lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix: ouverture d'une session temporaire de securite pour stocker une de cryptage alatoire pour

Browse Source 
encryption du cookie
This commit is contained in:
Regis Houssin 2009-05-20 18:18:25 +00:00
parent 43ee2c4acb
commit 3786711822
4 changed files with 196 additions and 197 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
htdocs/conf/conf.php.example
View File

@ -148,16 +148,6 @@ $dolibarr_main_authentication="dolibarr";
$dolibarr_main_force_https="0"; $dolibarr_main_force_https="0";
# dolibarr_main_cookie_cryptkey
# This parameter contains the key for crypted cookies.
# Warning: This parameter must be configured with multicompany module
# Default value: 123
# Possible values: must be a integer
# Examples:
# $dolibarr_main_cookie_cryptkey="6589148567895233654";
#
# $dolibarr_main_cookie_cryptkey="123456789";
# Parameters used to setup LDAP authentication. # Parameters used to setup LDAP authentication.
# Uncomment them if dolibarr_main_authentication = "ldap" # Uncomment them if dolibarr_main_authentication = "ldap"
# #

15
htdocs/main.inc.php
View File

@ -117,10 +117,19 @@ if (! defined('NOCSRFCHECK') && ! empty($_SERVER['HTTP_HOST']) && ! empty($_SERV
// This is to make Dolibarr working with Plesk // This is to make Dolibarr working with Plesk
set_include_path($_SERVER['DOCUMENT_ROOT'].'/htdocs'); set_include_path($_SERVER['DOCUMENT_ROOT'].'/htdocs');
// Security session
$sessionname="DOLSESSID_SECURITY";
session_name($sessionname);
session_start();
if (!isset($_SESSION['cryptkey'])) $_SESSION['cryptkey'] = mt_rand();
// Set and init common variables // Set and init common variables
// This include will set: $conf, $langs and $mysoc objects // This include will set: $conf, $langs and $mysoc objects
require_once("master.inc.php"); require_once("master.inc.php");
//Fermeture de la session de sécurite, ses donnees sont sauvegardees
session_write_close();
// Check if HTTPS // Check if HTTPS
if ($conf->file->main_force_https) if ($conf->file->main_force_https)
{ {
@ -449,11 +458,9 @@ if (! isset($_SESSION["dol_login"]))
if (!isset($HTTP_COOKIE_VARS[$entityCookieName])) if (!isset($HTTP_COOKIE_VARS[$entityCookieName]))
{ {
// Todo: utiliser $user->datelastlogin pour un cryptage aléatoire // Utilisation de $_SESSION['cryptkey'] comme cle de cryptage
$entityCookie = new DolCookie($conf->file->main_cookie_cryptkey); $entityCookie = new DolCookie($_SESSION['cryptkey']);
$entityCookie->_setCookie($entityCookieName, $entity); $entityCookie->_setCookie($entityCookieName, $entity);
//setcookie($entityCookieName, $entity, 0, "/", "", 0);
} }
} }

4
htdocs/master.inc.php
View File

@ -136,9 +136,6 @@ $conf->file->main_force_https = empty($dolibarr_main_force_https)?'':$dolibarr_m
// Define charset for HTML Output (can set hidden value force_charset in conf.php file) // Define charset for HTML Output (can set hidden value force_charset in conf.php file)
if (empty($force_charset_do_notuse)) $force_charset_do_notuse='UTF-8'; if (empty($force_charset_do_notuse)) $force_charset_do_notuse='UTF-8';
$conf->file->character_set_client=strtoupper($force_charset_do_notuse); $conf->file->character_set_client=strtoupper($force_charset_do_notuse);
// Define the encrypt key for cookie
//if (empty($dolibarr_main_cookie_cryptkey)) $dolibarr_main_cookie_cryptkey='123';
//$conf->file->main_cookie_cryptkey=$dolibarr_main_cookie_cryptkey;
// Define array of document root directories // Define array of document root directories
$conf->file->dol_document_root=array(DOL_DOCUMENT_ROOT); $conf->file->dol_document_root=array(DOL_DOCUMENT_ROOT);
@ -216,7 +213,6 @@ if (! defined('NOREQUIREDB'))
} }
else if (isset($_COOKIE[$entityCookieName])) // Inside a browser navigation else if (isset($_COOKIE[$entityCookieName])) // Inside a browser navigation
{ {
// TODO See to remove this later as it is a security hole
include_once(DOL_DOCUMENT_ROOT."/core/cookie.class.php"); include_once(DOL_DOCUMENT_ROOT."/core/cookie.class.php");
// Utilisation de $_SESSION['cryptkey'] comme cle de cryptage // Utilisation de $_SESSION['cryptkey'] comme cle de cryptage

6
htdocs/user/logout.php
View File

@ -51,6 +51,12 @@ session_name($sessionname);
session_destroy(); session_destroy();
dol_syslog("End session in DOLSESSID_".$dolibarr_main_db_name); dol_syslog("End session in DOLSESSID_".$dolibarr_main_db_name);
// Destroy security session
$sessionname="DOLSESSID_SECURITY";
session_name($sessionname);
session_destroy();
dol_syslog("End security session in DOLSESSID_".$dolibarr_main_db_name);
// Init session // Init session
$sessionname="DOLSESSID_".$dolibarr_main_db_name; $sessionname="DOLSESSID_".$dolibarr_main_db_name;
if (! empty($conf->global->MAIN_SESSION_TIMEOUT)) ini_set('session.gc_maxlifetime',$conf->global->MAIN_SESSION_TIMEOUT); if (! empty($conf->global->MAIN_SESSION_TIMEOUT)) ini_set('session.gc_maxlifetime',$conf->global->MAIN_SESSION_TIMEOUT);