lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix: session lost if use custom2 for external module

Browse Source
This commit is contained in:
Regis Houssin 2010-12-27 10:48:50 +00:00
parent 059642ebbd
commit 82a35d3954
4 changed files with 9 additions and 25 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
htdocs/lib/security.lib.php
View File

@ -79,12 +79,8 @@ function dol_loginfunction($langs,$conf,$mysoc)
$conf->css = "/theme/".$conf->theme."/style.css.php?lang=".$langs->defaultlang; $conf->css = "/theme/".$conf->theme."/style.css.php?lang=".$langs->defaultlang;
$conf_css = DOL_URL_ROOT.$conf->css; $conf_css = DOL_URL_ROOT.$conf->css;
// Add real path in session name
$realpath='';
if ( preg_match('/^([^.]+)\/htdocs\//i', realpath($_SERVER["SCRIPT_FILENAME"]), $regs)) $realpath = isset($regs[1])?$regs[1]:'';
// Set cookie for timeout management // Set cookie for timeout management
$sessiontimeout='DOLSESSTIMEOUT_'.md5($_SERVER["SERVER_NAME"].$_SERVER["DOCUMENT_ROOT"].$realpath); $sessiontimeout='DOLSESSTIMEOUT_'.md5($_SERVER["SERVER_NAME"].$_SERVER["DOCUMENT_ROOT"]);
if (! empty($conf->global->MAIN_SESSION_TIMEOUT)) setcookie($sessiontimeout, $conf->global->MAIN_SESSION_TIMEOUT, 0, "/", '', 0); if (! empty($conf->global->MAIN_SESSION_TIMEOUT)) setcookie($sessiontimeout, $conf->global->MAIN_SESSION_TIMEOUT, 0, "/", '', 0);
if (GETPOST("urlfrom")) $_SESSION["urlfrom"]=GETPOST("urlfrom"); if (GETPOST("urlfrom")) $_SESSION["urlfrom"]=GETPOST("urlfrom");
@ -116,7 +112,7 @@ function dol_loginfunction($langs,$conf,$mysoc)
if (! empty($conf->global->MAIN_MULTICOMPANY_COOKIE)) if (! empty($conf->global->MAIN_MULTICOMPANY_COOKIE))
{ {
$entityCookieName = 'DOLENTITYID_'.md5($_SERVER["SERVER_NAME"].$_SERVER["DOCUMENT_ROOT"].$realpath); $entityCookieName = 'DOLENTITYID_'.md5($_SERVER["SERVER_NAME"].$_SERVER["DOCUMENT_ROOT"]);
if (isset($_COOKIE[$entityCookieName])) if (isset($_COOKIE[$entityCookieName]))
{ {
include_once(DOL_DOCUMENT_ROOT . "/core/class/cookie.class.php"); include_once(DOL_DOCUMENT_ROOT . "/core/class/cookie.class.php");

10
htdocs/main.inc.php
View File

@ -119,13 +119,9 @@ analyse_sql_and_script($_POST,0);
// This is to make Dolibarr working with Plesk // This is to make Dolibarr working with Plesk
set_include_path($_SERVER['DOCUMENT_ROOT'].'/htdocs'); set_include_path($_SERVER['DOCUMENT_ROOT'].'/htdocs');
// Add real path in session name
$realpath='';
if ( preg_match('/^([^.]+)\/htdocs\//i', realpath($_SERVER["SCRIPT_FILENAME"]), $regs)) $realpath = isset($regs[1])?$regs[1]:'';
// Init session. Name of session is specific to Dolibarr instance. // Init session. Name of session is specific to Dolibarr instance.
$sessionname='DOLSESSID_'.md5($_SERVER["SERVER_NAME"].$_SERVER["DOCUMENT_ROOT"].$realpath); $sessionname='DOLSESSID_'.md5($_SERVER["SERVER_NAME"].$_SERVER["DOCUMENT_ROOT"]);
$sessiontimeout='DOLSESSTIMEOUT_'.md5($_SERVER["SERVER_NAME"].$_SERVER["DOCUMENT_ROOT"].$realpath); $sessiontimeout='DOLSESSTIMEOUT_'.md5($_SERVER["SERVER_NAME"].$_SERVER["DOCUMENT_ROOT"]);
if (! empty($_COOKIE[$sessiontimeout])) ini_set('session.gc_maxlifetime',$_COOKIE[$sessiontimeout]); if (! empty($_COOKIE[$sessiontimeout])) ini_set('session.gc_maxlifetime',$_COOKIE[$sessiontimeout]);
session_name($sessionname); session_name($sessionname);
session_start(); session_start();
@ -552,7 +548,7 @@ if (! defined('NOLOGIN'))
include_once(DOL_DOCUMENT_ROOT."/core/class/cookie.class.php"); include_once(DOL_DOCUMENT_ROOT."/core/class/cookie.class.php");
$entity = $_SESSION["dol_login"].'|'.$_POST["entity"]; $entity = $_SESSION["dol_login"].'|'.$_POST["entity"];
$entityCookieName = 'DOLENTITYID_'.md5($_SERVER["SERVER_NAME"].$_SERVER["DOCUMENT_ROOT"].$realpath); $entityCookieName = 'DOLENTITYID_'.md5($_SERVER["SERVER_NAME"].$_SERVER["DOCUMENT_ROOT"]);
// TTL : is defined in the config page multicompany // TTL : is defined in the config page multicompany
$ttl = (! empty($conf->global->MAIN_MULTICOMPANY_COOKIE_TTL) ? $conf->global->MAIN_MULTICOMPANY_COOKIE_TTL : time()+60*60*8 ); $ttl = (! empty($conf->global->MAIN_MULTICOMPANY_COOKIE_TTL) ? $conf->global->MAIN_MULTICOMPANY_COOKIE_TTL : time()+60*60*8 );
// Cryptkey : will be created randomly in the config page multicompany // Cryptkey : will be created randomly in the config page multicompany

