prehistoric-systems/mytinytodo
1
0
Fork 0
mirror of https://github.com/maxpozdeev/mytinytodo.git synced 2026-03-11 08:55:27 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

* Authenticated session becomes invalid if password or salt are changed

Browse source
This commit is contained in:
Max Pozdeev 2022-02-06 14:52:39 +03:00
parent fe6164bf7d
commit c209486c5a
6 changed files with 23 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
src/ajax.php
View file

@ -311,6 +311,7 @@ elseif(isset($_POST['login']))
session_regenerate_id(1);
$_SESSION['logged'] = 1;
$_SESSION['token'] = generateUUID();
$_SESSION['sign'] = idSignature(session_id(), Config::get('password'), defined('MTT_SALT') ? MTT_SALT : '');
}
jsonExit($t);
}
@ -319,6 +320,7 @@ elseif(isset($_POST['logout']))
check_token();
unset($_SESSION['logged']);
unset($_SESSION['token']);
unset($_SESSION['sign']);
$t = array('logged' => 0);
jsonExit($t);
}

2
src/config-sample.php
View file

@ -20,3 +20,5 @@ define("MTT_DB_PREFIX", "");
// set mysqli if needed
define("MTT_DB_DRIVER", "");
define("MTT_SALT", "Put random text here");

2
src/docker-config.php
View file

@ -15,3 +15,5 @@ else if (getenv('MTT_DB_TYPE') == 'sqlite') {
define("MTT_DB_TYPE", "sqlite");
define("MTT_DB_PREFIX", "");
}
define("MTT_SALT", "Random text");

3
src/includes/class.config.php
View file

@ -2,7 +2,7 @@
/*
This file is a part of myTinyTodo.
(C) Copyright 2021 Max Pozdeev <maxpozdeev@gmail.com>
(C) Copyright 2021-2022 Max Pozdeev <maxpozdeev@gmail.com>
Licensed under the GNU GPL version 2 or any later. See file COPYRIGHT for details.
*/
@ -271,6 +271,7 @@ class Config
$a[] = self::prepareDbDefine("MTT_DB_NAME", self::get('db.name')) . "\n";
$a[] = self::prepareDbDefine("MTT_DB_PREFIX", self::get('db.prefix')) . "\n";
$a[] = self::prepareDbDefine("MTT_DB_DRIVER", self::get('db.driver')) . "\n";
$a[] = self::prepareDbDefine("MTT_SALT", defined('MTT_SALT') ? MTT_SALT : generateUUID()) . "\n";
return implode("\n", $a);
}

12
src/includes/common.php
View file

@ -161,4 +161,16 @@ function isPasswordEqualsToHash(string $p, string $hash): bool
return false;
}
function idSignature(string $id, string $key, string $salt): string
{
$secret = $key.$salt;
return hash_hmac('sha256', $id, $secret);
}
function isSignatureOk(string $signature, string $id, string $key, string $salt): bool
{
if ( hash_equals($signature, idSignature($id, $key, $salt)) ) return true;
return false;
}
?>

5
src/init.php
View file

@ -116,8 +116,9 @@ function need_auth(): bool
function is_logged(): bool
{
if ( !need_auth() ) return true;
if ( isset($_SESSION['logged']) && $_SESSION['logged'] ) return true;
return false;
if ( !isset($_SESSION['logged']) || !isset($_SESSION['sign']) ) return false;
if ( !(int)$_SESSION['logged'] ) return false;
return isSignatureOk($_SESSION['sign'], session_id(), Config::get('password'), defined('MTT_SALT') ? MTT_SALT : '');
}
function is_readonly(): bool