added basic security checks

lam/HISTORY

@@ -1,7 +1,8 @@
-??? 1.0.1
+12.04.2006 1.0.1
    - LAM can now be installed with "configure" and "make install"
    - Unix: merged password hash settings for Unix users and groups
    - Samba 3: added Windows group to profile options
+   - security: LAM checks the session id and client IP
    - fixed bugs:
     -> Samba 3: hash values were wrong in some rare cases (1440021)
     -> Samba 3: readded time zone selection for logon hours (1407761)

lam/templates/account/edit.php

@@ -30,6 +30,8 @@ $Id$
 * @author Tilo Lutz
 */
 
+/** security functions */
+include_once("../../lib/security.inc");
 /** configuration options */
 include_once('../../lib/config.inc');
 /** functions to load and save profiles */
@@ -42,8 +44,7 @@ include_once('../../lib/pdf.inc');
 include_once('../../lib/modules.inc');
 
 // Start session
-session_save_path('../../sess');
+startSecureSession();
-@session_start();
 
 // Redirect to startpage if user is not loged in
 if (!isset($_SESSION['loggedIn'])) {

lam/templates/delete.php

@@ -29,6 +29,8 @@
 */
 
 
+/** security functions */
+include_once("../lib/security.inc");
 /** account functions */
 include_once('../lib/account.inc');
 /** current configuration options */
@@ -43,8 +45,7 @@ include_once('../lib/lamdaemon.inc');
 include_once('../lib/modules.inc');
 
 // Start session
-session_save_path('../sess');
+startSecureSession();
-@session_start();
 
 // Redirect to startpage if user is not loged in
 if (!isset($_SESSION['loggedIn'])) {

lam/templates/initsuff.php

@@ -28,6 +28,8 @@ $Id$
 * @package main
 */
 
+/** security functions */
+include_once("../lib/security.inc");
 /** access to configuration settings */
 include_once("../lib/config.inc");
 /** LDAP access */
@@ -36,8 +38,7 @@ include_once ("../lib/ldap.inc");
 include_once("../lib/status.inc");
 
 // start session
-session_save_path("../sess");
+startSecureSession();
-@session_start();
 
 setlanguage();
 

lam/templates/lists/list.php

@@ -29,14 +29,15 @@ $Id$
 * @author Roland Gruber
 */
 
+/** security functions */
+include_once("../../lib/security.inc");
 /** Used to get type information. */
 include_once("../../lib/types.inc");
 /** Access to configuration options */
 include_once("../../lib/config.inc");
 
 // start session
-session_save_path("../../sess");
+startSecureSession();
-@session_start();
 
 setlanguage();
 

lam/templates/lists/userlink.php

@@ -30,14 +30,15 @@ $Id$
 * @author Roland Gruber
 */
 
+/** security functions */
+include_once("../../lib/security.inc");
 /** Needed to find DNs of users */
 include_once("../../lib/ldap.inc");
 /** Used to display error messages */
 include_once("../../lib/status.inc");
 
 // start session
-session_save_path("../../sess");
+startSecureSession();
-@session_start();
 
 setlanguage();
 

lam/templates/logout.php

@@ -35,14 +35,15 @@ if (function_exists('mcrypt_create_iv')) {
 	setcookie("IV", "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx", 0, "/");
 }
 
+/** security functions */
+include_once("../lib/security.inc");
 /** Used to display status messages */
 include_once("../lib/status.inc");
 /** LDAP settings are deleted at logout */
 include_once("../lib/ldap.inc");
 
 // start session
-session_save_path("../sess");
+startSecureSession();
-@session_start();
 
 // close LDAP connection
 @$_SESSION["ldap"]->destroy();

lam/templates/main_header.php

@@ -28,12 +28,13 @@ $Id$
 * @author Roland Gruber
 */
 
+/** security functions */
+include_once("../lib/security.inc");
 /** access to configuration options */
 include_once("../lib/config.inc");
 
 // start session
-session_save_path("../sess");
+startSecureSession();
-@session_start();
 
 setlanguage();
 

lam/templates/massBuildAccounts.php

@@ -28,6 +28,8 @@ $Id$
 * @package tools
 */
 
+/** security functions */
+include_once("../lib/security.inc");
 /** access to configuration */
 include_once('../lib/config.inc');
 /** status messages */
@@ -37,8 +39,7 @@ include_once('../lib/modules.inc');
 
 
 // Start session
-session_save_path('../sess');
+startSecureSession();
-@session_start();
 
