From 750a11888491741bf071468dc5a222b0d8b45225 Mon Sep 17 00:00:00 2001 From: Roland Gruber Date: Sun, 12 Jan 2014 11:08:43 +0000 Subject: [PATCH] make session encryption optional --- lam/docs/manual-sources/howto.xml | 12 ++++++++++-- .../manual-sources/images/configGeneral1.png | Bin 15650 -> 18180 bytes lam/help/help.inc | 2 ++ lam/lib/config.inc | 8 +++++++- lam/templates/config/mainmanage.php | 12 ++++++++++++ lam/templates/login.php | 9 +++++---- 6 files changed, 36 insertions(+), 7 deletions(-) diff --git a/lam/docs/manual-sources/howto.xml b/lam/docs/manual-sources/howto.xml index c99d087b..8a349be0 100644 --- a/lam/docs/manual-sources/howto.xml +++ b/lam/docs/manual-sources/howto.xml @@ -996,6 +996,13 @@ Have fun! or with the "*" wildcard (e.g. 123.123.123.*). Users which try to access LAM via an untrusted IP only get blank pages. + Session encryption will encrypt sensitive + data like passwords in your session files. This is only available when + PHP MCrypt is active. This + adds extra security but also costs performance. If you manage a large + directory you might want to disable this and take other actions to + secure your LAM server. + @@ -8885,8 +8892,9 @@ objectclass: top Disable session encryption - LAM encrypts sensitive data in your session files. You can - prevent this by disabling the PHP MCrypt module (if installed). + LAM encrypts sensitive data in your session files. You can disable it to reduce CPU + load. diff --git a/lam/docs/manual-sources/images/configGeneral1.png b/lam/docs/manual-sources/images/configGeneral1.png index 4e3aa8e50c3dbcce4833c5de9365d97ddbef49d7..46cf276fe500ae81c9532934bf7c335615173099 100644 GIT binary patch literal 18180 zcmeIa1yo(#mM(aJ1PBBVb_fzYNRS}G2{|DlxVr~E!QCMV7A&|04;I|r-5r9vyF0v< z|K56aZ&kgns(#~*?$M+7fU`MlTYImy=KSV2zq$Qoq~2kmLD3)(2!_~um>dLx*a(3j z7@#78|Cri#If50Ejfj{6Dk|#qqVxjz`pELVstp8!{R8~kA!J)whe99}5HZ+m1;-z| zvrZaMPVZ3;&I<{9f@UZ>F*0J75I&QBi#kuxGhEX&&M<7Sh&J(6i#17)LL*yrOG#Oa zr8PBO3;ITZ2zI3GC_cZrBU0xMHb80eK0S3kSYW%39q6q^8Fbt2H8PATE@r=)sP@il zcX#vyZGk*4X0<~A>%j{O;XmIkP_e;hBMIUIusZO8{MlCfOc;Fr*EcC?BZ$y4Cb8Q^ zMLW1;+sRmNh->%V$)?LqjFdCzJP-_Q^ot}~7h)xm5D*Bm zx%r9}-BB=Nae3fjWwY+8LdVEWcD~kUYMnSmo7hYMc9h7k4;KFP`+@|AR9s9hLVLd4 zju_`Qu2PZPVYm9{_ca#rp9s1G4%f_14R@apA8p59*%~iBCEz~9n|&RCmb84TZ9U@g zly`5B_-?7^%jvq(#xfyx8>*}MOr;nsHkK!_u|tTpT4Yi=|D)|LSMS^*k1s8=^NH(A zM#c%tK720OMT5w6^Qqbrr+|K36Jg&@LBbarLwO!UONuYd^N_x1zp`2iypu!z00seT zIg2&!Hb9p`I%e+ z7pxGH`v&!jJweBVgLQ4(2JOO`&b~I=puQf)!lH7n!A$XWV@h62R&PJdr~DsaY?{1^ z8!z=%Tu|;`DQRe29q4u?*7^EkBq`|kxncwb)i|G4%Vl3(?;l%*3ob mpIVj*LKS z3bY5va7m0L#6bVjDrh65S|pjnPIhaP>T0LCtuW(3AMRN;@9+rW3|-j;tP}_CiXB3O z4DZf+PK@$2kC(d|+^JIW8M&cVRfo%3EY(TXC(%_`LDk2oxwO7xE4G`sZ(%5yPiaz- zP~`ml;6u@g?qB?*lBU|2k0y$Cec<_jIzNZ03@(w0;vF5ud>aS0);DsxAMfH)#<99z zw4g-uHOvgfgn<<;2w&Schd8#bN4^zWQJy=-nqxk{Lw)!du8 z^7V^*oLRMjE+t|Q|H#+*Qe_7#-ibPXxIS$5b^bNxvrbDgPX;XvAQ}*3nvK~l5AB>PxPJf z9DiZ0hPeS=Zv5)X@YdaJY9RbM0zzNDR^43fTcg?Bt-ty|<%$<^aczx%e_GmHLntxP z{^OdFyqLw~uOHHX4OS&D2<`VlgEG497$SdlC-4XgYH>!bEG|N!P#GCZkFl*jZ*MHM z^2gcV$^14t$m?S`ZA?3Y7kPLp3|-G=J-wC#b0-~NzpjT-N2+acTi3MjzG@*-#DzdS zAB`z{9$*C;J`g0~x?5XbK5a%P^?RS^Zi|-oHUOJ)s?fbC^@i6$MJv7Y#zBb{hsJC^ zJk0tV&V?g)z`|5j#WV(q2jlbSw-@0S3>Nv#IOwE4x_$ zFU=$3GbF;naB&NRK?lpGSt+3e(;@MvccoUaCw!k$VbDfR^TC<{^_g6(d+ty_(OMqw zn#85Drn<_rgM%m-$5CFkJ>~$h5bI|@etr%A&c3uh^|XwkhA(91bG4E%Ha7fsGPtrQ z=tz}eYQ7G1shxgYoZ}k0c=%dSlbgy#SgGx#noGxee}Xh;1~nL8c)toDhl}@1h90LL zUS9QjMV&1zcEha|^-1@{-0;E1L`K|t_#D3s6G2rKk2H~xYs*#JOs)1Bcyz{%>nHSi~Cv?CbY*VnpJxBhXyx=2gezb0!+*_ZEfkW(aTl(Jyb6l zde_ai&hA@ovx_S2dF7{1cXoEou21%UO-FgfF@8#I7N-g#KfhAec3;>qo=<&y(0(fJ z_nsOT`r;9=(qFgW*alz51XIs9M+kWvo}P9zVPxd5vXRsb7PC)=wy0B5PJNn*xLNCb zE*bAU(<^AQRSoX*mr~oM<4gN{cUdtpVw|@2Gfq3^`@;_vgyH4;i&8U|&gb9QbOpeU zJ_70psoByfaCnXbU63<;1rE+G2C zr~%BuS?sO@!dsVUMAr_7zyElM)^B?V*yvM$6EAeB#{6js#Ml-4&v#Gm2dH4RfPwJG zZ92a31fP(({|7duWTQJ~L`G)!Yj-l&-pjm*j<1foFDxy!wYNrvZyM-RvD+~NXNmnx zI7UJ>c55L;{O<0qF9|*TJ+-t^8nmoC%N#1HYBIS-hD}L{=}w8sh#@0m zc1VHtZ8Q=D5`=~LwTu4AH)O}1*GUpe=3BTB)9gancTI|q{&74x31*xbFHjmE3*aFv z?M#kxnW=G<=Al3M+#RHxuQ6F|x1Fz9^FdskMXNSTX!