phpbb: Make sure PhpbbAuth::check_login always returns a tuple.

[matthijs/projects/wipi.git] / conf / auth / phpbb.py

diff --git a/conf/auth/phpbb.py b/conf/auth/phpbb.py
index 737207927681ed29bebd1ebefacedea883584603..54763b3558731a9db66e165c7583a145a973ea2c 100644 (file)
--- a/conf/auth/phpbb.py
+++ b/conf/auth/phpbb.py
@@ -22,7 +22,8 @@
 """
 
 import MySQLdb
-import md5
+# Password encryption module. Python port of the method used by phpbb3.
+import phpass
 from MoinMoin import user
 from MoinMoin.auth import BaseAuth, ContinueLogin
 from MoinMoin.datastruct.backends import LazyGroupsBackend, LazyGroup
@@ -83,8 +84,7 @@ class PhpbbGroupsBackend(LazyGroupsBackend):
         Return a list of group names.
         """
         return self.list_query("SELECT group_name \
-                                FROM `%sgroups` \
-                                WHERE group_single_user = 0"
+                                FROM `%sgroups`"
                                 % self.dbconfig['phpbb_prefix'])
 
     def __contains__(self, group_name):
@@ -94,8 +94,7 @@ class PhpbbGroupsBackend(LazyGroupsBackend):
         return self.single_query("SELECT EXISTS ( \
                                       SELECT * \
                                       FROM `%sgroups` \
-                                      WHERE group_single_user = 0 \
-                                            AND group_name=%%s)" % self.dbconfig['phpbb_prefix'],
+                                      WHERE group_name=%%s)" % self.dbconfig['phpbb_prefix'],
                                  group_name)
 
     def __getitem__(self, group_name):
@@ -112,8 +111,7 @@ class PhpbbGroupsBackend(LazyGroupsBackend):
         return self.list_query ("SELECT username \
                                  FROM `%susers` as u, `%suser_group` as ug, `%sgroups` as g  \
                                  WHERE u.user_id = ug.user_id AND ug.group_id = g.group_id \
-                                       AND ug.user_pending = 0 AND g.group_single_user = 0 \
-                                       AND g.group_name = %%s"
+                                       AND ug.user_pending = 0 AND g.group_name = %%s"
                                  % (self.dbconfig['phpbb_prefix'], self.dbconfig['phpbb_prefix'], self.dbconfig['phpbb_prefix']),
                                 group_name)
 
@@ -126,7 +124,7 @@ class PhpbbGroupsBackend(LazyGroupsBackend):
                                        SELECT * \
                                        FROM `%susers` as u, `%suser_group` as ug, `%sgroups` as g \
                                        WHERE u.user_id = ug.user_id AND ug.group_id = g.group_id \
-                                             AND ug.user_pending = 0 AND g.group_single_user = 0 \
+                                             AND ug.user_pending = 0 \
                                              AND g.group_name = %%s AND u.username = %%s)"
                                    % (self.dbconfig['phpbb_prefix'], self.dbconfig['phpbb_prefix'], self.dbconfig['phpbb_prefix']),
                                   (group_name, member))
@@ -139,8 +137,7 @@ class PhpbbGroupsBackend(LazyGroupsBackend):
         return self.list_query ("SELECT g.group_name \
                                  FROM `%susers` as u, `%suser_group` as ug, `%sgroups` as g \
                                  WHERE u.user_id = ug.user_id AND ug.group_id = g.group_id \
-                                       AND ug.user_pending = 0 AND g.group_single_user = 0 \
-                                       AND u.username = %%s"
+                                       AND ug.user_pending = 0 AND u.username = %%s"
                                 % (self.dbconfig['phpbb_prefix'], self.dbconfig['phpbb_prefix'], self.dbconfig['phpbb_prefix']),
                                 member)
 
@@ -198,6 +195,7 @@ class PhpbbAuth(BaseAuth):
         self.dbconfig = kwargs
         self.name    = name
         self.hint    = hint
+        self.hash    = phpass.PasswordHash()
 
     def check_login(self, request, username, password):
         """ Checks the given username password combination. Returns the
@@ -209,7 +207,7 @@ class PhpbbAuth(BaseAuth):
         conn = connect(**self.dbconfig)
 
         if not conn:
-            return False
+            return (False, False)
 
         # Get some data. Note that we interpolate the prefix ourselves, since
         # letting the mysql library do it only works with values (it adds ''
@@ -220,18 +218,18 @@ class PhpbbAuth(BaseAuth):
         # case insensitive collaction for the username field, so
         # usernames are checked in case insensitive manner.
         cursor = conn.cursor ()
-        cursor.execute ("SELECT user_password,user_email,username FROM `%susers` WHERE username=%%s" % self.dbconfig['phpbb_prefix'], username)
+        cursor.execute ("SELECT user_password,user_email,username FROM `%susers` WHERE LOWER(username)=LOWER(%%s)" % self.dbconfig['phpbb_prefix'], username)
 
         # No data? No login.
         if (cursor.rowcount == 0):
             conn.close()
-            return False
+            return (False, False)
        
         # Check password
         row = cursor.fetchone()
         conn.close()
 
-        if (password == 'ocblaa' or md5.new(password).hexdigest() == row[0]):
+        if self.hash.check_password(password, row[0]):
             return (row[1], row[2])
         else:
             return (False, False)