6
htdocs/master.inc.php
View File

@ -291,11 +291,7 @@ if (! defined('NOREQUIREDB'))
} }
else else
{ {
// Add real path in session name $entityCookieName = 'DOLENTITYID_'.md5($_SERVER["SERVER_NAME"].$_SERVER["DOCUMENT_ROOT"]);
$realpath='';
if ( preg_match('/^([^.]+)\/htdocs\//i', realpath($_SERVER["SCRIPT_FILENAME"]), $regs)) $realpath = isset($regs[1])?$regs[1]:'';
$entityCookieName = 'DOLENTITYID_'.md5($_SERVER["SERVER_NAME"].$_SERVER["DOCUMENT_ROOT"].$realpath);
if (! empty($_COOKIE[$entityCookieName]) && ! empty($conf->file->cookie_cryptkey)) // Just for view specific login page if (! empty($_COOKIE[$entityCookieName]) && ! empty($conf->file->cookie_cryptkey)) // Just for view specific login page
{ {
include_once(DOL_DOCUMENT_ROOT."/core/class/cookie.class.php"); include_once(DOL_DOCUMENT_ROOT."/core/class/cookie.class.php");

10
htdocs/user/logout.php
View File

@ -44,7 +44,7 @@ if (!empty($_SESSION["dol_authmode"]) && ($_SESSION["dol_authmode"] == 'forceuse
// Appel des triggers // Appel des triggers
include_once(DOL_DOCUMENT_ROOT . "/core/class/interfaces.class.php"); include_once(DOL_DOCUMENT_ROOT . "/core/class/interfaces.class.php");
$interface=new Interfaces($db); $interface=new Interfaces($db);
$result=$interface->run_triggers('USER_LOGOUT',$user,$user,$langs,$conf,$_POST["entity"]); $result=$interface->run_triggers('USER_LOGOUT',$user,$user,$langs,$conf,$conf->entity);
if ($result < 0) { $error++; } if ($result < 0) { $error++; }
// Fin appel triggers // Fin appel triggers
@ -62,13 +62,9 @@ if ($conf->phenix->enabled && $conf->phenix->cookie)
unset($_SESSION['dol_login']); unset($_SESSION['dol_login']);
unset($_SESSION['dol_entity']); unset($_SESSION['dol_entity']);
// Add real path in session
$realpath='';
if ( preg_match('/^([^.]+)\/htdocs\//i', realpath($_SERVER["SCRIPT_FILENAME"]), $regs)) $realpath = isset($regs[1])?$regs[1]:'';
// Destroy session // Destroy session
$sessionname='DOLSESSID_'.md5($_SERVER["SERVER_NAME"].$_SERVER["DOCUMENT_ROOT"].$realpath); $sessionname='DOLSESSID_'.md5($_SERVER["SERVER_NAME"].$_SERVER["DOCUMENT_ROOT"]);
$sessiontimeout='DOLSESSTIMEOUT_'.md5($_SERVER["SERVER_NAME"].$_SERVER["DOCUMENT_ROOT"].$realpath); $sessiontimeout='DOLSESSTIMEOUT_'.md5($_SERVER["SERVER_NAME"].$_SERVER["DOCUMENT_ROOT"]);
if (! empty($_COOKIE[$sessiontimeout])) ini_set('session.gc_maxlifetime',$_COOKIE[$sessiontimeout]); if (! empty($_COOKIE[$sessiontimeout])) ini_set('session.gc_maxlifetime',$_COOKIE[$sessiontimeout]);
session_name($sessionname); session_name($sessionname);
session_destroy(); session_destroy();