~SygoNwUE2pEMa@n88b0@b8 z8s-YLg?w~vNr4w+vzV*(xV!ZAn<|5!H=&SUTwMw39zrqh*1bgy&sDek=suO8!?Z9N zd^SYAva-V&xPJZAu3?vtM%Gc<(s>NCvfBLVVC2YUMi+|wz`OQhY=?aNK+_lJg8%XZ zujqNsH2%2r_7#zjY|a=yROsfQg;p{ySG6R=`d&6obhg3czJuK3=6FD;;bJKuPrc%W zX0-x$MPZ@k$;J>^P_W4O9S?LA6h>p%^uK-kmRRT*Wsqcv0g(=pXu6qKTgUf(>Qai6 zo7m~jrE=XRyu0PU#g;H>_uSsZwgoN1GGEU>2p;UOdxKpJj`X(mCP$;j% z-puLt#P%93Ev^0joZH30BG+F_i!YYPYNRqQ9^SSN3Iyt}s{Z4{>Jssnu7S6C3eUgP zQa_u+eFtxE@k+pFEDSf!%(G{=3xcerVIsEnYoc@n``g);5~4nkk_sl5@Zi&J6P=w= zO=7XMg6}SlowbClZ3$Y^naxv`pAd@OsQWrdi}4sF%Q`d)=Zv{?+0^?gt24$g#N-!E zPFC2GMloxz6Jpa~Uw&i01(Q5mhO7cvbRjK%u&m(DE+9Z1u6)h~yu?{wg%I%iIfXt9 z0o*cTk<(-I)%6V0x~~ZK5(Q4L&vzzY($IKM&@#wp2UhRk zHLlnvmDSr%Tg&`xyTz6Ctan%5(^JQ$7@^CzSJR|=}qr~WI z&x7-G)!L7CR#wl?hi7ML?)Oy9d9C`m92}y5|2`0m~H_U1eEqk;2{q03_yf(^qw?FRk*efVfM2?;k7F_c7E_x0X) zq@1p7*B#yayNHugs^j|GkE0vs1sY-l-8bSM7-RSr$zk1(Kg~8bFNsNE=c<+cvY4;0 zj^^Rv!4FoyxV~Or8MUmWSuF@3C^OBwk35>_Qj30|BN8wDTNJq@-C8t7Fa9?gdH04R zG@qNeZT$J2M|ovQh$~bJwPJcXz)9h(APZT6irmG7?N=JgQn{I^xHTtfnfKm;2Kq znCPY>MZa1#!2OE-)$b(T7=+uJ90mM$_(TV*gd?O+cl3PEB75+)-7dWn5`ylazZmC) zX(l9qM$)4{R9xiSt(WoC}6Y-#E8%`J3-XKbuN6@E8 zmZfLH`8bO=`62d3ubYuzuJT>SFnvSJ5jnl)r!tr=@0*&{2b%TF^{VvU9-aFOL-FKbBkr^sHl3Hnu6oahg$_%3WT{C>9eBF84k|QC@B455-=^TJ^VE#k3naYEqQq!UMYh+<{wT zF5d^ElC0$SWOx}E2Vq(@d9zk=rA%*NQIy@C!0BWm+1U_hdV9b9_|fs>$BPbfNnYoZ z{fcG5I9>xL921VIqhed}o^K9(8?%gS%~fty6??sj$MRNIU7z=jlqRxT>iTR-)s(Vb zUCp(a@>h?cUz3WRDsZ$jSHj?vh%UmzQmBuTBdK zI~+2)dwWj~*|x&)Uc6C|!h!@n>UA0O==?=aW_5C};3)|e_goM7;p3U<; z{G+LYt#1YSxS{W3O5Lz}iYM|7q<);31gR6EdDkMg78~?%0f%P2`T+|oq}%3QAW@Og zKw=quBI>UNxI|#I>!?Hn7s`4f$DAXO8%I_?Gk+zWZlE zQ8?&+*OXDGwhGl#$LM!`o;YIlFit>J1HX{l_9+UD+d6_m)anFp=Vy8QWwj)^Id4=*Kt;pSvSdUA3S z+y};pyqsKfpPjY!hxhMaIiDCy{8@U7^gD2Iai5ZsI_ zeCM`P;86+BXR8nv$PmxYW_-wsC!spIJYAEo{@ZlN*H=QN@8#-33Y=NJytK^i7h$AT z$T8QNu3C<}Bz3A^uq@JbMZx|r$QDeawj}pQ?QA;ir|k0v=!M0HwR z6J=@V;pq}Y2nslw*h_fupuo!b0v~asmqeC6YH;jnRoVO1k1TVJf#r!5DGycA@d@*L zV3fOIMeng7c5AVYF-k41tdHkkM@Yv;Mn=wxy!gyamp4Hc`YQqr&iEWh zT|7Y2Wdg=f~z-d>+2@;i0MBmx}PFNJxki6uM> zeJacKDwXLzg@URe&<}BTl!)_@3^_K1M24bx!57~bxS`R}%BxscOg&JihhNq5xYqQ< z&AmNH#o1^DR8+-oZxDA#ir(>WHC{)=cC`Ul55n+_-0cvrA10;=xik}T8kW%Yd}6rdl-vjNVCVb$RxhtP0T&ow&FHQC zJev4}$%i6QS+ONklLXvfAz3b{*qnSWTxF8+1a>w3;9zoh6}s>)_#T>0#uGFH(=9t` z>4KOSl0*S<7CweQXN~f>lM4G@U_0?-5v7tmOwEw`^*bxfeYe|GiwF{^WQ3qMu_xqw z?gTeF`UOIx4Jfe}R!-MYQkIaSd8$u(aYSY~ss3&~AqXJ>Xb z)}Eq^i!Hvyo10BdudUNRn5v>+{rdhq1|TQ)VCOv3F%WjK$Oi>F16i^E7JD?L-x#H+|+Vw`NM8%z6A`(`NlWCa=-5BTZJ;E_9yGp1G5vZMVcB;@Wu~)ZK z*C=<@+^|V_NU2?v?lF8OfZR=y`g7N%HR_Ji-(&k=@A>mgKR=uc%lRt*Zc@{C*)q5| z!$|zgMCj<0dXuL6dFHjChYDuPpFT0MYJlM_nBy!wt5TNWM(^rZ8%&LbrHr0!>DX1g zuRZ;F8g79O$;!`f_LKg7(0+h`>wginh_r+^PO?#@qg$Jnc6)k~_V9AuB4N?f|2uAZV*Y-LBDW|ErEJ!7-JKvIT` zm2ziZ8QL=8fPnRV^S2;U{A%S??+7L~G&940vci2| zLp)|?waH?GgyiOLEPTJm5IH4G4Etzdp{$|7fQ^cbwH2Fa|MO_dbO!>F*4Fi>*iP(J z>Rus~*D5+_7vPN&y=;rP7v9v%p-CMfo?@okI5Ioz6Op}p!%vBsj0vFe@7wEVLPGn= z6hf3}Xh+A#$8)#WDOA=0)0j9%)rT5)p zd#EtADLX(~R)(VnHUdl)pnh|-YD*aX&WNLBx-{23;O$0$c2&ZiZBNm;*n@XEfN3(#eG#U-#K#~5#=9)?H;O4A|Ai~fY0lM@nlRi{j; zUDYT7yDbgX*g$j|Xi)iIES+95a#7{fVv?fZbagkoUzS5b4Ep-n>Rk0pmwxHCHX8K$ zBvsueC?BM8q@(!f7`p>GzqziT9+ko!S-G-Jnf5+Kdi!S=KLPPdG^Av6eiP5mt}45| z8-psQH|J4I(Ts>+v@4yC%PT63R__40^Y(39f4`((R#uh@H7+hr3o9vAOT*>adT{6> z?8#Ws?!-KkQ;NK=2cbz+lJ>&#vZAgcv%1ergZ9eWngk5cy^D(Wkp`B{%_1$$BC{Hr zQ|0@r27*~dNDzL5K8;ZWh71+a*1}eHCULc>&vmV6_-@g?SsZ~I^8+~SJR}<#TqZ>j z!zD3k-B!9!j(}Rc#X5_q!M_k^CzMB zW5Ir@sZ(b2MbRXX*D$>Hh9djfGXUW~f4;U^d$BcTMl>O4vZS7)WD(WXT~chFDS02J zJUJFQM9E}0vX)?4#>+>i9L=z^^XY}QRD(l7VKpX1N3FjcDvc7U)T4&2-}JrlGYs*H zPrmY)eAt+{2p~E=Rq1!>Id$Wsr-(6M=+LkM1*|^2Zz1iNCUVVZ5%Rm(PC4?;gZ}`{ z@K4-{WMY0uXZWSBPWdg^w4<1b8}eEGXJuvUgitpN#Z{~SOaF$u#tFIf!?LM-;HSJ#6rq-IT;O%qA)ujjE~Cw;a15}K%< z{*h0Fs43Osm*}(=|1R9*V};OAWL zZ|D;Sl%e)rDnC&?dB2ogKy+wxX?BVaAF4~K6$nr&KF1$dlA|oIER~>m66~1mYOFxY zZ;k}91w2<{?&Dy3lBcp!_cGr@l|^A*=B9yh53;a8Hb%!sW0y1kta6M*SfH8c{~a{h zKe2T=PbgHzpBMmaBCIdRCQKj69zOafZ4`tmr3+U7^}Nyly=>F}f7Jhe#_s=H&rpZ` zrC~3t-6Mz$!2b{(c5U~|^lWj6r<#c8pYiyIS6(m~NvLXk{@Ak}9Z=4RT(hz0Kbj%N zwf{;vJAPnD`iDKjx{Y2~0?