tim
c85f54116c
The queue image query took $id without quotes or a check, which allowed SQL injection.
103 lines
3.0 KiB
PHP
103 lines
3.0 KiB
PHP
<?php
|
|
require_once(realpath(dirname(__FILE__) . '/open_db.lib.php'));
|
|
|
|
$is_admin = FALSE;
|
|
|
|
if (isset($_SERVER['HTTPS'])) {
|
|
session_cache_limiter('private');
|
|
session_set_cookie_params(strtotime('+1 year'), '/', '.xxx.org.za', TRUE, TRUE);
|
|
session_start();
|
|
|
|
if (isset($_SESSION['editor'])) {
|
|
$is_admin = TRUE;
|
|
$username = $_SESSION['editor'];
|
|
} elseif (check_persistent_login()) {
|
|
// Note that check_persistent_login() sets $_SESSION['editor']
|
|
$is_admin = TRUE;
|
|
$username = $_SESSION['editor'];
|
|
} else {
|
|
$is_admin = FALSE;
|
|
}
|
|
// Don't cache if $is_admin is set
|
|
header( 'Cache-Control: no-store, no-cache, must-revalidate' );
|
|
header( 'Cache-Control: post-check=0, pre-check=0', false );
|
|
header( 'Pragma: no-cache' );
|
|
}
|
|
|
|
function check_persistent_login() {
|
|
if (!array_key_exists('PersistentAuth', $_COOKIE)) {
|
|
return false;
|
|
}
|
|
global $db, $is_admin;
|
|
$table = "persistent_sessions";
|
|
open_db('open');
|
|
|
|
$cookie_data = (string)$_COOKIE['PersistentAuth'];
|
|
list($username, $key) = explode("|", $cookie_data, 2) + array('', '');
|
|
|
|
$query = "SELECT * FROM $table WHERE username LIKE ? LIMIT 1";
|
|
$getid = $db->execute_query($query, array($username)) or die("Query failed: ".$db->error);
|
|
$row = $getid->fetch_assoc();
|
|
open_db('close');
|
|
|
|
if (isset($row)) {
|
|
// Set up session, and delete old cookie, and create new persistent cookie
|
|
$stored_session = $row['session'];
|
|
if ($stored_session == $key) {
|
|
// login
|
|
$_SESSION['editor'] = $username;
|
|
// delete cookie
|
|
delete_persistent_login();
|
|
// create new cookie
|
|
create_persistent_login($username);
|
|
return true;
|
|
}
|
|
return false;
|
|
}
|
|
return false;
|
|
}
|
|
|
|
function create_persistent_login($username) {
|
|
$validity = strtotime('+1 year'); // Time to keep the session valid
|
|
global $db, $is_admin;
|
|
$table = "persistent_sessions";
|
|
open_db('open');
|
|
|
|
$key = bin2hex(random_bytes(100));
|
|
|
|
// Add session key to database
|
|
$query = "INSERT INTO $table (username, session) VALUES (?, ?)";
|
|
$db->execute_query($query, array($username, $key)) or die("Query failed: ".$db->error);
|
|
open_db('close');
|
|
|
|
// Create cookie with key
|
|
setcookie('PersistentAuth', "$username|$key", $validity, '/', '.xxx.org.za', TRUE, TRUE);
|
|
|
|
return true;
|
|
}
|
|
|
|
function delete_persistent_login() {
|
|
global $db, $is_admin;
|
|
$table = "persistent_sessions";
|
|
open_db('open');
|
|
|
|
$cookie_data = (string)($_COOKIE['PersistentAuth'] ?? '');
|
|
list($username, $key) = explode("|", $cookie_data, 2) + array('', '');
|
|
|
|
// Remove this session key from the database
|
|
$query = "DELETE FROM $table WHERE username LIKE ? AND session LIKE ?";
|
|
$db->execute_query($query, array($username, $key)) or die("Query failed: ".$db->error);
|
|
|
|
// Reap old sessions
|
|
$query = "DELETE FROM $table " .
|
|
" WHERE created < DATE_SUB(now(), INTERVAL 1 YEAR);";
|
|
$db->query($query) or die("Query failed: ".$db->error);
|
|
|
|
open_db('close');
|
|
|
|
// Delete cookie
|
|
setcookie("PersistentAuth", false, strtotime('-1 year'), '/', '.xxx.org.za', TRUE, TRUE);
|
|
|
|
return true;
|
|
}
|