 // Redirect to startpage if user is not loged in
 if (!isset($_SESSION['loggedIn'])) {

lam/templates/massDoUpload.php

@@ -28,6 +28,8 @@ $Id$
 * @package tools
 */
 
+/** security functions */
+include_once("../lib/security.inc");
 /** access to configuration */
 include_once('../lib/config.inc');
 /** LDAP handle */
@@ -41,8 +43,7 @@ include_once('../lib/cache.inc');
 
 
 // Start session
-session_save_path('../sess');
+startSecureSession();
-@session_start();
 
 // Redirect to startpage if user is not loged in
 if (!isset($_SESSION['loggedIn'])) {

lam/templates/masscreate.php

@@ -28,6 +28,8 @@ $Id$
 * @package tools
 */
 
+/** security functions */
+include_once("../lib/security.inc");
 /** access to configuration */
 include_once('../lib/config.inc');
 /** status messages */
@@ -37,8 +39,7 @@ include_once('../lib/modules.inc');
 
 
 // Start session
-session_save_path('../sess');
+startSecureSession();
-@session_start();
 
 // Redirect to startpage if user is not loged in
 if (!isset($_SESSION['loggedIn'])) {

lam/templates/ou_edit.php

@@ -28,6 +28,8 @@ $Id$
 * @package tools
 */
 
+/** security functions */
+include_once("../lib/security.inc");
 /** access to configuration data */
 include_once("../lib/config.inc");
 /** access LDAP server */
@@ -36,8 +38,7 @@ include_once ("../lib/ldap.inc");
 include_once("../lib/status.inc");
 
 // start session
-session_save_path("../sess");
+startSecureSession();
-@session_start();
 
 setlanguage();
 

lam/templates/pdfedit/pdfdelete.php

@@ -28,12 +28,13 @@ $Id$
 * @author Michael Dürgner
 */
 
+/** security functions */
+include_once("../../lib/security.inc");
 /** helper functions for pdf */
 include_once('../../lib/pdfstruct.inc');
 
 // start session
-session_save_path("../../sess");
+startSecureSession();
-@session_start();
 
 setlanguage();
 

lam/templates/pdfedit/pdfmain.php

@@ -28,6 +28,8 @@ $Id$
 * @package PDF
 */
 
+/** security functions */
+include_once("../../lib/security.inc");
 /** access to PDF configuration files */
 include_once("../../lib/pdfstruct.inc");
 /** LDAP object */
@@ -38,8 +40,7 @@ include_once("../../lib/config.inc");
 include_once("../../lib/modules.inc");
 
 // start session
-session_save_path("../../sess");
+startSecureSession();
-@session_start();
 
 setlanguage();
 

lam/templates/pdfedit/pdfpage.php

@@ -31,6 +31,8 @@ $Id$
 * @package PDF
 */
 
+/** security functions */
+include_once("../../lib/security.inc");
 /** access to PDF configuration files */
 include_once('../../lib/pdfstruct.inc');
 /** LDAP object */
@@ -43,8 +45,7 @@ include_once('../../lib/modules.inc');
 include_once('../../lib/xml_parser.inc');
 
 // start session
-session_save_path("../../sess");
+startSecureSession();
-@session_start();
 
 setlanguage();
 

lam/templates/profedit/profiledelete.php

@@ -28,6 +28,8 @@ $Id$
 * @author Roland Gruber
 */
 
+/** security functions */
+include_once("../../lib/security.inc");
 /** helper functions for profiles */
 include_once("../../lib/profiles.inc");
 /** access to LDAP server */
@@ -36,8 +38,7 @@ include_once("../../lib/ldap.inc");
 include_once("../../lib/config.inc");
 
 // start session
-session_save_path("../../sess");
+startSecureSession();
-@session_start();
 
 setlanguage();
 

lam/templates/profedit/profilemain.php

@@ -28,6 +28,8 @@ $Id$
 * @author Roland Gruber
 */
 
+/** security functions */
+include_once("../../lib/security.inc");
 /** helper functions for profiles */
 include_once("../../lib/profiles.inc");
 /** access to LDAP server */
@@ -36,8 +38,7 @@ include_once("../../lib/ldap.inc");
 include_once("../../lib/config.inc");
 
 // start session
-session_save_path("../../sess");
+startSecureSession();
-@session_start();
 
 setlanguage();
 

lam/templates/profedit/profilepage.php

@@ -28,6 +28,8 @@ $Id$
 * @author Roland Gruber
 */
 
+/** security functions */
+include_once("../../lib/security.inc");
 /** helper functions for profiles */
 include_once("../../lib/profiles.inc");
 /** access to LDAP server */
@@ -40,8 +42,7 @@ include_once("../../lib/modules.inc");
 include_once("../../lib/status.inc");
 