%?N;>n6p1egdcazPHeXON6m(=u2qYi>3=!k-gMP|**@ z`yCx0Ro)9D^s3kyy->+JTb34lM(HK2|7!}8JpLyGI~%|(ZA|fg9|Pf-bhFcLhR?*vbN_h2dv*enP!WL zWGq!<_J?it^4nh`)YPs2JQjVTCVnu3;aM$Z_H&kK7w!PSB0r-#@RwHEUmI%g zN*}8U7YgseKiNO@WC(Gk{%6KE9iH@$Apx<j9TG0rEkhIat*#I_p#V?}Ch;gJ6>7 z=%i?kfl9KcPe0vILJBXxntfzdXE1ugQ0||1kP;Z2ITR~#bshKFZzu1eLqJwpf#IsI zy1X))4(--0d;jUS!_KW+keZYJvJcH0{pHGb9vi~8R@-WA%fk|4dC?#z?FpyJBfE)_ zkVKxkX^`34uNSi0-5$3H*~H!5FqVd)6SR}_Rz9cO{t5yGU-G_mj}R0ErxktUPc!Wp z;w!}`(n7KP&O5gGZ2z9l)k(IA4B`c6;NzXrmKIX`?ot0Pq(8}{sPQ0pg8pz~jN4-F z#%d^)R_fI_noe#r?(1=Z(7cE)mW*1x#UK}3rl6yM=l5R2ZA#*>%$KF=QiH40OYz>R zH@=AS6X-gaTeQMNL`X#&nJizv+!Ff`4>r_%INd0@14-kna~DM>f;z6siMHcwy96V5 zuC}SE?&)b8y_wF-<7fe`uB9=6Yre!M-p>ZEC!!aZmqUg2PLWXHl_E`ZbNQ8(3KZCn z$wpra?4nLo{`)YY%&T9KYb#fy%%qhB32?PaO2gdm9^WkwvbFGOrT;XWHlMGTgsl%G zsK>{=+CFA^y#EBE05UlL9g^}?5Sfy`v%vbkxA!RtNly1}eZ6FrKf0<%`Wq`7!t7StfaE4eU1K=g_`1c+<#mJ|BlkN)InF zu_`jJ@?=(cXz1#KPKPA7iC$8)vW{a%PN~VVkFs91>t)+|0O9S4{R}Mh{l}HhkVakA zVbjFaqXa-)*H71vM#CEcOs3l>J}Me*(wT>M(hX@K3GUbre%OuRz>Ame%E1Llfo6yyLkviKW0r3TTn0&@QXn~DT{;4 z9T-?9cSnKJ^V1dgox|Go<7G)g9yGkwq&Taqv&*7yi3kV?pacY4Yg@zRZUYbJ2dGmU z8x1cnAA-z%yKR1cC?3&a;7ssVpbv3ct6ZNfaDb59{(Sv8& zl%G^VEl-AC$M2cmd*Ks@44DjSz%bssbc8B$^~NcTbYPnvhUn`@<50sR`u91>~ONd!(B@{lp>OPN1qD zSN#EEGh~_MEh{H?wJgmjTFcfs>OD$GjpSKvz^oe`#PZvE*m)Nx`$KkNc^Ga{Te<;a zie;<#>Z>z|Oa;{3^Wf7|z2>x1jYA$6fE9x=|8YEk!7UuYUn^HN^r>GPB3x%(Hc>gH zTx*368GSYarW-&vLD2t5x`p9@O#>0m!;eBOM*qqr`_ibagjrM`aZ~^xc~-`n0W}Lj z-FQukBWoEp7&jVBGC`q8mgaUUa;%mWLe%#Osdcg>+ia@Tm?_5$6*`)~IDt||AorY71Ljj54ptJTPcSo^nF5X#|t5yit`_~bABT5M`Y_5zy$oq8DUPSWKfBzt5!SS z7SXIUciyxT;Jft1@6T}R;F_LyrhO7$rZ{h|k_imWtQaB#j2_bp5thlNKRyck>L~s+ zj~ENZUMaUxDm9^es%w-JF(w4C@%kNZ*iTlXoez_9Pp15r`2h2Ku^H&Z+5gJ|&0CH; zujcm2xo~c{$E|2t9bM%AyoP7Ne-$BoeB(5ZC9JQEf}ppa|3$x}m6vx4{Q)8!T?bZ1 zLqegReo#puFm?Y76v_s!T)jY+6|10}+?_)?Pst_-urf5O5j92^J(@n2uuS(yPwB*Aplheg8eKZE=6U1bD!uCAq!yni}!D*%Hov_I8lp(9`3c zWvRTF41Au}UOT`^n?Jd>w-**}x3qM5+thS-_=v>zHkw)6LEzRHn1-1Sd8P2Qd!DlH z_N{VuTa}rdg8B&i)q}d)V~fY+7g94FkrOhSG&3lG%eftqrVSzEo4vT@EUfgZ%QtT# zVE&x&yNO14+BKe zvUP-*S5({&(D`&`xx091r@hE%cBgBiTqZNjLXrpvf&(8H zSmU+tK&cM8dS9)ruLEbooQG&(nDl9CH0`L~@~kAdO*|bl3Ch6tz;M&H9J)ixKOZG7w0JVu% zJw!kl33QD3(7!>3CQ?5jEd!{bS{1+#xU5H{`m@yKj{D0`Yd0xHRs&@_&Bcm=Gx_;p zk&J5%oTh3y;|0AxPV3AEvkrf0%rt6|s8|Z$E6cNJ*Ek+B;E)PjRVd{I1wQ7^5J8GR z{)c=ovi-{B&8e4IA(Kg2?<~sC>uwie7VlqwZez`KojO!bzlpV#wG}tN8Incvzs}!& z0=DLb)E^8Yk|vtQ%pzV<8lf=RK+vXK75NpPr2fvZ3-G7*1&Nw7vzl(Vd`en{)gOQo zs>;$_doPc#Wc@}#L!)@%I+k-hStui=yA5Nf%CMCXNRJ#NRldIj{k)BGRuT)%9;KF0x;4Cek=_!FK{2ZoH&n+3znK)CptMjJZ^}W zU1qvE|IB+^fChK>n7Y6qaksHGz3i(H$5m!ofp!Fu0;TQJHu)+cw%bx`Y^%0MR`IX% z%%G5s-xETG@s%xh-a z&_#;0libtjB%Q@4v{skeckJw@6aEI5s*efBPB{!G9NG4@$vHTHOTMh8Cnt!uQEd`U zbt;OqgZXvN9?CjbIyCf7ycOj5H8UEC7~{_iSa4`%ZthHsc@c==;;OMduM{(MGV<-6 zWtvMdu>D|^((iE5pKp_8M|^7-=D_5NqtOq@WtP;W@vLgZQG2QUk1z%@$_IZ`^U1X- zDtsIs@?P{^jvc{(ege4z*MWkL1Je=0d& zWS4?Kjul=QSAy@o-QClSl>Kuu|x@n1j+`$-Eb%%kX}5*2cwJtt$7;FCfOj~UkUymRTQTB z!iEizA*s7Q8Iu&J##L61?oZ&ug1(ZWz>XgUeT3&&_9oKQs`)SOECS4I8OyLB8WHO*oN_PW z3r*DK+2N%Jfp=UbljD{pJ~AZcNlTVu$ez!1jr4qr2U#qa*;Vp{&&lpY5`3n_XyErD z-qk5NtNqPa0he>DAoU9K>!ThZUW|zD5ef5ALG0UnG+z2GN4}z zFMZjGJrFbX5H-*X;z^e-Ll0ELRi>v~ex2_%m#^%$>7-ogsHtI;q1Z#(9tkQS(ggST z;NioJOru`y!oi`TXQ^*|H>8H(6M2j*(PHUJFx!QNl;NCRtxa&fra)z#J3)+U$D z!NGA-HlbBgQL%2Ao|(D-yNHUBQJgaL>sO9?8{x7)%y8LHq2Mq-4UHf3NnDcW)<-L1 z%xa~Bbu&?=y9tk$)yquZ!t&J0oLz1%fL2q~c4J|0ZEbh=7KoBr>JKP;ifbHpzGv5UZt?Y(KyEd&@(+(-qn~qh0OoK7OCSd=|Rfpfc~<9xsT$+55S%VVr;a1#9kp zH98&06Q+uF>b)Q8>%K-3yor5Asi&HXWRqA?s6#~AUW+Mx542xjP_Tf4pueXFG$vAp z{?mMYox5*oY3bLmU!T44v81BQ*QmlJCl>-rpyXtV{Fbh8I$tbuGF)6aEv}l`YC9}r1_$u~uHR?=P ze~pb~2s#J*?0IPQ_r+HM!NF+VV|4gsONfy5NCNL$az5vqHbO0ao4s89aM~eR*&6#@ zpci%B9v?{JwX+t!N6@I4t8=cqo{Ip9$n`kia`V{?F}!#A0xyr-X9^mI=A$43o)mgS zqA4;8=dS{zg{pcbpTO=z25QD}g} zw{LTWx@jUQzhi4l9165xqdCe2D=P_2O--?}+=(9b_!DL;o!r{4o8Bcx{R#Z1=f$gs zMMZC}&$r*ftgBpmGJ>MyOf>h$OJ46Yy`!o-RIpp$&w-yG9aTH*Yk9ZFb6adB6;h-w zEGz&8nbio$K2GFos;a6Q7#OUsu7Xc!kWakba(fW>yz8;QeX?