diff --git a/CHANGELOG.md b/CHANGELOG.md
index d30eeb4..3d36aa4 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,4 +1,4 @@
-# 2021-xx-xx: FlatPress 1.2.1
+# 2021-06-19: [FlatPress 1.2.1](https://github.com/flatpressblog/flatpress/releases/tag/1.2.1)
## Bugfixes
- BOM in French language files lead to blank page in admin area (see [#82](https://github.com/flatpressblog/flatpress/issues/82))
## Translations
diff --git a/CONTRIBUTORS.md b/CONTRIBUTORS.md
index 451fc68..c149894 100644
--- a/CONTRIBUTORS.md
+++ b/CONTRIBUTORS.md
@@ -6,7 +6,7 @@ If you think someone's missing here, please let us know.
## The team
FlatPress was initially developed by [Edoardo Vacchi (NoWhereMan)](https://github.com/evacchi "github.com/evacchi"). Edoardo was supported by [Hydra](http://hydra.clans.it/ "hydra.clans.it"), [drudo](https://drudotec.wordpress.com/ "drudotec.wordpress.com"), giulio, [alcor](http://alcor.altervista.org/ "alcor.altervista.org"), and [Tychondriax](http://tychondriax.altervista.org/blog/ "tychondriax.altervista.org").
-Since 2018, FlatPress is taken care of by [Arvid Zimmermann](https://arvidzimmermann.de "arvidzimmermann.de").
+Since 2018, FlatPress is taken care of by [Arvid Zimmermann](https://github.com/azett "github.com/azett").
## Coding
- Piero VDFN introduced the plugins Comment Center, jQuery, and LightBox2.
diff --git a/README.md b/README.md
index 533e507..06a076d 100644
--- a/README.md
+++ b/README.md
@@ -1,15 +1,41 @@
-
-[[flatpress.org](https://www.flatpress.org/)] [[Support forum](https://forum.flatpress.org/)] [[Wiki](https://wiki.flatpress.org/)] [[GitHub](https://github.com/flatpressblog/flatpress)] [Mastodon] [[Twitter](https://www.twitter.com/FlatPress)] [[Changelog](./CHANGELOG.md)] [[Contributors](./CONTRIBUTORS.md)]
+[](https://www.flatpress.org "Home page")
+[](https://forum.flatpress.org "Support forum")
+[](https://wiki.flatpress.org "Wiki")
+[](https://fosstodon.org/@flatpress "FlatPress@Mastodon")
+[](https://twitter.com/FlatPress "FlatPress@Twitter")
+[](./CHANGELOG.md "Change log")
+[](./SECURITY.md "Security policy")
+[](./CONTRIBUTORS.md "Contributors")
+
+[](https://github.com/flatpressblog/flatpress/releases "See all releases")
+[](./LICENSE.md "License")
+[](https://github.com/flatpressblog/flatpress/issues "See open issues")
+[](https://github.com/flatpressblog/flatpress/commits/ "Last commit")
# Welcome to FlatPress!
FlatPress is a lightweight, easy-to-set-up blogging engine. Plain and simple, just PHP. No database needed!
+## Features
+- Independent, standard-compliant blog software
+- Works on files, __no database__
+- Easy to setup, easy to backup
+- Powerful __plugin system__ with widget support
+- Easy to customize with __themes__, powered by [Smarty](http://www.smarty.net/)
+- __Comments__ function with spam protection
+- __Free software__ under [GNU GPLv2](LICENSE.md)
+
+
## Getting started
Installing and running FlatPress is really easy:
- [Download FlatPress](https://www.flatpress.org/download), unzip, upload
- Browse to your web server, run simple FlatPress installer
- Enjoy blogging with FlatPress!
+## Help and support
+Visit our [wiki](https://wiki.flatpress.org) to learn everything about blogging with FlatPress, how to work with themes and plugins and where to find them. The wiki also has the [general FAQ](https://wiki.flatpress.org/doc:faq) and the [tech FAQ](https://wiki.flatpress.org/doc:techfaq).
+
+Ask your questions, show off your FlatPress blog and meet fellow FlatPressers at the [support forum](https://forum.flatpress.org).
+
## Requirements
FlatPress runs on any web server (e.g. Apache or IIS) with PHP 5.6 or higher. Since all data is stored in files, no database is needed.
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..6430db5
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,5 @@
+# Security Policy
+Thank you for your efforts on the security of the FlatPress software. Feel free to report any vulnerability you stumble upon!
