GNUsocial/gnu-social
4
0
Fork 1
Code Issues Releases Wiki Activity

- Lookup anon profiles by ID (safer because they are guranteed to be unique) and probably faster

Browse Source 
- Obfuscate the anonymous user session token to make it hard to figure out the profile ID
This commit is contained in:
Zach Copley 2010-09-29 15:52:18 -07:00
parent 0fe0f42173
commit f79f44801c
3 changed files with 38 additions and 37 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

44
plugins/AnonymousFave/AnonymousFavePlugin.php
View File

@ -151,7 +151,7 @@ class AnonymousFavePlugin extends Plugin {
if (!common_logged_in()) {
$profile = $this->getAnonProfile();
$profile = AnonymousFavePlugin::getAnonProfile();
if (!empty($profile)) {
if ($profile->hasFave($item->notice)) {
$disfavor = new AnonDisFavorForm($item->out, $item->notice);
@ -207,43 +207,59 @@ class AnonymousFavePlugin extends Plugin {
// Get the anon user's IP, and turn it into a nickname
list($proxy, $ip) = common_client_ip();
// IP + time + random number should avoid collisions
$nickname = 'anonymous-' . $ip . '-' . time() . '-' . common_good_rand(5);
// IP + time + random number should help to avoid collisions
$baseNickname = $ip . '-' . time() . '-' . common_good_rand(5);
$profile = new Profile();
$profile->nickname = $nickname;
$profile->nickname = $baseNickname;
$id = $profile->insert();
if (!empty($id)) {
if (!$id) {
throw new ServerException(_m("Couldn't create anonymous user session"));
}
// Stick the Profile ID into the nickname
$orig = clone($profile);
$profile->nickname = 'anon-' . $id . '-' . $baseNickname;
$result = $profile->update($orig);
if (!$result) {
throw new ServerException(_m("Couldn't create anonymous user session"));
}
common_log(
LOG_INFO,
"AnonymousFavePlugin - created profile for anonymous user from IP: "
. $ip
. ', nickname = '
. $nickname
. $profile->nickname
);
}
return $profile;
}
function getAnonProfile() {
static function getAnonProfile() {
$anon = $_SESSION['anon_nickname'];
$token = $_SESSION['anon_token'];
$anon = base64_decode($token);
$profile = null;
if (!empty($anon)) {
$profile = Profile::staticGet('nickname', $anon);
if (!empty($anon) && substr($anon, 0, 5) == 'anon-') {
$parts = explode('-', $anon);
$id = $parts[1];
// Do Profile lookup by ID instead of nickname for safety/performance
$profile = Profile::staticGet('id', $id);
} else {
$profile = $this->createAnonProfile();
$_SESSION['anon_nickname'] = $profile->nickname;
// Obfuscate so it's hard to figure out the Profile ID
$_SESSION['anon_token'] = base64_encode($profile->nickname);
}
if (!empty($profile)) {
return $profile;
}
}
/**
* Provide plugin version information.

10
plugins/AnonymousFave/anondisfavor.php
View File

@ -54,15 +54,7 @@ class AnonDisfavorAction extends RedirectingAction
{
parent::handle($args);
$anon = $_SESSION['anon_nickname'];
$profile = Profile::staticGet('nickname', $anon);
if (empty($profile)) {
common_debug(
"AnonDisFavorAction - Anon user tried to disfave a notice but doesn't have a profile."
);
}
$profile = AnonymousFavePlugin::getAnonProfile();
if (empty($profile) || $_SERVER['REQUEST_METHOD'] != 'POST') {
$this->clientError(

9
plugins/AnonymousFave/anonfavor.php
View File

@ -54,14 +54,7 @@ class AnonFavorAction extends RedirectingAction
{
parent::handle($args);
$anon = $_SESSION['anon_nickname'];
$profile = Profile::staticGet('nickname', $anon);
if (empty($profile)) {
common_debug(
"AnonFavorAction - Anon user tried to fave a notice but doesn't have a profile."
);
}
$profile = AnonymousFavePlugin::getAnonProfile();
if (empty($profile) || $_SERVER['REQUEST_METHOD'] != 'POST') {
$this->clientError(