#=n*}-W09(jCVcyA8 zA$N0glJfHMRFssJ(a|q7j}8ylG6eVqYHRt!!yOC_4Bo;-v1LEPV6Lt=`wjPV8K=ir z+))R|r^m;qRH-#iPWzJXA?Vm%UI?2L1-_f4a}dlHR!*$oYX`yWeVuO6b8HMoM#d_Q z7q=FlnOImV%FD-h1MZ|uIG}k->beByXW8>X@oV)KGnGRF0|WE(^FXiF-rnBbZ3<+V zGfe2{=%Mcw7JbJz+55p#Es9z~BGs%dB8L&-TuwjdhiVmX`ZkuTY{^ zqQ>>Xgtm5(UR(O8_|XyA;(m8?shZ@Gul}o97^8)y4@*A$U7a719=_AmMPpu{r1V5Ya0jpa)16+S)Pm@@+bTL*Kr|a=$Q< zb$74N$=M!EDZ(M;-B`2VdQ#_p>$6u-p9*(69aAo+F@uwk<-<3pGY2vxa{m}tNN2~tZ!f7Yyv|D)5bF?d%P z4Q#a7KpgZ}tc3mMaC!otLwj4><{1qq=h*zbHU;+2%uG5On!4kDzFv!EwMD zrxAm?o@!u~fkNHNrmnU&m`nglObirVKr8QbaiBZ<8EEikK^y#Vs5CS+_h+g~Jnr31 zzY4tpUfa>xmWnz3f%yADYb?yZVa_(Zv8&98zyRQM$O zr?VXfBgL%N196+-jky-nJd=?OD=VuSV5#ceT%4S$6c{j2QDa_NrA9|b=MQAdX9AV^ zs&!RJ$iVL+eF1)chFofD>W?d(p$+$U*FeMX-`UY&G@2z_?bVnj8U(cKBLFA(cTP{& z*sS+gi!-ZLnCFd|;^E3hd$~EPR8d=3hcRF2+#AEDSPm)+RJci@&~8%qtlq9J{~ENk?uXOmW;q^{g?G8_ zi0{Cu7TBl;%o;9ar{w9|OA`~8*~LXlmg=jkizjP#0C*>Qpm z>lGrxDOx70gvCwk>z{QdKte~R&&l)WpwaLd3e-eSP;^DmLh;w7zCV0}=Ka|viq}(@ zJywFDY^CN2AkjRDtsU@;RwJ-OBO~!0wpV#&1B|%FxuXn77E~8R6(Z%bnVvsCJS|$R z;rf#ge@Pt~X7O^n#;Lou7I!v{>hjm@m|NM|$v~A(0LT!oZ0pMhbWBnTLm)A9*)+=& z60om5+sRrBKvMAURDHUS!R4J8qDw0F>G9DFkZNrap{T%4_``MSE!a8s`TwmX2J^$N&@kPs@ z9nidor>3R=qFkl`2zQFkC5Av)R<^5uB?7)V2{w+FL4+}=ajkTc9R|pT`d34$t?_P@Jj#d#<0iD;)BKisv8MCkqAPcqTb|-RYGvLzy0TY;?fOFAGm+NqBybOvDXSg_(i{GT8+@*5bZZ7AT8#}VQGPTT-JvmSDY>~443Tlw-+XfH5fC$3q2FnQ=$suZ z4K>88-1zp(Qua5dd@%z^_zZtnmk9yMJJ4&_;hkH7A}`Al0;WJATTA&8L#=t&>tm4g z)2!4X_`7~jY+i6StbCtTz~0$;3Wsu7h~#LYsih}+BrR=PF$Ni8qc{3`)1!vHip*L)~2SvMAKAj9oZZ%ni?-7&`ABV znxT&^LMPl6W#r_Ff&CsG9W5>{PEJm4Y;2sXbFnD_)kP6MegII$%*R)AcYEys+R;sV zbFm!aakZHVBBHIiWq_&Pk-MGDx$HYRJ3|}D%(=G-5MfARm4@5FKOcblxMYfk%lW>I zKk6%YK*&@Jf(*z#V4ka^0h4ezWAhru;XboH>k_;G{m1GK6s#>(r#B7zJfoZ$;h-Jk(5HW>oZsc5V(K;&ib(vdyo0PJCgD6@DLy*bTqUj0*MbFwm@tG ze8odV1RQ3~YFp4F$o)SRHb5Nl6%C$c6;OL7K7X{@)6&wSudffFu$tNwfJXff{Q$J1 zrJ=zf;R5wqh9H6f$PrZU93CI%Sfh|WeF}i~(TvT2l}&+0)zZpJYdVV7cD9YkonEoA`x;b@W_5M8>Qkx7ZyxL+lqUnMb6QZ-jSQdVC7@nd@C1aN8BC#0PB*9J&e z4)>qhT_W#o?f3Y9XG;H>Jvv;VaE$)Rm;mPT!Ol974-->m&3k^{n?_u5*gX@PfgcgN zso>QQHj=QOdz<6yiaF;1zfn^=0Bb8O<^@eh>1TVuSlVY4k)86BE7;(B7&wvg+4Ebk_%$>L zaf7m@w9wGdGL;YnwY+iy?l3?aB)95?n)8}Jg5E$N$RU5;3!vNPQ_!G#^a+Pwhp7K|JJlsJ8 zHb;V(|I|&Cf+mF-rv;a-l@&HCC@78i9EUWH;i4qMHQ>(&!7H?c1Qosz#EkH!Yq)}N2x?fOG5McajeWXA6`m61NQx~Y?k!n1b zSy*_u0Xv8~6`h=%L`B5&sbfejOr5H1fjZO1N-Bq z5g{5%AKiNa#MiCZZ%#UPz7s6>lQcv!Xj|ir)#bA04H*M=W}>++TyalTSJ9`3btXk* z9a_-|Z#ePx^}W8n27ws^AKx`-G7<{rN;|!A+0?YG_Uh{KUp$@y1&C3<22@b5 z_>OWU!vi1+Km(lh409%=PTK@AH|uek&1Ea)l-O9mP5nm9#&hYp_rv>+0}?}?;S6rA zdiQz~g#LGYj$sBwQJDRhCOmhay&j$_{{DK%!r0s0*$G}Rv5?{RH(b7+@fR*vuA+EH z|HS&TC5D%=py_}BWB})G@X+mN z5v_=>ZoDOOjC=_dK?_jbBe$)yXZ<)|)`8gQs2>UFtrZfHA;Tp+9XadaBuv#&rvg(AB9(NxSm2E#B0xwBF;@bWhZSbi_G`Vwu@bc5UHw0J zN`O%ZhFrNyDmXfN!XJ;WG6k7)T-6D~r=rt=`?N1f=pGccp?Qm>%cW;zaG6a-z(L8+ zb-CHJRFa^kmKM(+AFEdz0|*<9@;2qE`os$3bf+X#Z55D?gd z;?s)@M@GgR;4W;a*!;5$dZPXSeqi`~Fi2FQFfcGy6MvZsXG$f2aZCurBl9W&r=!m@ z04g|Ns=%K`4i>`}&rOIGhdA>B?Mw|63h$1j{? z@7tFmxbUR?WoAEl8BLU5B-$z{mIZDRzJ~$9faHt;J+?wEva|!i%mYs1%x4p4x!JRA zNvPNdDl*9qrdy{swfubQ>KWyPcu0-%Ev9AGPCPh|9>jIqzy)6IJ-=9u)&>MCe>>~r zJtPF_pYK98Fi9zAW@kb1^Pf^{q5xeL|H`Ghz{-IL3@%~eHy{F$Zf$EDn)DB4RD=c% z1}62O{Bbh)s2sROGtH^ruCcjSsIYaAu_+dWh|rZxRn0*-u^=YUb$WY{J7mmJMuhAI z$PpbMCL%fdC%FEtqu#<)6yaTxT0i*@76E~{<=u&LZX^_FB z+K+|;i=ZrqbU9TyxutFW76-FGFJLiz&p?z|4^Np z(&w2rIZ1ZJdE8&baQJB0A)J;HH?|s^Rl0JV97GfU#|r50$g#^sHpu-pYrs_?VsE8j J`64=>{|9}xe7pbv literal 15650 zcmeIZby(Ez+cr3WDAFY$ASgckj*j z_w4TTZanXA-`!*PpFNIYJ}|?4=FaOnuk$?bFeL>k987Xd2n2#7BMno5Ku{YY5EKOr zRPf5ZJgyvYL30t4QNzH%m|jqv2Y)_vl-72EKyc;3PYTNHNs1-}@)RNid#&b~vOVLW zrMf!(VDIuRs>}pND2*ItsJa?bN7E+NO|AUXn1D@jakhiqnDs}UYK?F=L|r^no?WWj zd`sP@3JkXP*4bx4%MAgP@|+(W_a59^zN~GiQAp!XyTs?66SCm+^71txOQ&C$t8BjQ^MbKbo5-HRJy_TU0(`a%Jo1KF4FgUdWtEeg1t{rBJMg+dwP z&(r18mXzy*;YB3@*PrKxu9XW}84y%BWSR8OkCuNZrU~4dufATHN>wJ6WXB>!gFuwr z!g}2{)8%i>XD+spu6oF8ZA13KKGnf=XrrFsN?F~#HrL$2puT#+Y_rdY=GYIass(`2dH<^oidwc>^Q-1jjdf`UXu3tF*?y?Xyl=>*v9D zL?UU%WLX>+;|6E6&}&4Pi#>0UKm&i-o?fmCsBX0g^<%k|hnj#ySg z?b}bNIrx}19PGz4+vvL@t{3;0EFM4BE)1Cc={hNpHsiKV9upVGl-SeHGE%FmOC#Ve z^eOc76H#%PzCbm%4&70ZV$`i0pP(R=nR)g1Laca*0!