+
+## Reporting a vulnerability
+Please report security issues to `hello@flatpress.org`, it's as simple as that. Thanks!
diff --git a/defaults.php b/defaults.php
index 290918d..e6e066b 100755
--- a/defaults.php
+++ b/defaults.php
@@ -120,10 +120,9 @@ if (isset($_SERVER ['HTTPS'])) {
}
$serverport = "false";
// Unterstützung für Apache und IIS
+ini_set('session.cookie_secure', 1);
if (isset($_SERVER ['HTTPS']) && ($_SERVER ['HTTPS'] == '1' || strtolower($_SERVER ['HTTPS']) == 'on')) {
$serverport = "https://";
- // Uses a secure connection (HTTPS) if possible
- ini_set('session.cookie_secure', 1);
} else {
$serverport = "http://";
}
diff --git a/fp-includes/core/core.cookie.php b/fp-includes/core/core.cookie.php
index 79b79e5..dd99493 100644
--- a/fp-includes/core/core.cookie.php
+++ b/fp-includes/core/core.cookie.php
@@ -1,138 +1,141 @@
$_COOKIE[USER_COOKIE], 'password' => $_COOKIE[PASS_COOKIE]);
-}
+ function wp_get_cookie_login() {
+ if (empty($_COOKIE [USER_COOKIE]) || empty($_COOKIE [PASS_COOKIE]))
+ return false;
+
+ return array(
+ 'login' => $_COOKIE [USER_COOKIE],
+ 'password' => $_COOKIE [PASS_COOKIE]
+ );
+ }
endif;
-function cookie_set($username, $password, $already_md5 = false, $home = '', $siteurl = '', $remember = false) {
- if ( !$already_md5 )
- $password = md5( md5($password) ); // Double hash the password in the cookie.
- if ( empty($home) )
+function cookie_set($username, $password, $already_md5 = false, $home = '', $siteurl = '', $remember = false) {
+ if (!$already_md5)
+ $password = md5(md5($password)); // Double hash the password in the cookie.
+
+ if (empty($home))
$cookiepath = COOKIEPATH;
else
- $cookiepath = preg_replace('|https?://[^/]+|i', '', $home . '/' );
+ $cookiepath = preg_replace('|https?://[^/]+|i', '', $home . '/');
- if ( empty($siteurl) ) {
+ if (empty($siteurl)) {
$sitecookiepath = SITECOOKIEPATH;
$cookiehash = COOKIEHASH;
} else {
- $sitecookiepath = preg_replace('|https?://[^/]+|i', '', $siteurl . '/' );
+ $sitecookiepath = preg_replace('|https?://[^/]+|i', '', $siteurl . '/');
$cookiehash = md5($siteurl);
}
- if ( $remember )
+ if ($remember)
$expire = time() + 31536000;
else
$expire = 0;
- setcookie(USER_COOKIE, $username, $expire, $cookiepath, COOKIE_DOMAIN);
- setcookie(PASS_COOKIE, $password, $expire, $cookiepath, COOKIE_DOMAIN);
+ setcookie(USER_COOKIE, $username, $expire, $cookiepath, COOKIE_DOMAIN, COOKIE_SECURE);
+ setcookie(PASS_COOKIE, $password, $expire, $cookiepath, COOKIE_DOMAIN, COOKIE_SECURE);
- if ( $cookiepath != $sitecookiepath ) {
- setcookie(USER_COOKIE, $username, $expire, $sitecookiepath, COOKIE_DOMAIN);
- setcookie(PASS_COOKIE, $password, $expire, $sitecookiepath, COOKIE_DOMAIN);
+ if ($cookiepath != $sitecookiepath) {
+ setcookie(USER_COOKIE, $username, $expire, $sitecookiepath, COOKIE_DOMAIN, COOKIE_SECURE);
+ setcookie(PASS_COOKIE, $password, $expire, $sitecookiepath, COOKIE_DOMAIN, COOKIE_SECURE);
}
}
function cookie_clear() {
- setcookie(USER_COOKIE, ' ', time() - 31536000, COOKIEPATH, COOKIE_DOMAIN);
- setcookie(PASS_COOKIE, ' ', time() - 31536000, COOKIEPATH, COOKIE_DOMAIN);
- setcookie(USER_COOKIE, ' ', time() - 31536000, SITECOOKIEPATH, COOKIE_DOMAIN);
- setcookie(PASS_COOKIE, ' ', time() - 31536000, SITECOOKIEPATH, COOKIE_DOMAIN);
+ setcookie(USER_COOKIE, ' ', time() - 31536000, COOKIEPATH, COOKIE_DOMAIN, COOKIE_SECURE);
+ setcookie(PASS_COOKIE, ' ', time() - 31536000, COOKIEPATH, COOKIE_DOMAIN, COOKIE_SECURE);
+ setcookie(USER_COOKIE, ' ', time() - 31536000, SITECOOKIEPATH, COOKIE_DOMAIN, COOKIE_SECURE);
+ setcookie(PASS_COOKIE, ' ', time() - 31536000, SITECOOKIEPATH, COOKIE_DOMAIN, COOKIE_SECURE);
}
+if (!function_exists('wp_login')) :
-if ( !function_exists('wp_login') ) :
-function wp_login($username, $password, $already_md5 = false) {
- global $wpdb, $error;
+ function wp_login($username, $password, $already_md5 = false) {
+ global $wpdb, $error;
- $username = sanitize_user($username);
+ $username = sanitize_user($username);
- if ( '' == $username )
- return false;
+ if ('' == $username)
+ return false;
- if ( '' == $password ) {
- $error = __('ERROR: The password field is empty.');
- return false;
- }
-
- $login = get_userdatabylogin($username);
- //$login = $wpdb->get_row("SELECT ID, user_login, user_pass FROM $wpdb->users WHERE user_login = '$username'");
-
- if (!$login) {
- $error = __('ERROR: Invalid username.');
- return false;
- } else {
- // If the password is already_md5, it has been double hashed.
