tim/xxx
1
0
Fork 0
Code Issues Pull Requests Releases Activity

Fix some issues with secure cookies being overwritten by insecure site.

Browse Source 
Now, /publish/{edit,addeditor,login,logout} must be accessed via
https://; other pages should not be (but can be).
This commit is contained in:
tim
2014-04-24 09:56:25 +02:00
parent 7fc40728f5
commit a00c1b4c9d
7 changed files with 41 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
publish/login.php
+12 -4
View File
@@ -1,11 +1,15 @@
<?
if ( ! isset($_SERVER['HTTPS'])) {
header('Location: https://' . $_SERVER["SERVER_NAME"] . $_SERVER['REQUEST_URI']);
}
require_once("../session.lib.php");
$denied = NULL;
$is_admin = NULL;
if (isset($_SESSION['editor'])) {
header("Location: http://xxx.org.za/publish/edit");
session_write_close();
header("Location: https://xxx.org.za/publish/edit");
return;
} else if (isset($_POST['login'])) {
include_once('../open_db.lib.php');
$table = "editors";
open_db('open');
@@ -17,7 +21,8 @@ if (isset($_SESSION['editor'])) {
$getid = $db->query($query) or die("Query failed: ".$db->error());
$row = $getid->fetch_assoc();
if (isset($row)) $stored_password = $row['password'];
if (isset($row))
$stored_password = $row['password'];
else $denied = TRUE;
$getid->close();
open_db('close');
@@ -35,10 +40,13 @@ if (isset($_SESSION['editor'])) {
$url .= $_SERVER['HTTP_HOST'];
$url .= $_SESSION['referrer'];
unset($_SESSION['referrer']);
session_write_close();
header("Location: $url");
return;
} else {
header("Location: http://xxx.org.za/publish/edit");
session_write_close();
header("Location: https://xxx.org.za/publish/edit");
return;
}
}
}