 // start session
-session_save_path("../../sess");
+startSecureSession();
-@session_start();
 
 setlanguage();
 

lam/templates/schema/schema.php

@@ -31,6 +31,8 @@ $Id$
  */
  
  
+/** security functions */
+include_once("../../lib/security.inc");
 /** access to LDAP server */
 include_once("../../lib/ldap.inc");
 /** access to configuration options */
@@ -39,8 +41,7 @@ include_once("../../lib/config.inc");
 require_once("../../lib/schema.inc");
 
 // start session
-session_save_path("../../sess");
+startSecureSession();
-@session_start();
 
 setlanguage();
 

lam/templates/tools.php

@@ -28,12 +28,13 @@ $Id$
 * @package tools
 */
 
+/** security functions */
+include_once("../lib/security.inc");
 /** access to configuration options */
 include_once("../lib/config.inc");
 
 // start session
-session_save_path("../sess");
+startSecureSession();
-@session_start();
 
 setlanguage();
 

lam/templates/tree/add_attr.php

@@ -43,6 +43,8 @@ $Id$
  * @author Roland Gruber
  */
 
+/** security functions */
+include_once('../../lib/security.inc');
 /** tree functions */
 include_once('../../lib/tree.inc');
 /** access to configuration */
@@ -55,8 +57,7 @@ include_once('../../lib/status.inc');
 include_once('../../lib/account.inc');
 
 // start session
-session_save_path("../../sess");
+startSecureSession();
-@session_start();
 
 setlanguage();
 

lam/templates/tree/add_attr_form.php

@@ -40,6 +40,8 @@ $Id$
  * @author Roland Gruber
  */
 
+/** security functions */
+include_once('../../lib/security.inc');
 /** tree functions */
 include_once('../../lib/tree.inc');
 /** access to configuration */
@@ -50,8 +52,7 @@ include_once('../../lib/ldap.inc');
 include_once('../../lib/status.inc');
 
 // start session
-session_save_path("../../sess");
+startSecureSession();
-@session_start();
 
 setlanguage();
 

lam/templates/tree/add_oclass.php

@@ -45,6 +45,8 @@ $Id$
  * @author Roland Gruber
  */
 
+/** security functions */
+include_once('../../lib/security.inc');
 /** tree functions */
 include_once('../../lib/tree.inc');
 /** access to configuration */
@@ -55,8 +57,7 @@ include_once('../../lib/ldap.inc');
 include_once('../../lib/status.inc');
 
 // start session
-session_save_path("../../sess");
+startSecureSession();
-@session_start();
 
 setlanguage();
 

lam/templates/tree/add_oclass_form.php

@@ -46,6 +46,8 @@ $Id$
  * @author Roland Gruber
  */
 
+/** security functions */
+include_once('../../lib/security.inc');
 /** tree functions */
 include_once('../../lib/tree.inc');
 /** access to configuration */
@@ -56,8 +58,7 @@ include_once('../../lib/ldap.inc');
 include_once('../../lib/status.inc');
 
 // start session
-session_save_path("../../sess");
+startSecureSession();
-@session_start();
 
 setlanguage();
 

lam/templates/tree/add_value.php

@@ -45,6 +45,8 @@ $Id$
  * @author Roland Gruber
  */
 
+/** security functions */
+include_once('../../lib/security.inc');
 /** tree functions */
 include_once('../../lib/tree.inc');
 /** access to configuration */
@@ -55,8 +57,7 @@ include_once('../../lib/ldap.inc');
 include_once('../../lib/status.inc');
 
 // start session
-session_save_path("../../sess");
+startSecureSession();
-@session_start();
 
 setlanguage();
 

lam/templates/tree/add_value_form.php

@@ -42,6 +42,8 @@ $Id$
  * @author Roland Gruber
  */
 
+/** security functions */
+include_once('../../lib/security.inc');
 /** tree functions */
 include_once('../../lib/tree.inc');
 /** access to configuration */
@@ -52,8 +54,7 @@ include_once('../../lib/ldap.inc');
 include_once('../../lib/status.inc');
 
 // start session
-session_save_path("../../sess");
+startSecureSession();
-@session_start();
 
 setlanguage();
 

lam/templates/tree/collapse.php

@@ -44,6 +44,8 @@ $Id$
  * @author Roland Gruber
  */
 
+/** security functions */
+include_once('../../lib/security.inc');
 /** tree functions */
 include_once('../../lib/tree.inc');
 /** access to configuration */
@@ -52,8 +54,7 @@ include_once('../../lib/config.inc');
 include_once('../../lib/ldap.inc');
 