- // Otherwise, it is plain text.
- if ( ($already_md5 && md5($login->user_pass) == $password) || ($login->user_login == $username && $login->user_pass == md5($password)) ) {
- return true;
- } else {
- $error = __('ERROR: Incorrect password.');
- $pwd = '';
+ if ('' == $password) {
+ $error = __('ERROR: The password field is empty.');
return false;
}
+
+ $login = get_userdatabylogin($username);
+ // $login = $wpdb->get_row("SELECT ID, user_login, user_pass FROM $wpdb->users WHERE user_login = '$username'");
+
+ if (!$login) {
+ $error = __('ERROR: Invalid username.');
+ return false;
+ } else {
+ // If the password is already_md5, it has been double hashed.
+ // Otherwise, it is plain text.
+ if (($already_md5 && md5($login->user_pass) == $password) || ($login->user_login == $username && $login->user_pass == md5($password))) {
+ return true;
+ } else {
+ $error = __('ERROR: Incorrect password.');
+ $pwd = '';
+ return false;
+ }
+ }
}
-}
endif;
-if ( !function_exists('is_user_logged_in') ) :
-function is_user_logged_in() {
- $user = wp_get_current_user();
+if (!function_exists('is_user_logged_in')) :
- if ( $user->id == 0 )
- return false;
+ function is_user_logged_in() {
+ $user = wp_get_current_user();
- return true;
-}
-endif;
+ if ($user->id == 0)
+ return false;
-if ( !function_exists('auth_redirect') ) :
-function auth_redirect() {
- // Checks if a user is logged in, if not redirects them to the login page
- if ( (!empty($_COOKIE[USER_COOKIE]) &&
- !wp_login($_COOKIE[USER_COOKIE], $_COOKIE[PASS_COOKIE], true)) ||
- (empty($_COOKIE[USER_COOKIE])) ) {
- nocache_headers();
-
- wp_redirect(get_option('siteurl') . '/wp-login.php?redirect_to=' . urlencode($_SERVER['REQUEST_URI']));
- exit();
+ return true;
}
-}
endif;
+if (!function_exists('auth_redirect')) :
+
+ function auth_redirect() {
+ // Checks if a user is logged in, if not redirects them to the login page
+ if ((!empty($_COOKIE [USER_COOKIE]) && !wp_login($_COOKIE [USER_COOKIE], $_COOKIE [PASS_COOKIE], true)) || (empty($_COOKIE [USER_COOKIE]))) {
+ nocache_headers();
+
+ wp_redirect(get_option('siteurl') . '/wp-login.php?redirect_to=' . urlencode($_SERVER ['REQUEST_URI']));
+ exit();
+ }
+ }
+endif;
?>
\ No newline at end of file
diff --git a/fp-includes/core/core.session.php b/fp-includes/core/core.session.php
index 581cc9e..7a428e2 100755
--- a/fp-includes/core/core.session.php
+++ b/fp-includes/core/core.session.php
@@ -1,44 +1,41 @@
diff --git a/fp-includes/core/core.system.php b/fp-includes/core/core.system.php
index 557726d..f58cbeb 100755
--- a/fp-includes/core/core.system.php
+++ b/fp-includes/core/core.system.php
@@ -68,7 +68,7 @@ function system_hashsalt_save($force = false) {
return true;
}
-define('SYSTEM_VER', '1.2');
+define('SYSTEM_VER', '1.2.1');
function system_ver() {
return 'fp-' . SYSTEM_VER;
diff --git a/fp-includes/core/core.users.php b/fp-includes/core/core.users.php
index f8f0580..82d61d6 100755
--- a/fp-includes/core/core.users.php
+++ b/fp-includes/core/core.users.php
@@ -64,8 +64,8 @@ function user_login($userid, $pwd, $params = null) {