#VdKjf5L3v&Ux);v?;q^5Ll zQd)VbUV3iD${6PU_%YXb>8R9wPlOiCvD){80USSXkLOvz;Tk@p_6uv2XOqkPA+15R zhZ=;#pSKIude1`rHr)hfVsdP-hNh~HyRcSIiH1An>pk6}?){fZ>rlj%P_tw90vSr7 zoRQnZRKe5^^{^Z!`ExivmhVj^M{Vs~oO`WwJ$bA9U)D+p(w?wE07$TV$%?vkf7{o4234&;b9W9FM zlp?S?3_=o-MHAEX*VlfZ*z`Ov)<>4V!M_O#3X1qRPmT#Qu(B>q#xj?b3_KtQm8+kr`;_wXSNnER=;^1DvZgrQ?$p*yj8rtIy$K$4 z_-zfB#LE5AbQE1Qvi`YPYNdJarJ$$xi7NOX6)3U|A0QrkKkig){XgxH27xa z@>H$jB-nVX%gg?}rmu&0B0A}@$wHoGEiYI0_uG0qeQJZwvC(G@rbghY;77w~(yot} z^HiIkT$o}JNEp`Wm<&kjlQpu)zTk4Am231CfmOOr)@^Me9h!Ap|24~MO|`~HdCy=x z%hzElHghF2A^5{zzBD0=@>M(WmAk)0<%~BWgV7qjqvp-!Zx>BzFrVB!_AqPrLGy9m ze*HQ!bS;P=)^3~PKy>|GD00RIKf2Iogy4DZ?{Fe=Dq(Lin0_5uIoLRCl$LT6lTl z)i*mkKBzEUuc;|+Xl{MCXJ{2oyBcngr zr*g|}{SREhq3V3|OhFEDKwWEh-5|8G9=pJ*%QpkRY}vyTDOB&f9&W=*D8Yh23J4BY zB@%Y8X_#}5j`~wlglI4yuA8pw7#wI+<6hF>I!Rf)Z1i?7HxdS4B3WQ+pSSXuC3e!6 z%V{|jZ??jfmHpi7*f$L3yLFZX)`Eq_$0om7otk-OIZ|{8WH0^p_$uVrsdEXF=;5I{ zqs(oQ9$bcoKr_S}ThwOMaSDF<%GxK0$g#** zW5P->HZxnmXZ6h6MQa1fB`=3fQ}cj(E1EPb-S&zSqWC0&WZ_hd^(QpdXgxGSL;>}Dob z-{Q)$(aL^sGvC|CDh;C|_riqF@zcQVaA-G_tsvYo@%4c@Y z7kon%u2zsS>7BUFQDQWCaD(J|Zlv91gdeYr0J!ix94EI5NxXM8PLyx+|x4d~c(^Ki{`N!VE zVIAnFF%xcGws^OujSM{UbP}`Zc^GEy{%vcV>4@S@zrzbBvz^p6muQesxh+_k3L_JH zEE;r*8K-fYoOdOUyc?DKjyDll^!Eq<4kSx`ru4cvTHo7q%v5@5+KF8vEF>f(AmDwv zGgI%rEdUbsY@<(Kl`|wfnP?}jFs7eedX^2Hy!c1S$4Udc{GbS@YKzqm7#G7 zg@%YpzG7^~jKBR>_6u<(0sAzWu)cPdus`mRSOYudh%5 z=5$JGYG0$Pi;IlEdwlZjPq)(KWVv5KYnz->AOVj%O!UCiJw@# z^yXn=J2}b<=9ct-d3>^6^Wb!lbXLr%BRT&&19xLMtkgMg?N=}s3d+z>LTFT!!)P7> z^a(ybKDEQ5rL?i~Dm#xY^7~$T-XW<$0m&-#mDx{vo#Ec}0d-Dm*3CS8Gsbm27X4Z& z(%rnUZUs8u1R41T*JK4I7JbH7a3%9vMVDEEQ zsk5gNMP=qO6^x9!uA;$%ohr_Jv=)|n#NIS@#HDyqKXeseMEz;+(Kd4tdj$Ck)^nzI zMGHVJxe8lW(^Xz?m!m(Y&gxeA3PYLsPD&b0AyC;N4B@3EYRBzlKDNi4&az8%4g+Zw zqmFE8J(59ZXAe$Js*si0+4?Ff1;!dPb)}xiM%z<6uov;Nq1|n51D5vxOq*K7U?|IQ zj$ES1_0b6El((0c6YKc+cx~;_M=xh*XIooaS!C!l0b(4S4~I0FTwY(9enzixA0{o^ z%Jv&orDqo6G4QI6(JJk38vCt=i5w8FYlnmuwG*d*KthyudJhENynFS#KwYU&uU!JmB*S5q|-X+1{5Mx zt={G+ri+N)oIQtL?JY%#;!+8H9U2eKtN9%WM))9aN##qf+0S?wwj4{_&+isJbK+U! ze-_aqG`d0!u{jyki_)2IHc;aPi3nb^l=}zcL{dHC0;2||oILUb6g8ksGF!X6uF+oV z#GS4Zrh!7)d3pV2uhjMHaTcb~Q0up5UCJ^t=8eU&7F-Z-vs))P#j9;+3f2BH$DcRb zKP=T8N(>0DsyfiEUQ|)}BMUd|cx0$YYf^4$*#0cRY!_L3y5F8ed%{K%9-gL%Pe#@~ z^Q)EPH4Fqd|BEB5bP+#P!+8ZW&)vpTohn;?%ikHVgYLuaXX*lOZ*rzuvmE`=)TjnA z_2qqv4Tdm72{>L5f6pFNxD7Gf|NOt~0VeFs|#b-wJoosctcX; zA;-B;`eLGCHNNuUe8Mh{rMmwyByRk}@nElS!M3?POrZGhWhNntI2H|~rUc9t%BjdQ z?vVD?YJmyGfOLpTKPqf?w&_$S)@5Jl4Hgl`z4(m_bP5UzW@ctNO_aSDiA*a(#_Qya zm@v44dyKxtdbK6tLuon{!}>zv@MGg_0&)nGG_QAw`pS!F3~nwi$|q0y;ECB%xP~=* z&~#cqU*D9}tv)ze;GYMnd4WA%Xk%2JSy`LIMH}?k}Rqc5< z4#{{;bk{x+A`C>B>^0JBLWhSPKW)PjMN>r1Nz;EDnVJFsVzWAbCb=|4%Z9DAf4{1q zVuFjEUydw2P73B(haw%b}QZ7o#rcibw2MI z7lhIlEa}Y`wV)?K9^ur!D=pM?;IkuFs+#Wa@7FFjsaMHo@=^{&#OV~*dL7yie52AA z5adF288W$EDzH_oTr@72Xfx=;pHX~-aQ+ig*|R>4JbNYxQS$G73B9`MG6W^qOV9a4 zQ0P#QKhC5tlw%N5_J8B9Om|&nKdqS)aZ3#~S)PB#kfWmB{5t3c?S8^$b}@vhxTvV; ztmb9FZ5>nO_*C!Flk9kFbA_6b#utUJ?Iy-=ie!rsn=&kHHHqydg62MF)SFLS z7yowr)qy+XZ%bY`;qS-Ra!=ky)C&vJ!z`J{6eqXT-qE6|*_b6!fBuoyLyIXSO zatI=ndBW)CvEh&b0A>A>J99ZU-EAME!ty?QY|<;ngsz=zdrGc(?VDf|2>YH*^yTta zkEb{!)YkAhom%o;_nn7)dXle`z5CeqkVW-i8eO|X14l_d-ppRB*?6@q^ZL6= z4|oO`%h^I88LBZ6fbN9yt00S<%j-t~D`0UWMajXs+(q*aUW(!t2 z$iQ@~cH97H^ThWP{+rj_JamC0SSue~JiEAK@cc$$w5Qpf-N59+cmY=FvU(GA30<$m zbN?48d-E8^^YZPll2l_RGi3kcSP@F$$k3WL$|AOR$qaQ6NL;M&@F$HM+mcVpHri6b z401B7ChNVzb)Hi4Fn6wniZ|AaIn%Bx#_O^u1;Jc>I0C8mOF#6pMX;Y`ML)l9H&G)8 zW?5}jzIhAx$@pAn=Tv8>x93_*vqB1OmixAjhBGF})jbM0vgjB%YRssef z85Q9l#MD&pEL zY1C8L)>C;kRDQlfUJ0*Z|1IQtd%@_00%0J+QMe`)z50yP! zp?R7^Y=|5Fn6tBWq!)8Vg-Zf!s$Hc?7#8GJl9BeG%_NJ*w{Q;FGgi3B&ZhvPV^LU) zB)t(C4NZchF#0PAhGgWIFMDU{Uv-(x8Wv);a#SwQs{@YKWVWYx!`XIMSL2hCwzsyV zVM$4oCgq`_WFb~FOqQ*`#)@^(36zt^2mH10$D8!`!qqok(C2!4dz0A}C}(@GuO|Vb z59Yc(wXG6w_Y+&e$mqJI<)VaF?;Cv0n2RK?1_HU--KZg6wo0<4C1@k;D`Q#LJ~;i7 z2d_MXWRGz!lFnhoF^vzwTe3RtsvegVlk1SwbcKtuJ%k4{^Ll%f6xpBw50`uYZ&uw? zrucJNvzt=gUz=lxD^t^Otl6K()qHl}h?JB02AIi%Bnv*cO2))_qf)NB4E-;YLm%txZlX#z2y*Cdl$?>$c&No zlbuVKs~Tg;ZR$uooZD@W*pIhe5mX1uGBE&~z=eX?