lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix: Add token to the url logout

Browse Source
This commit is contained in:
Laurent Destailleur 2021-12-31 14:33:12 +01:00
parent d7d019e071
commit 7e11677117
4 changed files with 11 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
htdocs/core/get_info.php
View File

@ -33,7 +33,7 @@ if (!defined('NOCSRFCHECK')) {
if (!defined('NOTOKENRENEWAL')) { if (!defined('NOTOKENRENEWAL')) {
define('NOTOKENRENEWAL', 1); define('NOTOKENRENEWAL', 1);
} }
//if (! defined('NOLOGIN')) define('NOLOGIN',1); // Not disabled cause need to load personalized language //if (! defined('NOLOGIN')) define('NOLOGIN',1); // Not disabled cause need to load personalized language and need security layer
if (!defined('NOREQUIREMENU')) { if (!defined('NOREQUIREMENU')) {
define('NOREQUIREMENU', 1); define('NOREQUIREMENU', 1);
} }
@ -56,8 +56,8 @@ $left = ($langs->trans("DIRECTION") == 'rtl' ? 'right' : 'left');
$title = $langs->trans("Info"); $title = $langs->trans("Info");
// URL http://mydolibarr/core/search_page?dol_use_jmobile=1 can be used for tests // URL http://mydolibarr/core/get_info.php?dol_use_jmobile=1 can be used for tests
$head = '<!-- Quick access -->'."\n"; $head = '<!-- Info user page -->'."\n";
$arrayofjs = array(); $arrayofjs = array();
$arrayofcss = array(); $arrayofcss = array();
top_htmlhead($head, $title, 0, 0, $arrayofjs, $arrayofcss); top_htmlhead($head, $title, 0, 0, $arrayofjs, $arrayofcss);
@ -93,7 +93,7 @@ if (empty($conf->global->MAIN_OPTIMIZEFORTEXTBROWSER)) {
if ($_SESSION["dol_authmode"] != 'forceuser' && $_SESSION["dol_authmode"] != 'http') { if ($_SESSION["dol_authmode"] != 'forceuser' && $_SESSION["dol_authmode"] != 'http') {
$logouthtmltext .= $langs->trans("Logout").'<br>'; $logouthtmltext .= $langs->trans("Logout").'<br>';
$logouttext .= '<a href="'.DOL_URL_ROOT.'/user/logout.php">'; $logouttext .= '<a href="'.DOL_URL_ROOT.'/user/logout.php?token='.newToken().'">';
//$logouttext .= img_picto($langs->trans('Logout').":".$langs->trans('Logout'), 'logout_top.png', 'class="login"', 0, 0, 1); //$logouttext .= img_picto($langs->trans('Logout').":".$langs->trans('Logout'), 'logout_top.png', 'class="login"', 0, 0, 1);
$logouttext .= '<span class="fa fa-sign-out atoplogin"></span>'; $logouttext .= '<span class="fa fa-sign-out atoplogin"></span>';
$logouttext .= '</a>'; $logouttext .= '</a>';