if ($loggedin) {
// session_regenerate_id();
$expire = time() + 31536000;
- setcookie(USER_COOKIE, $userid, $expire, COOKIEPATH, COOKIE_DOMAIN);
- setcookie(PASS_COOKIE, $user ['password'], $expire, COOKIEPATH, COOKIE_DOMAIN);
+ setcookie(USER_COOKIE, $userid, $expire, COOKIEPATH, COOKIE_DOMAIN, COOKIE_SECURE);
+ setcookie(PASS_COOKIE, $user ['password'], $expire, COOKIEPATH, COOKIE_DOMAIN, COOKIE_SECURE);
}
return $loggedin;
@@ -76,8 +76,8 @@ function user_logout() {
if (user_loggedin()) {
- setcookie(USER_COOKIE, ' ', time() - 31536000, COOKIEPATH, COOKIE_DOMAIN);
- setcookie(PASS_COOKIE, ' ', time() - 31536000, COOKIEPATH, COOKIE_DOMAIN);
+ setcookie(USER_COOKIE, ' ', time() - 31536000, COOKIEPATH, COOKIE_DOMAIN, COOKIE_SECURE);
+ setcookie(PASS_COOKIE, ' ', time() - 31536000, COOKIEPATH, COOKIE_DOMAIN, COOKIE_SECURE);
}
$loggedin = false;
diff --git a/fp-includes/core/core.wp-pluggable-funcs.php b/fp-includes/core/core.wp-pluggable-funcs.php
index bd9fd7e..1e1957e 100755
--- a/fp-includes/core/core.wp-pluggable-funcs.php
+++ b/fp-includes/core/core.wp-pluggable-funcs.php
@@ -290,12 +290,12 @@ if (!function_exists('wp_setcookie')) :
$cookiehash = md5($siteurl);
}
- setcookie('wordpressuser_' . $cookiehash, $username, time() + 31536000, $cookiepath);
- setcookie('wordpresspass_' . $cookiehash, $password, time() + 31536000, $cookiepath);
+ setcookie('wordpressuser_' . $cookiehash, $username, time() + 31536000, $cookiepath, COOKIE_SECURE);
+ setcookie('wordpresspass_' . $cookiehash, $password, time() + 31536000, $cookiepath, COOKIE_SECURE);
if ($cookiepath != $sitecookiepath) {
- setcookie('wordpressuser_' . $cookiehash, $username, time() + 31536000, $sitecookiepath);
- setcookie('wordpresspass_' . $cookiehash, $password, time() + 31536000, $sitecookiepath);
+ setcookie('wordpressuser_' . $cookiehash, $username, time() + 31536000, $sitecookiepath, COOKIE_SECURE);
+ setcookie('wordpresspass_' . $cookiehash, $password, time() + 31536000, $sitecookiepath, COOKIE_SECURE);
}
}
endif;
@@ -303,10 +303,10 @@ endif;
if (!function_exists('wp_clearcookie')) :
function wp_clearcookie() {
- setcookie('wordpressuser_' . COOKIEHASH, ' ', time() - 31536000, COOKIEPATH);
- setcookie('wordpresspass_' . COOKIEHASH, ' ', time() - 31536000, COOKIEPATH);
- setcookie('wordpressuser_' . COOKIEHASH, ' ', time() - 31536000, SITECOOKIEPATH);
- setcookie('wordpresspass_' . COOKIEHASH, ' ', time() - 31536000, SITECOOKIEPATH);
+ setcookie('wordpressuser_' . COOKIEHASH, ' ', time() - 31536000, COOKIEPATH, COOKIE_SECURE);
+ setcookie('wordpresspass_' . COOKIEHASH, ' ', time() - 31536000, COOKIEPATH, COOKIE_SECURE);
+ setcookie('wordpressuser_' . COOKIEHASH, ' ', time() - 31536000, SITECOOKIEPATH, COOKIE_SECURE);
+ setcookie('wordpresspass_' . COOKIEHASH, ' ', time() - 31536000, SITECOOKIEPATH, COOKIE_SECURE);
}
endif;
diff --git a/fp-plugins/commentcenter/tpls/editpol.tpl b/fp-plugins/commentcenter/tpls/editpol.tpl
index 65d347d..1f89c97 100644
--- a/fp-plugins/commentcenter/tpls/editpol.tpl
+++ b/fp-plugins/commentcenter/tpls/editpol.tpl
@@ -52,7 +52,11 @@