prehistoric-systems/mytinytodo
1
0
Fork 0
mirror of https://github.com/maxpozdeev/mytinytodo.git synced 2026-03-11 08:55:27 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

generate csrf token before login (fix for 454ed89)

Browse source
This commit is contained in:
Max Pozdeev 2022-02-09 22:38:13 +03:00
parent b9dcd9071c
commit 28439ec79c
3 changed files with 13 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
src/ajax.php
View file

@ -310,8 +310,7 @@ elseif(isset($_POST['login']))
if ( isPasswordEqualsToHash(_post('password'), Config::get('password')) ) {
$t['logged'] = 1;
$_SESSION['logged'] = 1;
$_SESSION['token'] = generateUUID();
$_SESSION['sign'] = idSignature(session_id(), Config::get('password'), defined('MTT_SALT') ? MTT_SALT : '');
update_token();
}
jsonExit($t);
}
@ -319,8 +318,7 @@ elseif(isset($_POST['logout']))
{
check_token();
unset($_SESSION['logged']);
unset($_SESSION['token']);
unset($_SESSION['sign']);
update_token();
session_regenerate_id(1);
$t = array('logged' => 0);
jsonExit($t);

4
src/index.php
View file

@ -23,6 +23,10 @@ if (!is_int(Config::get('firstdayofweek')) || Config::get('firstdayofweek')<0 ||
Config::set('firstdayofweek', 1);
}
if (access_token() == '' && need_auth()) {
update_token();
}
define('TEMPLATEPATH', MTTTHEMES. Config::get('template'). '/');
require(TEMPLATEPATH. 'index.php');

7
src/init.php
View file

@ -150,6 +150,13 @@ function check_token()
}
}
function update_token()
{
if (!need_auth()) return;
$_SESSION['token'] = generateUUID();
$_SESSION['sign'] = idSignature(session_id(), Config::get('password'), defined('MTT_SALT') ? MTT_SALT : '');
}
function setup_and_start_session()
{
require_once(MTTINC. 'class.sessionhandler.php');