Merge pull request #308 from joomlatools/feature/297-security

Port security fixes from Joomla v3.4.6 - v3.4.8

Author: johanjanssens

app/administrator/components/com_menus/models/item.php

@@ -1256,9 +1256,13 @@ public function save($data)
 		{
 			// Adding self to the association
 			$associations = $data['associations'];
+
+			// Unset any invalid associations
+			$associations = Joomla\Utilities\ArrayHelper::toInteger($associations);
+
 			foreach ($associations as $tag => $id)
 			{
-				if (empty($id))
+				if (!$id)
 				{
 					unset($associations[$tag]);
 				}
@@ -1299,9 +1303,10 @@ public function save($data)
 				$key = md5(json_encode($associations));
 				$query->clear()
 					->insert('#__languages_associations');
+
 				foreach ($associations as $id)
 				{
-					$query->values($id . ',' . $db->quote('com_menus.item') . ',' . $db->quote($key));
+					$query->values((int) $id . ',' . $db->quote('com_menus.item') . ',' . $db->quote($key));
 				}
 				$db->setQuery($query);
 

app/site/components/com_users/models/reset.php

@@ -275,20 +275,14 @@ public function processResetConfirm($data)
 			return false;
 		}
 
-		$parts = explode(':', $user->activation);
-		$crypt = $parts[0];
-
-		if (!isset($parts[1]))
+		if (!$user->activation)
 		{
 			$this->setError(JText::_('COM_USERS_USER_NOT_FOUND'));
 			return false;
 		}
 
-		$salt = $parts[1];
-		$testcrypt = JUserHelper::getCryptedPassword($data['token'], $salt, 'md5-hex');
-
 		// Verify the token
-		if (!($crypt == $testcrypt))
+		if (!(JUserHelper::verifyPassword($data['token'], $user->activation)))
 		{
 			$this->setError(JText::_('COM_USERS_USER_NOT_FOUND'));
 
@@ -305,7 +299,7 @@ public function processResetConfirm($data)
 
 		// Push the user data into the session.
 		$app = JFactory::getApplication();
-		$app->setUserState('com_users.reset.token', $crypt . ':' . $salt);
+		$app->setUserState('com_users.reset.token', $user->activation);
 		$app->setUserState('com_users.reset.user', $user->id);
 
 		return true;
@@ -412,8 +406,7 @@ public function processResetRequest($data)
 
 		// Set the confirmation token.
 		$token = JApplicationHelper::getHash(JUserHelper::genRandomPassword());
-		$salt = JUserHelper::getSalt('crypt-md5');
-		$hashedToken = md5($token . $salt) . ':' . $salt;
+		$hashedToken = JUserHelper::hashPassword($token);
 		$user->activation = $hashedToken;
 
 		// Save the user to the database.

composer.json

@@ -23,6 +23,7 @@
     "joomla/application": "~1.2",
     "joomla/registry": "~1.2",
     "joomla/string": "~1.0",
+    "joomla/uri": "~1.0",
     "phpmailer/phpmailer": "5.2.9",
     "vlucas/phpdotenv": "^2.1.0",
     "joomlatools/console": "^1.4.0"

composer.lock

@@ -200,7 +200,7 @@ public function connect()
 	public function disconnect()
 	{
 		// Close the connection.
-		if ($this->connection)
+		if ($this->connection instanceof mysqli && $this->connection->stat() !== false)
 		{
 			foreach ($this->disconnectHandlers as $h)
 			{