_3KE=J%kanP5Nb$*>)p!Ab{A7 zq?l>%EZ?_}-`b*NPv-+AX?Aw0?YSE|f=ZyMS&3n9-)35QOqSQ7 zrgq;|?IvAKC!qGKY-hT_zs6kDgV^!A2ZO9UMQXlUJ~k0Z)w1r%BR&+a)S2;~yg>Eg^YNU-IEW;#1%BmOM!&_kUfr zT?yC7PMFjpDxa+N5{qW2G`*SU`;l&q0$D);GD<_Qv7Jy$XHq1z&M1Z^XME$C-Ud}O@IUfdxu=@jkJ+ocU)J*g7=-;^zTbD|6@YV zzxk=NDCrlR+@$}=LpRUyKMf2NmkEI8WfX}2-;t62&2RsA2O%)glElg z!-Fb_vj14R2@v#gC9pkcK_v@$gz2UdhM9?yA^Xa{j6mmXtd8B{fxWKUSO9hBr~?a=aL^a9Jz5 z;aW#%!6`QMld0u9Adbm@;P`EazkE@CU^V;`!Az>;Sy7rK3%BvS4CJOqGHTK$@qTI0 z$K=tG*T=JJoKku4c*%Zf@FBsJ?6E4Jpmv>P;6_%z^Zyz9>!jhOTF4t>rIFYokNpqr zI1zk!i3M#sFgN6mw?^!ppb%U;sk^U+jRk7FKcY-6O>RNxe~Xci`qQmJhn@Fa-R4L* z$S%!H*1tYbY6GJ70RYqo0iq(_YN0_vsY(p4&dz7PQ)f679`P^3@!&e#S3yI|RmW&^ zYwqiRc*QUOn`!|hZawN&;Ry(Yvi8mk@cj8v#HWktV)Nh0sSlhCB_C(z8o$5HA0s)U z=Fng`$r3Zvl0P9N^=RI$&$jluFIVhG!M8zKdn>)LO*YP}{qPj7#d2&#I4aDvvAcLO zxJFSiT)mN1n7mcUk^Kk|Jw#`c)xWToR|~BXR!Py(>Xle&^_>{P&|C7I#i{Qhx+6f~ zW7n#g8s=B}r%+KE_BPn9#$#$pvy@;C;M45LgBN9s#pQf=DR*6=(r?J7qY+Hn)28Fy z|6?bRU*?(v852udxlc_!1b9vhi&ba#8KhoJx<0ED3H9OM(v3ek`raGIr51jC&ZBB2 zPJQEz_V#QK@v=(0D34E1wVRD|jnCnmRdbPo6=sLdJADkGvb-uDeQWB}h)u<{uw5MTHNTmb z(dFk*w$y2XmlKb+->;Ss3=d~31KJhHubc;M`9SCwuJQ0k43@P%Blj9%lFfV}1GLu=CjIMkMfFI=-U&{JTG@Rq<=gBkUP2&|ur!YvUQ)du}FiaAbx;$9f z3=$KOed9X?m%F4A7T~q}lP8~SPCIDwA&nN7_rX1Peh<1|gF89wM8#7_!dI&r;->Qy zGbLS=D|}?6K2t+Og=;4`BXktEPS)DEQ@*P;jQ0H-L@32XaJ4%i1}{Ojg>v1GwJH*D{LZu9~xX~JM2zb!#jIB zcY)dmx2`3fAsyVjK6&j`?`$YwljxFspWUyGU`;(}`b$*(SStO6Lz|5L)2CSe0 zt55_`en34lObYnyo)ih?u^|ENyci7=wwvaQiV*r!KH}4tP|6Nw_jHH0dxcLjvb@}5 z`w3dju({;gW9r)$j=sLaapqBnpQJQEJ2^m9B!W%%yG+?4f!FDmyHmXFRL$G=ZpO&u z240^*l{T-8t0cXdeuHG~^0|74xdyk@i{pT>H9*XIH#VskJ{5WNZN0?Z&VwdKmKL_W zuwZU3RRD}LX8*ySepygdx$jm~dhAqv0aX@tptf>F4S5#w>^~}qzD*8v)Yo8iignQa zj#t{bE!aM%@2xBkNhZE5TqcyD2{Dc!cN6gY$1yOvd{C;?&||=7i#%_8Uv_)x>pMi1 zI)k+KJg;P{GjWPP+L&CK5|tvP7EKj&Fmrbw{FzfBSCqMTj!CBptw5M-5Qo8lRND+x zZh4BtE8;3I0Ih|Xm(S(cE_}Fketv84Q=OV@GIEn3!6E4%gznBwminK@KL+xi9Or0gT zDZywXtz@>})!Af0y8q(~|7JpqeFCnUq0F{iAYPQrJit!8A3-5#JAD$0L^h0$ z9)YUB4LEL=>;4yd*Pxg*Sj_*bw1O%AqBovGT%0}$Y3me!@1FZ)C5)Gt{JR<$wb-&1|vzrTLf;V5t^$zev%BLQRX3lx`fts{k@11wD2=9IY#jj3*KX`f57?pZnHg6|9r}6FZ70 zerA28%x^S!-FhbyiZ6lvg1Ov3w$WCv*|YT*2Yq5E_2;yc^GYW=sIDF@#W?FXXh1x? zKV6W!xyHY?4{L;qv6R!{1+G(pFcp$nS{Ie`Gm#VRSWTJgOJ&>m<(5od|$r z7~n#@++G!`lDH%NnhYf2HUeK@Fgz9MLgn~C zTG0|DnSgB|__*gIF2;IyTkA9Q$*PfYok$&XQ~7rD)xQrVvVMO)C$oa&Nq6Ini4Ew0 zzS&%L?IyG8W3&_kYSqE0uVI_44l%(nM!#|49m{vBNjSx2$guFhRmN@mm>}Uh%zOXr~8_( z6EYFEaTKw&{!#y$p<%PN{e(pyJ&rVAtzg)aMPEYwJyIzwBAI9M5A7?n)}Jf{Gfh;c z>tamOqdi0kY?)f#ja1KZAosg*;`@qiZnf%w<{xPC42A~z+Qxwmy+SLcZD`K9Gd~z9 z*qJk2dRVzT^6cRAPFmfC9!&!FTs`C*sKq_m@Arn^%?v0fNlXGipGAWMEU? z4p#5p7XNLkZaN;D3>O`*aC~iMjI42rw-!`-{1ggNGj8-gUAQ^g8S&6s+XM1jZq5&# zy1b3GHOe`ERsW}pCTMajBin^v`wBO7Yl;#dUGH^v@i(9@-w!O-WM*cjq=O9zNlkv2H#e6KG?=)!JBZSB>7%P9)4%;m z+S=N835$S`aB*ct0>;uu#qYd4ny<>w&)?M4^r%rZN7;n!9*`*@rD%-?>GAQ89@oyz z-8RRbml`&gyY`sSOG(j8!F@b_Wq)K&V5QBX?Mv96t*}_T+=bdqEq4x3q@|@<<>!mu zHvEv^)EFPGKx^koSh={lJ+_cNDr1zojzR^ zMSh$a>|VF{^;U$u$u{g&3&y=shYRZv-ITS72IxJIMokL3^XxS=#^V@O-*RcgV6eAu zm*-o9u!gP=heYk{>{bU;8v02h;yy)!h33Lc3`IJ1O7GvuY=Jo?TVC? z)Y_BXzk?JPH#EM3-2B}A1H`D^TNH@ra`811k2?v`1 zJ;L9g0va!?{wzMB$dWcB0ce9xM5zL9KrYmtYx2Wl$A9uf*sPa$$0?(=wN);W4am8L z!#{wV!ehP##r_=h*8k>w6?tH9Z%8^*v7%k+ndYD z?=mnRo4=ZZ?mJUeE+55ykU{O=RG1HhGVt?zU7bZ?Cl}*FjsDh01&6#~THSYk_p0S* zk+GIR?#ScMyu@^geH9fIk>uRm+{MMkwN}i`h5h|+#4pQDyMVtXF*P+cJ>B69GT7by zMK)*UC&fyJbCY2_i8ES@&9A|6`}vlewh$a>C9#O(=GxlVBbNLs3p*O`i=+JPSRw*# zZQc6XS_z5N=ulc#9iF*z(^U{PkTWy2rqf`Jb6fa!{M-U+eq!mFQ(tLvSa(OqO0q+< zQ?YV(md8*QSqS4f!&&(GR`}s_=IM7XK0cRmam1R4)qPG{THvJXQTlEymOb3P;+*a7 zr0DxIS;IX&&NEqZ(9veX$VE-ns4yd0HvU?-||*VUbV{~k3AX0q1!^O_Hv z$<8=_eDhWxCF5K7;NZF4u84z!L#&IS`&ya#%v9y*D0uMNAl$Zor`b4=jM`p@;G_yR z%D_@*x5!QoznQ-tsL{qEW%G~Qlg=F>h@S7bEf)4}sBm8Cm5L$+<{c^_&oZM08gbI# zsISCOeF;t>A;T}B&k~Ha(rnbfpU(QQ3khAVkK}@)4`}Q&^&Y$RyG?xqG+7@$+)Gu+ zRmmSr6j*u1t`Tb;0z0#d-&mitpI({dtXp)z0f4I7{5UPff|)xr8Q zBW$$9uf8?tz7z0FzHYXknQAiiq1pId-c}b$5%m6>bA=8ZH%-vNz*$xnn1FsLq+T@C z8#LaFFakz_p_mxphZ6gU!