lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fi:x Restore a security system broken by adding alt feature.

Browse Source
This commit is contained in:
Laurent Destailleur 2010-12-27 18:59:11 +00:00
parent 1f8ce55a43
commit dfe9bbe286
1 changed files with 7 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
htdocs/lib/security.lib.php
View File

@ -79,8 +79,13 @@ function dol_loginfunction($langs,$conf,$mysoc)
$conf->css = "/theme/".$conf->theme."/style.css.php?lang=".$langs->defaultlang; $conf->css = "/theme/".$conf->theme."/style.css.php?lang=".$langs->defaultlang;
$conf_css = DOL_URL_ROOT.$conf->css; $conf_css = DOL_URL_ROOT.$conf->css;
// Add real path in session name (we must do that to avoid conflict between two dolibarr instances)
$realpath='';
if ( preg_match('/^([^.]+)\/htdocs\//i', realpath($_SERVER["SCRIPT_FILENAME"]), $regs)) $realpath = isset($regs[1])?$regs[1]:'';
if (defined('DOL_DOCUMENT_ROOT_ALT') && DOL_DOCUMENT_ROOT_ALT) $realpath=''; // warning, using alt feature is a security hole because path is not in session name
// Set cookie for timeout management // Set cookie for timeout management
$sessiontimeout='DOLSESSTIMEOUT_'.md5($_SERVER["SERVER_NAME"].$_SERVER["DOCUMENT_ROOT"]); $sessiontimeout='DOLSESSTIMEOUT_'.md5($_SERVER["SERVER_NAME"].$_SERVER["DOCUMENT_ROOT"].$realpath);
if (! empty($conf->global->MAIN_SESSION_TIMEOUT)) setcookie($sessiontimeout, $conf->global->MAIN_SESSION_TIMEOUT, 0, "/", '', 0); if (! empty($conf->global->MAIN_SESSION_TIMEOUT)) setcookie($sessiontimeout, $conf->global->MAIN_SESSION_TIMEOUT, 0, "/", '', 0);
if (GETPOST("urlfrom")) $_SESSION["urlfrom"]=GETPOST("urlfrom"); if (GETPOST("urlfrom")) $_SESSION["urlfrom"]=GETPOST("urlfrom");
@ -112,7 +117,7 @@ function dol_loginfunction($langs,$conf,$mysoc)
if (! empty($conf->global->MAIN_MULTICOMPANY_COOKIE)) if (! empty($conf->global->MAIN_MULTICOMPANY_COOKIE))
{ {
$entityCookieName = 'DOLENTITYID_'.md5($_SERVER["SERVER_NAME"].$_SERVER["DOCUMENT_ROOT"]); $entityCookieName = 'DOLENTITYID_'.md5($_SERVER["SERVER_NAME"].$_SERVER["DOCUMENT_ROOT"].$realpath);
if (isset($_COOKIE[$entityCookieName])) if (isset($_COOKIE[$entityCookieName]))
{ {
include_once(DOL_DOCUMENT_ROOT . "/core/class/cookie.class.php"); include_once(DOL_DOCUMENT_ROOT . "/core/class/cookie.class.php");