8
htdocs/main.inc.php
View File

@ -320,7 +320,7 @@ if (!empty($conf->global->MAIN_ONLY_LOGIN_ALLOWED)) {
if (session_id() && isset($_SESSION["dol_login"]) && $_SESSION["dol_login"] != $conf->global->MAIN_ONLY_LOGIN_ALLOWED) { if (session_id() && isset($_SESSION["dol_login"]) && $_SESSION["dol_login"] != $conf->global->MAIN_ONLY_LOGIN_ALLOWED) {
print 'Sorry, your application is offline.'."\n"; print 'Sorry, your application is offline.'."\n";
print 'You are logged with user "'.$_SESSION["dol_login"].'" and only administrator user "'.$conf->global->MAIN_ONLY_LOGIN_ALLOWED.'" is allowed to connect for the moment.'."\n"; print 'You are logged with user "'.$_SESSION["dol_login"].'" and only administrator user "'.$conf->global->MAIN_ONLY_LOGIN_ALLOWED.'" is allowed to connect for the moment.'."\n";
$nexturl = DOL_URL_ROOT.'/user/logout.php'; $nexturl = DOL_URL_ROOT.'/user/logout.php?token='.newToken();
print 'Please try later or <a href="'.$nexturl.'">click here to disconnect and change login user</a>...'."\n"; print 'Please try later or <a href="'.$nexturl.'">click here to disconnect and change login user</a>...'."\n";
} else { } else {
print 'Sorry, your application is offline. Only administrator user "'.$conf->global->MAIN_ONLY_LOGIN_ALLOWED.'" is allowed to connect for the moment.'."\n"; print 'Sorry, your application is offline. Only administrator user "'.$conf->global->MAIN_ONLY_LOGIN_ALLOWED.'" is allowed to connect for the moment.'."\n";
@ -1854,7 +1854,7 @@ function top_menu($head, $title = '', $target = '', $disablejs = 0, $disablehead
if ($_SESSION["dol_authmode"] != 'forceuser' && $_SESSION["dol_authmode"] != 'http') { if ($_SESSION["dol_authmode"] != 'forceuser' && $_SESSION["dol_authmode"] != 'http') {
$logouthtmltext .= $langs->trans("Logout").'<br>'; $logouthtmltext .= $langs->trans("Logout").'<br>';
$logouttext .= '<a accesskey="l" href="'.DOL_URL_ROOT.'/user/logout.php">'; $logouttext .= '<a accesskey="l" href="'.DOL_URL_ROOT.'/user/logout.php?token='.newToken().'">';
$logouttext .= img_picto($langs->trans('Logout'), 'sign-out', '', false, 0, 0, '', 'atoplogin'); $logouttext .= img_picto($langs->trans('Logout'), 'sign-out', '', false, 0, 0, '', 'atoplogin');
$logouttext .= '</a>'; $logouttext .= '</a>';
} else { } else {
@ -2020,7 +2020,7 @@ function top_menu($head, $title = '', $target = '', $disablejs = 0, $disablehead
* Build the tooltip on user login * Build the tooltip on user login
* *
* @param int $hideloginname Hide login name. Show only the image. * @param int $hideloginname Hide login name. Show only the image.
* @param string $urllogout URL for logout * @param string $urllogout URL for logout (Will use DOL_URL_ROOT.'/user/logout.php?token=...' if empty)
* @return string HTML content * @return string HTML content
*/ */
function top_menu_user($hideloginname = 0, $urllogout = '') function top_menu_user($hideloginname = 0, $urllogout = '')
@ -2136,7 +2136,7 @@ function top_menu_user($hideloginname = 0, $urllogout = '')
} }
if (empty($urllogout)) { if (empty($urllogout)) {
$urllogout = DOL_URL_ROOT.'/user/logout.php'; $urllogout = DOL_URL_ROOT.'/user/logout.php?token='.newToken();
} }
$logoutLink = '<a accesskey="l" href="'.$urllogout.'" class="button-top-menu-dropdown" ><i class="fa fa-sign-out-alt"></i> '.$langs->trans("Logout").'</a>'; $logoutLink = '<a accesskey="l" href="'.$urllogout.'" class="button-top-menu-dropdown" ><i class="fa fa-sign-out-alt"></i> '.$langs->trans("Logout").'</a>';
$profilLink = '<a accesskey="l" href="'.DOL_URL_ROOT.'/user/card.php?id='.$user->id.'" class="button-top-menu-dropdown" ><i class="fa fa-user"></i> '.$langs->trans("Card").'</a>'; $profilLink = '<a accesskey="l" href="'.DOL_URL_ROOT.'/user/card.php?id='.$user->id.'" class="button-top-menu-dropdown" ><i class="fa fa-user"></i> '.$langs->trans("Card").'</a>';

4
htdocs/takepos/index.php
View File

@ -906,7 +906,7 @@ if (empty($conf->global->TAKEPOS_HIDE_HEAD_BAR)) {
</div> </div>
<div class="login_block_user"> <div class="login_block_user">
<?php <?php
print top_menu_user(1, DOL_URL_ROOT.'/user/logout.php'); print top_menu_user(1);
?> ?>
</div> </div>
</div> </div>
@ -1163,7 +1163,7 @@ if ($r % 3 == 2) {
} }
if (!empty($conf->global->TAKEPOS_HIDE_HEAD_BAR)) { if (!empty($conf->global->TAKEPOS_HIDE_HEAD_BAR)) {
$menus[$r++] = array('title'=>'<span class="fa fa-sign-out-alt paddingrightonly"></span><div class="trunc">'.$langs->trans("Logout").'</div>', 'action'=>'window.location.href=\''.DOL_URL_ROOT.'/user/logout.php\';'); $menus[$r++] = array('title'=>'<span class="fa fa-sign-out-alt paddingrightonly"></span><div class="trunc">'.$langs->trans("Logout").'</div>', 'action'=>'window.location.href=\''.DOL_URL_ROOT.'/user/logout.php?token='.newToken().'\';');
} }
if (!empty($conf->global->TAKEPOS_WEIGHING_SCALE)) { if (!empty($conf->global->TAKEPOS_WEIGHING_SCALE)) {

2
htdocs/takepos/phone.php
View File

@ -329,7 +329,7 @@ function TakeposPrintingOrder(){
} }
function Exit(){ function Exit(){
window.location.href='../user/logout.php'; window.location.href='../user/logout.php?token=<?php echo newToken(); ?>';
} }
function CheckPlease(payment){ function CheckPlease(payment){