Fix #1679

Signed-off-by: Yoshi2889 <rick.2889@gmail.com>
Merge pull request #1692 from Yoshi2889/1679

Fix #1679
Merge pull request #1693 from Yoshi2889/1393

Fix #1393; now hides $sourcedir at all times from debug info
HTML5 - Rich snippets - Breadcrumbs
- thanks @VBGAMER45 for pointing :)
Signed-off-by: Antes <antes@simplemachines.org>
Merge pull request #1694 from Antes/micro

HTML5 - Rich snippets - Breadcrumbs
Update Load.php

Attempt to prevent a bunch of Undefined Index errors for both 'seed' and 'browser_cache' (ip = ::1) generated in the error log using an obsolete web browser (i.e. Safari 4.1.3).  Isset can get undefined errors when an array key is not defined.  Using array_key_exists solves the undefined key problem.  The proposed changes assume that the keys can not be better defined elsewhere?

Signed-off-by: butchs <J.Miller@POBox.com>
Merge pull request #1696 from butchs/patch-9

Update Load.php
Convert create_function calls to true anonymous functions

With the recent bump in minimum PHP requirement as PHP 5.3, we can use closures and true anonymous functions, which are better, more readable and less memory intensive.

Signed-off-by: Shitiz Garg <mail@dragooon.net>
Convert a few more create_function to anonymous functions

Signed-off-by: Shitiz Garg <mail@dragooon.net>
Add back compatibility to functions in case mb_string is disabled

Signed-off-by: Shitiz Garg <mail@dragooon.net>
More code cleanup, shift globals to use keyword instead

Signed-off-by: Shitiz Garg <mail@dragooon.net>
More cleanup for closures

Signed-off-by: Shitiz Garg <mail@dragooon.net>
Fix initial $smcFunc's text function declarations

Signed-off-by: Shitiz Garg <mail@dragooon.net>
Merge pull request #1698 from Dragooon/convert-closures-duos

Convert create_functions to true anonymous functions/closures
Update hashing algorithm for passwords to SHA256

Previously hashes were computed as sha1(lower(username) . password), update this to add a layer of sha256 so that it becomes sha256(sha1(lower(username) . password) based on ideas by @jdarwood007.

The cookie password hash becomes sha256(password_hash . salt) instead of sha1(password_hash . salt), but the login hash remains same as before. This provides additional protection as someone with the hash from the database can't login directly simply by submitting that into the login form, they'd still need the original password to be able to login

Signed-off-by: Shitiz Garg <mail@dragooon.net>
Use bcrypt for passwords and SHA-512 for cookies

Shift from sha256(sha1(lower(username) . password)) to password_hash(sha1(lower(username) . password), PASSWORD_BCRYPT) which is a PHP 5.5 implementation of a costly bcrypt based algorithm (added a back porting library as well which makes it compatible till minimum of PHP 5.3.7). This is much slower and more secure than a simple one pass sha256.

Also, the cookies are shifted from sha256(password . salt) to sha512(password . salt) to give them that extra spice of security.

Signed-off-by: Shitiz Garg <mail@dragooon.net>
Move to simply bcrypt instead of bcrypt + sha1

bcrypting a sha1 hash is less secure than simply using bcrypt on a password. This also means that client side hashing is gone, as we cannot send hashed passwords and then use simple bcrypt. Ideally, client side hashing should be replaced by SSL which'd be more secure against SSL.

Signed-off-by: Shitiz Garg <mail@dragooon.net>
Fix profile password verification

Signed-off-by: Shitiz Garg <mail@dragooon.net>
Use UTF-8 safe strtolower for lowercasing usernames on login

Should potentially fix #1538

Signed-off-by: Shitiz Garg <mail@dragooon.net>
Minor code cleanup

We don't need hash_verify and hash_simple functions anymore

Signed-off-by: Shitiz Garg <mail@dragooon.net>