From a00c1b4c9d5b10f19619b423bbb3a279177e1850 Mon Sep 17 00:00:00 2001
From: Timothy Allen <tim@treehouse.org.za>
Date: Thu, 24 Apr 2014 09:56:25 +0200
Subject: [PATCH] Fix some issues with secure cookies being overwritten by
 insecure site. Now, /publish/{edit,addeditor,login,logout} must be accessed
 via https://; other pages should not be (but can be).

---
 bottombar.inc.php     |  1 +
 publish/addeditor.php |  3 +++
 publish/edit.php      |  5 ++++-
 publish/login.php     | 16 ++++++++++++----
 publish/logout.php    |  5 ++++-
 publish/style.css     |  1 +
 session.lib.php       | 28 ++++++++++++++++------------
 7 files changed, 41 insertions(+), 18 deletions(-)

diff --git a/bottombar.inc.php b/bottombar.inc.php
index a1ff496..32da418 100644
--- a/bottombar.inc.php
+++ b/bottombar.inc.php
@@ -1,4 +1,5 @@
 <div id="bottom"><p>
 All stories and submissions <a class="whitefont" href="about">&copy;</a> 2003&ndash;<? echo gmdate("Y"); ?> their respective authors. 
 </p></div>
+<? $_SESSION['referrer'] = $_SERVER['REQUEST_URI']; ?>
 <? include_once('google.inc.php'); ?>
diff --git a/publish/addeditor.php b/publish/addeditor.php
index b56e319..5acc5b2 100644
--- a/publish/addeditor.php
+++ b/publish/addeditor.php
@@ -1,4 +1,7 @@
 <? 
+if ( ! isset($_SERVER['HTTPS'])) {
+   header('Location: https://' . $_SERVER["SERVER_NAME"] . $_SERVER['REQUEST_URI']);
+}
 require_once("../session.lib.php"); 
 $added = FALSE;
 if (!isset($_SESSION['editor'])) {
diff --git a/publish/edit.php b/publish/edit.php
index cdc0164..a983728 100644
--- a/publish/edit.php
+++ b/publish/edit.php
@@ -1,7 +1,11 @@
 <?
+if ( ! isset($_SERVER['HTTPS'])) {
+   header('Location: https://' . $_SERVER["SERVER_NAME"] . $_SERVER['REQUEST_URI']);
+}
 require_once("../session.lib.php"); 
 if (!isset($_SESSION['editor'])) {
   $is_admin = FALSE;
+  session_write_close();
   header("Location: https://xxx.org.za/publish/login");
   return;
 }
@@ -28,7 +32,6 @@ if (!isset($_SESSION['editor'])) {
   $editable = TRUE;
   $id = get_id();
 ?>
-
 <body>
 
 <div id='container'>
diff --git a/publish/login.php b/publish/login.php
index 0a227cd..8e44cc1 100644
--- a/publish/login.php
+++ b/publish/login.php
@@ -1,11 +1,15 @@
 <?
+if ( ! isset($_SERVER['HTTPS'])) {
+   header('Location: https://' . $_SERVER["SERVER_NAME"] . $_SERVER['REQUEST_URI']);
+}
 require_once("../session.lib.php");
 $denied = NULL;
 $is_admin = NULL;
 if (isset($_SESSION['editor'])) {
-  header("Location: http://xxx.org.za/publish/edit");
+  session_write_close();
+  header("Location: https://xxx.org.za/publish/edit");
+  return;
 } else if (isset($_POST['login'])) {
-
   include_once('../open_db.lib.php');
   $table = "editors";
   open_db('open');
@@ -17,7 +21,8 @@ if (isset($_SESSION['editor'])) {
   $getid = $db->query($query) or die("Query failed: ".$db->error());
   $row = $getid->fetch_assoc();
 
-  if (isset($row)) $stored_password = $row['password'];
+  if (isset($row)) 
+    $stored_password = $row['password'];
   else  $denied = TRUE;
   $getid->close();
   open_db('close');
@@ -35,10 +40,13 @@ if (isset($_SESSION['editor'])) {
       $url .= $_SERVER['HTTP_HOST'];
       $url .= $_SESSION['referrer'];
       unset($_SESSION['referrer']);
+      session_write_close();
       header("Location: $url");
       return;
     } else {
-      header("Location: http://xxx.org.za/publish/edit");
+      session_write_close();
+      header("Location: https://xxx.org.za/publish/edit");
+      return;
     }
   }
 } 
diff --git a/publish/logout.php b/publish/logout.php
index 1e22545..c11235a 100644
--- a/publish/logout.php
+++ b/publish/logout.php
@@ -1,4 +1,7 @@
 <?
+if ( ! isset($_SERVER['HTTPS'])) {
+   header('Location: https://' . $_SERVER["SERVER_NAME"] . $_SERVER['REQUEST_URI']);
+}
 require_once("../session.lib.php");
 if (isset($_SESSION['editor'])) {
   if (isset($_COOKIE[session_name()])) {
@@ -18,7 +21,7 @@ if (isset($_SESSION['referrer'])) {
   header("Location: $url");
   return;
 } else {
-  header("Location: /");
+  header("Location: http://xxx.org.za/");
   return;
 }
 ?>
diff --git a/publish/style.css b/publish/style.css
index 3e9b40c..43bb79c 100644
--- a/publish/style.css
+++ b/publish/style.css
@@ -10,6 +10,7 @@
 input#remember {
   margin-left: -2px;
   margin-top: 7px;
+  width: inherit;
 }
 
 #story {
diff --git a/session.lib.php b/session.lib.php
index bac3504..651d2f3 100644
--- a/session.lib.php
+++ b/session.lib.php
@@ -1,17 +1,21 @@
 <?
 require_once(realpath(dirname(__FILE__) . '/open_db.lib.php'));
-session_cache_limiter('none');
-session_set_cookie_params(strtotime('+1 year'), '/', '.xxx.org.za', TRUE, TRUE);
-session_start();
-$_SESSION['referrer'] = $_SERVER['REQUEST_URI'];
-if (isset($_SESSION['editor'])) {
-  $is_admin = TRUE;
-  $username = $_SESSION['editor'];
-} elseif (check_persistent_login()) {
-  $is_admin = TRUE;
-  $username = $_SESSION['editor'];
-} else {
-  $is_admin = FALSE;
+
+if (isset($_SERVER['HTTPS'])) {
+  session_cache_limiter('private');
+  session_set_cookie_params(strtotime('+1 year'), '/', '.xxx.org.za', TRUE, TRUE);
+  session_start();
+
+  if (isset($_SESSION['editor'])) {
+    $is_admin = TRUE;
+    $username = $_SESSION['editor'];
+  } elseif (check_persistent_login()) {
+    // check_persistent_login() sets $_SESSION['editor']
+    $is_admin = TRUE;
+    $username = $_SESSION['editor'];
+  } else {
+    $is_admin = FALSE;
+  }
 }
 
 function check_persistent_login() {