 // start session
-session_save_path("../../sess");
+startSecureSession();
-@session_start();
 
 setlanguage();
 

lam/templates/tree/create.php

@@ -45,6 +45,8 @@ $Id$
  * @author Roland Gruber
  */
 
+/** security functions */
+include_once('../../lib/security.inc');
 /** tree functions */
 include_once('../../lib/tree.inc');
 /** access to configuration */
@@ -55,8 +57,7 @@ include_once('../../lib/ldap.inc');
 include_once('../../lib/status.inc');
 
 // start session
-session_save_path("../../sess");
+startSecureSession();
-@session_start();
 
 setlanguage();
 

lam/templates/tree/create_form.php

@@ -41,6 +41,8 @@ $Id$
  * @author Roland Gruber
  */
 
+/** security functions */
+include_once('../../lib/security.inc');
 /** tree functions */
 include_once('../../lib/tree.inc');
 /** access to configuration */
@@ -53,8 +55,7 @@ include_once('../../lib/status.inc');
 include_once('templates/templates.inc');
 
 // start session
-session_save_path("../../sess");
+startSecureSession();
-@session_start();
 
 setlanguage();
 

lam/templates/tree/creation_template.php

@@ -40,6 +40,8 @@ $Id$
  * @author Roland Gruber
  */
 
+/** security functions */
+include_once('../../lib/security.inc');
 /** tree functions */
 include_once('../../lib/tree.inc');
 /** access to configuration */
@@ -52,8 +54,7 @@ include_once('../../lib/status.inc');
 include_once('templates/templates.inc');
 
 // start session
-session_save_path("../../sess");
+startSecureSession();
-@session_start();
 
 setlanguage();
 

lam/templates/tree/delete.php

@@ -40,6 +40,8 @@ $Id$
  * @author Roland Gruber
  */
 
+/** security functions */
+include_once('../../lib/security.inc');
 /** tree functions */
 include_once('../../lib/tree.inc');
 /** access to configuration */
@@ -50,8 +52,7 @@ include_once('../../lib/ldap.inc');
 include_once('../../lib/status.inc');
 
 // start session
-session_save_path("../../sess");
+startSecureSession();
-@session_start();
 
 setlanguage();
 

lam/templates/tree/delete_attr.php

@@ -40,6 +40,8 @@ $Id$
  * @author Roland Gruber
  */
 
+/** security functions */
+include_once('../../lib/security.inc');
 /** tree functions */
 include_once('../../lib/tree.inc');
 /** access to configuration */
@@ -50,8 +52,7 @@ include_once('../../lib/ldap.inc');
 include_once('../../lib/status.inc');
 
 // start session
-session_save_path("../../sess");
+startSecureSession();
-@session_start();
 
 setlanguage();
 

lam/templates/tree/delete_form.php

@@ -40,6 +40,8 @@ $Id$
  * @author Roland Gruber
  */
 
+/** security functions */
+include_once('../../lib/security.inc');
 /** tree functions */
 include_once('../../lib/tree.inc');
 /** access to configuration */
@@ -50,8 +52,7 @@ include_once('../../lib/ldap.inc');
 include_once('../../lib/status.inc');
 
 // start session
-session_save_path("../../sess");
+startSecureSession();
-@session_start();
 
 setlanguage();
 

lam/templates/tree/download_binary_attr.php

@@ -37,6 +37,8 @@ $Id$
  */
 
 
+/** security functions */
+include_once('../../lib/security.inc');
 /** tree functions */
 include_once('../../lib/tree.inc');
 /** access to configuration */
@@ -47,8 +49,7 @@ include_once('../../lib/ldap.inc');
 include_once('../../lib/status.inc');
 
 // start session
-session_save_path("../../sess");
+startSecureSession();
-@session_start();
 
 setlanguage();
 

lam/templates/tree/edit.php

@@ -42,6 +42,8 @@ $Id$
  * @author Roland Gruber
  */
 
+/** security functions */
+include_once('../../lib/security.inc');
 /** tree functions */
 include_once('../../lib/tree.inc');
 /** access to configuration */
@@ -52,8 +54,7 @@ include_once('../../lib/ldap.inc');
 include_once('../../lib/status.inc');
 
 // start session
-session_save_path("../../sess");
+startSecureSession();
-@session_start();
 
 setlanguage();
 

lam/templates/tree/expand.php

@@ -43,6 +43,8 @@ $Id$
  * @author Roland Gruber
  */
 
+/** security functions */
+include_once('../../lib/security.inc');
 /** tree functions */
 include_once('../../lib/tree.inc');
 /** access to configuration */
@@ -51,8 +53,7 @@ include_once('../../lib/config.inc');
 include_once('../../lib/ldap.inc');
 
