version, $username, $function, $collection, $id) = array_pad(explode('/', $path.'///'), 5, ''); diff --git a/setup.php b/setup.php index 27916d1..01868c3 100644 --- a/setup.php +++ b/setup.php @@ -23,6 +23,7 @@ # Contributor(s): # Daniel Triendl # balu +# Christian Wittmer # # Alternatively, the contents of this file may be used under the terms of # either the GNU General Public License Version 2 or later (the "GPL"), or @@ -156,6 +157,15 @@ function write_config_file($dbt, $dbh, $dbn, $dbu, $dbp, $fsRoot) { $cfg_content .= " define(\"BCRYPT\", true);\n"; $cfg_content .= " define(\"BCRYPT_ROUNDS\", 12);\n"; + $cfg_content .= "\n"; + $cfg_content .= " // you can enable logging to syslog for MINQUOTA_ERROR_OVER_QUOTA\n"; + $cfg_content .= " // if (quota_used > MINQUOTA && quota_used < MAXQUOTA)\n"; + $cfg_content .= " define(\"MINQUOTA_LOG_ERROR_OVER_QUOTA_ENABLE\", false);\n"; + $cfg_content .= "\n"; + $cfg_content .= " // set MinQuota and MaxQuota\n"; + $cfg_content .= " define(\"MINQUOTA\", 30000);\n"; + $cfg_content .= " define(\"MAXQUOTA\", 35000);\n"; + $cfg_content .= "\n?>\n"; // now write everything diff --git a/weave_utils.php b/weave_utils.php index ae3371a..3868b84 100644 --- a/weave_utils.php +++ b/weave_utils.php @@ -21,6 +21,7 @@ # Contributor(s): # Daniel Triendl # Mark Straver +# Christian Wittmer # # Alternatively, the contents of this file may be used under the terms of # either the GNU General Public License Version 2 or later (the "GPL"), or @@ -257,20 +258,29 @@ function check_quota(&$db) { - // Checks the quota and if over limit, returns "over quota" to the user. - $auth_user = array_key_exists('PHP_AUTH_USER', $_SERVER) ? $_SERVER['PHP_AUTH_USER'] : null; - try { + // Checks the quota and if over limit, returns "over quota" to the user. + $auth_user = array_key_exists('PHP_AUTH_USER', $_SERVER) ? $_SERVER['PHP_AUTH_USER'] : null; + try { $quota_used = $db->get_storage_total(); // log_quota("Debug quota: ".$auth_user." @ ".$quota_used." KB."); } catch (Exception $e) { log_error($e->getMessage(), $e->getCode()); } - - if ($quota_used > 35000) { - log_quota("[!!] Over quota: ".$auth_user." @ ".$quota_used." KB."); - // HTTP 400 with body error code 14 means over quota. - report_problem(WEAVE_ERROR_OVER_QUOTA, 400); - } + + if ((defined("MINQUOTA") && MINQUOTA) && (defined("MAXQUOTA") && MAXQUOTA)) { + if ($quota_used > MINQUOTA && $quota_used < MAXQUOTA) { + report_problem(WEAVE_ERROR_OVER_QUOTA, 400); + log_quota("[!!] Over quota [MINQUOTA:MAXQUOTA]: ".$auth_user." @ ".$quota_used." KB."); + if (defined(MINQUOTA_LOG_ERROR_OVER_QUOTA_ENABLE) && MINQUOTA_LOG_ERROR_OVER_QUOTA_ENABLE) { + log_error(" MinQUOTA exceeding: ".$quota_used." KB."); + } + } + if ($quota_used > MAXQUOTA) { + log_quota("[!!] Over quota: ".$auth_user." @ ".$quota_used." KB."); + // HTTP 400 with body error code 14 means over quota. + report_problem(WEAVE_ERROR_OVER_QUOTA, 400); + } + } } function check_timestamp($collection, &$db)