Init with KH 3.1.3.1

includes/kohana/modules/auth/README.md

@@ -0,0 +1,13 @@
+New Age Auth
+---
+
+I've forked the main Auth module because there were some fundamental flaws with it:
+
+ 1. It's trivial to [bruteforce](http://dev.kohanaframework.org/issues/3163) publicly hidden salt hashes.
+    - I've fixed this by switching the password hashing algorithm to the more secure secret-key based hash_hmac method.
+ 2. ORM drivers were included.
+    - I've fixed this by simply removing them. They cause confusion with new users because they think that Auth requires ORM. The only driver currently provided by default is the file driver.
+ 3. Auth::get_user()'s api is inconsistent because it returns different data types.
+    - I've fixed this by returning an empty user model by default. You can override what gets returned (if you've changed your user model class name for instance) by overloading the get_user() method in your application.
+
+These changes should be merged into the mainline branch eventually, but they completely break the API, so likely won't be done until 3.1.

includes/kohana/modules/auth/classes/auth.php

@@ -0,0 +1,3 @@
+<?php defined('SYSPATH') or die('No direct access allowed.');
+
+abstract class Auth extends Kohana_Auth { }

includes/kohana/modules/auth/classes/auth/file.php

@@ -0,0 +1,3 @@
+<?php defined('SYSPATH') or die('No direct access allowed.');
+
+class Auth_File extends Kohana_Auth_File { }

includes/kohana/modules/auth/classes/kohana/auth.php

@@ -0,0 +1,175 @@
+<?php defined('SYSPATH') or die('No direct access allowed.');
+/**
+ * User authorization library. Handles user login and logout, as well as secure
+ * password hashing.
+ *
+ * @package    Kohana/Auth
+ * @author     Kohana Team
+ * @copyright  (c) 2007-2010 Kohana Team
+ * @license    http://kohanaframework.org/license
+ */
+abstract class Kohana_Auth {
+
+	// Auth instances
+	protected static $_instance;
+
+	/**
+	 * Singleton pattern
+	 *
+	 * @return Auth
+	 */
+	public static function instance()
+	{
+		if ( ! isset(Auth::$_instance))
+		{
+			// Load the configuration for this type
+			$config = Kohana::config('auth');
+
+			if ( ! $type = $config->get('driver'))
+			{
+				$type = 'file';
+			}
+
+			// Set the session class name
+			$class = 'Auth_'.ucfirst($type);
+
+			// Create a new session instance
+			Auth::$_instance = new $class($config);
+		}
+
+		return Auth::$_instance;
+	}
+
+	protected $_session;
+
+	protected $_config;
+
+	/**
+	 * Loads Session and configuration options.
+	 *
+	 * @return  void
+	 */
+	public function __construct($config = array())
+	{
+		// Save the config in the object
+		$this->_config = $config;
+
+		$this->_session = Session::instance();
+	}
+
+	abstract protected function _login($username, $password, $remember);
+
+	abstract public function password($username);
+
+	abstract public function check_password($password);
+
+	/**
+	 * Gets the currently logged in user from the session.
+	 * Returns NULL if no user is currently logged in.
+	 *
+	 * @return  mixed
+	 */
+	public function get_user($default = NULL)
+	{
+		return $this->_session->get($this->_config['session_key'], $default);
+	}
+
+	/**
+	 * Attempt to log in a user by using an ORM object and plain-text password.
+	 *
+	 * @param   string   username to log in
+	 * @param   string   password to check against
+	 * @param   boolean  enable autologin
+	 * @return  boolean
+	 */
+	public function login($username, $password, $remember = FALSE)
+	{
+		if (empty($password))
+			return FALSE;
+
+		if (is_string($password))
+		{
+			// Create a hashed password
+			$password = $this->hash($password);
+		}
+
+		return $this->_login($username, $password, $remember);
+	}
+
+	/**
+	 * Log out a user by removing the related session variables.
+	 *
+	 * @param   boolean  completely destroy the session
+	 * @param   boolean  remove all tokens for user
+	 * @return  boolean
+	 */
+	public function logout($destroy = FALSE, $logout_all = FALSE)
+	{
+		if ($destroy === TRUE)
+		{
+			// Destroy the session completely
+			$this->_session->destroy();
+		}
+		else
+		{
+			// Remove the user from the session
+			$this->_session->delete($this->_config['session_key']);
+
+			// Regenerate session_id
+			$this->_session->regenerate();
+		}
+
+		// Double check
+		return ! $this->logged_in();
+	}
+
+	/**
+	 * Check if there is an active session. Optionally allows checking for a
+	 * specific role.
+	 *
+	 * @param   string   role name
+	 * @return  mixed
+	 */
+	public function logged_in($role = NULL)
+	{
+		return ($this->get_user() !== NULL);
+	}
+
+	/**
+	 * Creates a hashed hmac password from a plaintext password. This
+	 * method is deprecated, [Auth::hash] should be used instead.
+	 *
+	 * @deprecated
+	 * @param   string  plaintext password
+	 */
+	public function hash_password($password)
+	{
+		return $this->hash($password);
+	}
+
+	/**
+	 * Perform a hmac hash, using the configured method.
+	 *
+	 * @param   string  string to hash
+	 * @return  string
+	 */
+	public function hash($str)
+	{
+		if ( ! $this->_config['hash_key'])
+			throw new Kohana_Exception('A valid hash key must be set in your auth config.');
+
+		return hash_hmac($this->_config['hash_method'], $str, $this->_config['hash_key']);
+	}
+
+	protected function complete_login($user)
+	{
+		// Regenerate session_id
+		$this->_session->regenerate();
+
+		// Store username in session
+		$this->_session->set($this->_config['session_key'], $user);
+
+		return TRUE;
+	}
+
+} // End Auth