-{Aue1VC#d)VUG#lkfGK*h)?LnU9Y+22o6GNiH5ZzxR| z4Gj&)1&{KjTma_XIZAQYFH>CrT z?h>7R=OM?tk*9k&1?EG;R8T9fLb)>6XLRkIjE^vbdsI;{1+T@g{SB}BL$_tNT0*xz zv)Lk+vnd{_F5KELwub@76A)q(G7+02BO?^!np$;VWM2rM&rW9d)niYXJF|g7g~+z7 zGFx@An?4W78^VxbBEa}CYP(qcDZjW#ZF(0u=H6xa7%)n&9(v-Md7N=op?+edA3Is9 znA$mGzGFr?J{mJEbr6`@9B+&zu(g`h^r^D`g99K+UJ|K7#_NQE_fSz3Qhg#hJw+rK zpF!1V&g!v(7lH~@TBlK3UfbufbovVg9z_8hp+*ybxcGkK;Sx?MXR3nc6MG+>kUL_m zp8%5#uA?8k^9?&EOO2`UoLgV+&dA?F3DxWg`k)tLd}o_!2oLfCp1%{v?`G8VZ}(@| zbpj=`djQs3}>gIx6CGF zK<{bxG$Gx)Bh{2pZJ0ajKYx|BT^EC};L!&GaQ45oW8V2VWxte~qzjGZjgj{mL_y5t zp5jaA5PE2aMdH{GDr15;3HiHRIB|*R45qEI5zQX|NC2$y|I1hmwFtziR7C*6u4Qi+3~Bj$5-F*lCABX}TWPoaV3K!%T#RlmNEbAd-@X<=cp?hH6C z03dwzQknzw<0WnE;vMc@WB*{uK|*o*B@~}LL#Mo=0)z@0n$*Fw>9|)5{x_Gm#HJ@ zxTgiQyl@4ySI2QFDOa1N&9lt`hA#+dqQcS;J9grt;Ea-Rdg)8SnFhl`$rs`Ii#;PoZi8 z#)Z{2^@z}BBDaImnefCS-b%dx1K!8%E8O<{f~d=bUMSSvu`Ky! z{HA|CX6HIZ0^nVyAt^attm_2m3h1}{ftnpZVJw_RpVK^^Y=|S`6yE^{fR_aR|;P z;qV0KuE#DxFYnakq`Ac^X7I0fXx`YAzq2i+0;mLr;c|k}(r!mt-YLVCp-c+?^d07xQH#XsT#Z-FDg580BDV&dY!H4&PZ zkzoYTN5JhhlmPv~gVRk!)Md30fOW&!Qq)489JI8wEG!Wew)6hqu$hrX`%7IeSY*Za zKS&SFD7?=07Se=$09Lg$H6_Bw=KwdS0mX86^mAopWx!A4Q1Ah#T3%#i+=|u5^U`*NA6p*e;BZ)U-se&Ho;Lr)6 ze%SS!G|ohSYOn^?gpu>65D}(1jsQJ+ea2!L92~i9oW9=FPR9%u%l-_EWwZ4jh^!IF z9uubDMZIV z(DV)s4fXWogMqjm%X|YCYYtuX6;!9jcxez%QlUhD+OKz+GvLXzx+iD!nirjsc2!13 zVDiqtoP#W93w=ugsYxg2r;@sC3=A*bulfaN1Ru+zy;8P@>!?SFSNP%vY`eIAW{0-7 z;P92T6ArJaAD0#t1n?I5J8c%IG0`vy&A@FmqovhK4TSB#g>H-$CdR~=Xl3YD+asln zfc2}yps^P&B_#z0Os^ENd3-THKYzG7M3JyNoc&RWfoJkbx;JL&zZQgY;aGltKA8Bb zsw#kN7s>D7NWLn4rcyV@8!!N-CMIvj@rj9DPqwt}FMv~fAQ{R&w$U+`J+jVp!mc(J zau*~18}Zyu{4yd53+#~!b9qggI94d?Rtt~yOk2870h=ISb9ls6V?UE_v!#K><#6O?C z8_;PXC=y^h9jMB)C4zYCGLn>(1ni*5%J_J7b8~YmpXKa!gR?k!SldTDQO`XiPtTgd zLK{$vprWFNG6)Md?xBP(`me%m5T7F=M%P`%GWUSv8vypdQ(h&wW~jB9f0EAjLk;XUZ&m{@DQbn7`yu_9TaVG9mj>6P2aF?eKBPj>B>44UGxeNrxvIfjIWCq01(E zL>Qyf(p4@F5qYE}TcQg)z_02|kD$1jD*0R6+u>}6XF2ClV~f`FlX6ZY_it`)RDZk~ zw&c+)(VMKYo4z_ftc_Is#?!OB{WpT|PnmHWNChunz8nR#pQ9|v?O6D)HYr)G=2BUD zSFM0drTHa9m6zjC=5Di%~chZk>wfjD!)AJ;lqalsR}tNAV>@j4Mo{F3}nMC`Vw7ST-*foO-vR;a40@aONW!N zmVj`z@GBUM1UdP6sl9XJztSRclbG|=sME*~5yksNqExN&l@8RtOH-U}T;g-Pnx1ug zateS3zSZMb(_{Cz5jL}A5dtxqjB0LpE@gkWiF)Joa?!#b$7CY=aMto*80Szo?WGe9 zf!{$7J-~@f$i$>|v1qz6F0MmPWdPb0OzSsTXvN{ODF|gj6>gar{uJ-6l zU=5!}2bE5wWNd8g(&D0t<#Kb~`8B%8*M
>t+@^~cok*EAiIx$0=ok62RpZ#)cr z%io8Ru;}Q8OyA2RbpBZpD*bGT4M|3ktHwa=TcRRTkZ#{0WE(n=lhs#v= zmc}?wIm3eut*ih{^)eHjcm*TOhh>kyH8Wd?{;E`5<}FOX84;$-w=ar6yAwXa#a1Xy zyHa;;jd4fvIHQpjZfais9jNb-k*UH&4+>CL5-#&@l#N$}iDmAO1tC{u&CXgtIEUxR zdE#(lXCpTM11fid(*Smkj&e{a0*R!QL!c^Ul7+;}s!5Q`iLeu9T)eV}n6k0q4k|>* zW{<7Igs6wml*Tx*nTa>P6UM(XS}dezoA8NTcNL&4V0g5ApW_`t*|^4eLJ4Yy3O)u| zq~!B>SwK+6gS<^cvqU&mT$fD4c`@c zbdKX#{eG_`D4av?&h61c383>yjHuinI$GNJ6BOwczrbu%+>E$WGJh|JxvSDp&; ziyfxWKvHnjHjq$Dmvh#w9kv)litahH@D~4$*Zj|?Zvzw8Dm$TEoS<)j1Wa5z?npz8 t0PXt!=GfB@7x8x*>aA|z>tC&$-gf<{hAgTVB-}MeMnVBrB4+gde*$1d?VA7q diff --git a/lam/help/help.inc b/lam/help/help.inc index 0d0957b6..a96d14d9 100644 --- a/lam/help/help.inc +++ b/lam/help/help.inc @@ -155,6 +155,8 @@ $helpArray = array ( "Text" => _('Please change this setting only if you experience problems in receiving emails from LAM. This defines the line ending of emails.')), "244" => array ("Headline" => _('PHP error reporting'), "Text" => _('Defines if the PHP error reporting setting from php.ini is used or the setting preferred by LAM ("E_ALL & ~E_NOTICE"). If you do not develop LAM modules please use the default. This will prevent displaying messages that are useful only for developers.')), + "245" => array ("Headline" => _('Encrypt session'), + "Text" => _('Encrypts sensitive data like passwords in your session. This requires the PHP MCrypt extension.')), "250" => array ("Headline" => _("Filter"), "Text" => _("Here you can input simple filter expressions (e.g. 