prehistoric-systems/mytinytodo
1
0
Fork 0
mirror of https://github.com/maxpozdeev/mytinytodo.git synced 2026-03-11 08:55:27 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

more fixes for csrf token checking

Browse source
This commit is contained in:
Max Pozdeev 2022-02-10 00:41:28 +03:00
parent 28439ec79c
commit ce01ca5bea
4 changed files with 22 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
src/ajax.php
View file

@ -308,16 +308,16 @@ elseif(isset($_POST['login']))
jsonExit($t);
}
if ( isPasswordEqualsToHash(_post('password'), Config::get('password')) ) {
$t['logged'] = 1;
$_SESSION['logged'] = 1;
updateSessionLogged(true);
update_token();
$t['logged'] = 1;
}
jsonExit($t);
}
elseif(isset($_POST['logout']))
{
check_token();
unset($_SESSION['logged']);
updateSessionLogged(false);
update_token();
session_regenerate_id(1);
$t = array('logged' => 0);

1
src/includes/mytinytodo.js
View file

@ -546,6 +546,7 @@ var mytinytodo = window.mytinytodo = _mtt = {
$(document).ajaxError(function(event, request, settings){
var errtxt;
if(request.status == 0) errtxt = 'Bad connection';
else if(request.status == 403) errtxt = request.responseText;
else if(request.status != 200) errtxt = 'HTTP: '+request.status+'/'+request.statusText;
else errtxt = request.responseText;
flashError(_mtt.lang.get('error'), errtxt);

2
src/index.php
View file

@ -23,7 +23,7 @@ if (!is_int(Config::get('firstdayofweek')) || Config::get('firstdayofweek')<0 ||
Config::set('firstdayofweek', 1);
}
if (access_token() == '' && need_auth()) {
if (need_auth() && access_token() == '') {
update_token();
}

23
src/init.php
View file

@ -132,6 +132,18 @@ function is_readonly(): bool
return false;
}
function updateSessionLogged(bool $logged)
{
if ($logged) {
$_SESSION['logged'] = 1;
$_SESSION['sign'] = idSignature(session_id(), Config::get('password'), defined('MTT_SALT') ? MTT_SALT : '');
}
else {
unset($_SESSION['logged']);
unset($_SESSION['sign']);
}
}
function access_token(): string
{
if (!need_auth()) return '';
@ -142,19 +154,18 @@ function access_token(): string
function check_token()
{
if (!need_auth()) return;
$token = access_token();
if ($token == '') return true;
if (!isset($_SERVER)) return true;
if (!isset($_SERVER['HTTP_MTT_TOKEN']) || $_SERVER['HTTP_MTT_TOKEN'] != $token) {
if ($token == '' || !isset($_SERVER['HTTP_MTT_TOKEN']) || $_SERVER['HTTP_MTT_TOKEN'] != $token) {
http_response_code(403);
die("Access denied! Try to reload the page.");
}
}
function update_token()
function update_token(): string
{
if (!need_auth()) return;
$_SESSION['token'] = generateUUID();
$_SESSION['sign'] = idSignature(session_id(), Config::get('password'), defined('MTT_SALT') ? MTT_SALT : '');
return $_SESSION['token'];
}
function setup_and_start_session()