includes/kohana/modules/auth/classes/kohana/auth/file.php

@@ -0,0 +1,88 @@
+<?php defined('SYSPATH') or die('No direct access allowed.');
+/**
+ * File Auth driver.
+ * [!!] this Auth driver does not support roles nor autologin.
+ *
+ * @package    Kohana/Auth
+ * @author     Kohana Team
+ * @copyright  (c) 2007-2010 Kohana Team
+ * @license    http://kohanaframework.org/license
+ */
+class Kohana_Auth_File extends Auth {
+
+	// User list
+	protected $_users;
+
+	/**
+	 * Constructor loads the user list into the class.
+	 */
+	public function __construct($config = array())
+	{
+		parent::__construct($config);
+
+		// Load user list
+		$this->_users = Arr::get($config, 'users', array());
+	}
+
+	/**
+	 * Logs a user in.
+	 *
+	 * @param   string   username
+	 * @param   string   password
+	 * @param   boolean  enable autologin (not supported)
+	 * @return  boolean
+	 */
+	protected function _login($username, $password, $remember)
+	{
+		if (isset($this->_users[$username]) AND $this->_users[$username] === $password)
+		{
+			// Complete the login
+			return $this->complete_login($username);
+		}
+
+		// Login failed
+		return FALSE;
+	}
+
+	/**
+	 * Forces a user to be logged in, without specifying a password.
+	 *
+	 * @param   mixed    username
+	 * @return  boolean
+	 */
+	public function force_login($username)
+	{
+		// Complete the login
+		return $this->complete_login($username);
+	}
+
+	/**
+	 * Get the stored password for a username.
+	 *
+	 * @param   mixed   username
+	 * @return  string
+	 */
+	public function password($username)
+	{
+		return Arr::get($this->_users, $username, FALSE);
+	}
+
+	/**
+	 * Compare password with original (plain text). Works for current (logged in) user
+	 *
+	 * @param   string  $password
+	 * @return  boolean
+	 */
+	public function check_password($password)
+	{
+		$username = $this->get_user();
+
+		if ($username === FALSE)
+		{
+			return FALSE;
+		}
+
+		return ($password === $this->password($username));
+	}
+
+} // End Auth File

includes/kohana/modules/auth/config/auth.php

@@ -0,0 +1,16 @@
+<?php defined('SYSPATH') or die('No direct access allowed.');
+
+return array(
+
+	'driver'       => 'file',
+	'hash_method'  => 'sha256',
+	'hash_key'     => NULL,
+	'lifetime'     => 1209600,
+	'session_key'  => 'auth_user',
+
+	// Username/password combinations for the Auth File driver
+	'users' => array(
+		// 'admin' => 'b3154acf3a344170077d11bdb5fff31532f679a1919e716a02',
+	),
+
+);

includes/kohana/modules/auth/guide/auth/menu.md

@@ -0,0 +1,7 @@
+## [Auth]()
+- [Config](config)
+- [User Model](user)
+- [Register Users](register)
+- [Log in and out](login)
+- [Edit User](edit)
+- [Using Roles](roles)