'value' or 'v*'). The filter is case-sensitive.")), "260" => array ("Headline" => _("Additional LDAP filter"), diff --git a/lam/lib/config.inc b/lam/lib/config.inc index e84ef2ad..ddcefb0e 100644 --- a/lam/lib/config.inc +++ b/lam/lib/config.inc @@ -1400,6 +1400,9 @@ class LAMCfgMain { /** list of hosts which may access LAM */ public $allowedHosts; + /** session encryption */ + public $encryptSession; + /** minimum length for passwords */ public $passwordMinLength = 0; @@ -1437,7 +1440,8 @@ class LAMCfgMain { private $settings = array("password", "default", "sessionTimeout", "logLevel", "logDestination", "allowedHosts", "passwordMinLength", "passwordMinUpper", "passwordMinLower", "passwordMinNumeric", - "passwordMinClasses", "passwordMinSymbol", "mailEOL", 'errorReporting'); + "passwordMinClasses", "passwordMinSymbol", "mailEOL", 'errorReporting', + 'encryptSession'); /** * Loads preferences from config file @@ -1449,6 +1453,7 @@ class LAMCfgMain { $this->logLevel = LOG_NOTICE; $this->logDestination = "SYSLOG"; $this->allowedHosts = ""; + $this->encryptSession = 'true'; $this->reload(); } @@ -1516,6 +1521,7 @@ class LAMCfgMain { if (!in_array("logLevel", $saved)) array_push($file_array, "\n\n# log level\n" . "logLevel: " . $this->logLevel); if (!in_array("logDestination", $saved)) array_push($file_array, "\n\n# log destination\n" . "logDestination: " . $this->logDestination); if (!in_array("allowedHosts", $saved)) array_push($file_array, "\n\n# list of hosts which may access LAM\n" . "allowedHosts: " . $this->allowedHosts); + if (!in_array("encryptSession", $saved)) array_push($file_array, "\n\n# encrypt session data\n" . "encryptSession: " . $this->encryptSession); if (!in_array("passwordMinLength", $saved)) array_push($file_array, "\n\n# Password: minimum password length\n" . "passwordMinLength: " . $this->passwordMinLength); if (!in_array("passwordMinUpper", $saved)) array_push($file_array, "\n\n# Password: minimum uppercase characters\n" . "passwordMinUpper: " . $this->passwordMinUpper); if (!in_array("passwordMinLower", $saved)) array_push($file_array, "\n\n# Password: minimum lowercase characters\n" . "passwordMinLower: " . $this->passwordMinLower); diff --git a/lam/templates/config/mainmanage.php b/lam/templates/config/mainmanage.php index 9441d78b..cf7ae048 100644 --- a/lam/templates/config/mainmanage.php +++ b/lam/templates/config/mainmanage.php @@ -104,6 +104,14 @@ if (isset($_POST['submitFormData'])) { } else $allowedHosts = ""; $cfg->allowedHosts = $allowedHosts; + // set session encryption + if (function_exists('mcrypt_create_iv')) { + $encryptSession = 'false'; + if (isset($_POST['encryptSession']) && ($_POST['encryptSession'] == 'on')) { + $encryptSession = 'true'; + } + $cfg->encryptSession = $encryptSession; + } // set log level $cfg->logLevel = $_POST['logLevel']; // set log destination @@ -263,6 +271,10 @@ $securityTable = new htmlTable(); $options = array(5, 10, 20, 30, 60, 90, 120, 240); $securityTable->addElement(new htmlTableExtendedSelect('sessionTimeout', $options, array($cfg->sessionTimeout), _("Session timeout"), '238'), true); $securityTable->addElement(new htmlTableExtendedInputTextarea('allowedHosts', implode("\n", explode(",", $cfg->allowedHosts)), '30', '7', _("Allowed hosts"), '241'), true); +$encryptSession = ($cfg->encryptSession === 'true'); +$encryptSessionBox = new htmlTableExtendedInputCheckbox('encryptSession', $encryptSession, _('Encrypt session'), '245'); +$encryptSessionBox->setIsEnabled(function_exists('mcrypt_create_iv')); +$securityTable->addElement($encryptSessionBox, true); // SSL certificate $securityTable->addElement(new htmlOutputText(_('SSL certificates'))); $sslMethod = _('use system certificates'); diff --git a/lam/templates/login.php b/lam/templates/login.php index 50fa5c4f..7b7b186e 100644 --- a/lam/templates/login.php +++ b/lam/templates/login.php @@ -125,14 +125,15 @@ $_SESSION['header'] .= "\n encryptSession == 'true')) { $key = @mcrypt_create_iv(32, MCRYPT_DEV_URANDOM); if (! $key) { srand((double)microtime()*1234567); @@ -651,5 +652,5 @@ if(!empty($_POST['checklogin'])) { } //displays the login window -display_LoginPage($_SESSION["config"]); +display_LoginPage($_SESSION["config"], $_SESSION["cfgMain"]); ?>