 // start session
-session_save_path("../../sess");
+startSecureSession();
-@session_start();
 
 setlanguage();
 

lam/templates/tree/export.php

@@ -35,6 +35,8 @@ $Id$
  * @author Roland Gruber
  */
 
+/** security functions */
+include_once('../../lib/security.inc');
 /** export functions */
 require '../../lib/export.inc';
 /** common functions */
@@ -47,8 +49,7 @@ include_once('../../lib/ldap.inc');
 include_once('../../lib/status.inc');
 
 // start session
-session_save_path("../../sess");
+startSecureSession();
-@session_start();
 
 setlanguage();
 

lam/templates/tree/export_form.php

@@ -40,6 +40,8 @@ $Id$
  * @author Roland Gruber
  */
 
+/** security functions */
+include_once('../../lib/security.inc');
 /** export functions */
 require '../../lib/export.inc';
 /** access to configuration */
@@ -50,8 +52,7 @@ include_once('../../lib/ldap.inc');
 include_once('../../lib/status.inc');
 
 // start session
-session_save_path("../../sess");
+startSecureSession();
-@session_start();
 
 setlanguage();
 

lam/templates/tree/rdelete.php

@@ -39,6 +39,8 @@ $Id$
  * @author Roland Gruber
  */
 
+/** security functions */
+include_once('../../lib/security.inc');
 /** tree functions */
 include_once('../../lib/tree.inc');
 /** access to configuration */
@@ -49,8 +51,7 @@ include_once('../../lib/ldap.inc');
 include_once('../../lib/status.inc');
 
 // start session
-session_save_path("../../sess");
+startSecureSession();
-@session_start();
 
 setlanguage();
 

lam/templates/tree/refresh.php

@@ -40,6 +40,8 @@ $Id$
  * @author Roland Gruber
  */
 
+/** security functions */
+include_once('../../lib/security.inc');
 /** tree functions */
 include_once('../../lib/tree.inc');
 /** access to configuration */
@@ -48,8 +50,7 @@ include_once('../../lib/config.inc');
 include_once('../../lib/ldap.inc');
 
 // start session
-session_save_path("../../sess");
+startSecureSession();
-@session_start();
 
 if( ! array_key_exists( 'tree', $_SESSION ) )
 	header( "Location: tree.php" );

lam/templates/tree/tree.php

@@ -43,6 +43,8 @@ $Id$
  * @author Roland Gruber
  */
 
+/** security functions */
+include_once('../../lib/security.inc');
 /** tree functions */
 include_once('../../lib/tree.inc');
 /** access to configuration */
@@ -51,8 +53,7 @@ include_once('../../lib/config.inc');
 include_once('../../lib/ldap.inc');
 
 // start session
-session_save_path("../../sess");
+startSecureSession();
-@session_start();
 
 setlanguage();
 

lam/templates/tree/tree_view.php

@@ -30,6 +30,8 @@ $Id$
 * @author Roland Gruber
 */
 
+/** security functions */
+include_once('../../lib/security.inc');
 /** tree functions */
 include_once('../../lib/tree.inc');
 /** access to configuration */
@@ -38,8 +40,7 @@ include_once('../../lib/config.inc');
 include_once('../../lib/ldap.inc');
 
 // start session
-session_save_path("../../sess");
+startSecureSession();
-@session_start();
 
 // get encoding
 $lang = explode(":",$_SESSION['language']);

lam/templates/tree/update.php

@@ -53,6 +53,8 @@ $Id$
  * @author Roland Gruber
  */
 
+/** security functions */
+include_once('../../lib/security.inc');
 /** tree functions */
 include_once('../../lib/tree.inc');
 /** access to configuration */
@@ -61,8 +63,7 @@ include_once('../../lib/config.inc');
 include_once('../../lib/ldap.inc');
 
 // start session
-session_save_path("../../sess");
+startSecureSession();
-@session_start();
 
 setlanguage();
 

lam/templates/tree/update_confirm.php

@@ -41,6 +41,8 @@ $Id$
  * @author Roland Gruber
  */
 
+/** security functions */
+include_once('../../lib/security.inc');
 /** tree functions */
 include_once('../../lib/tree.inc');
 /** access to configuration */
@@ -51,8 +53,7 @@ include_once('../../lib/ldap.inc');
 include_once('../../lib/account.inc');
 
 // start session
-session_save_path("../../sess");
+startSecureSession();
-@session_start();
 
 setlanguage();