WMDE
/
LDAPAccountManager
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

fix problems if password reset is continued in different browser

This commit is contained in:
Roland Gruber 2013-07-28 17:49:20 +00:00
parent 2a1a4e57a6
commit 2940462f96
1 changed files with 12 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
lam/lib/security.inc
View File

@ -40,10 +40,11 @@ checkClientIP();
* Starts a session and checks the environment. * Starts a session and checks the environment.
* The script is stopped if one of the checks fail (timeout redirection may be overriden). * The script is stopped if one of the checks fail (timeout redirection may be overriden).
* *
* @param boolean $redirectToLogin redirect user to login page * @param boolean $redirectToLogin redirect user to login page (default: true)
* @param boolean $initSecureData init verification data like session ID and client IP (default: false)
* @return boolean true if all ok, false if session expired * @return boolean true if all ok, false if session expired
*/ */
function startSecureSession($redirectToLogin = true) { function startSecureSession($redirectToLogin = true, $initSecureData = false) {
// start session // start session
if (isset($_SESSION)) unset($_SESSION); if (isset($_SESSION)) unset($_SESSION);
if (strtolower(session_module_name()) == 'files') { if (strtolower(session_module_name()) == 'files') {
@ -55,6 +56,13 @@ function startSecureSession($redirectToLogin = true) {
} }
} }
@session_start(); @session_start();
// init secure data if needed
if ($initSecureData && !isset($_SESSION["sec_session_id"])) {
$_SESSION["sec_session_id"] = session_id();
$_SESSION["sec_client_ip"] = $_SERVER['REMOTE_ADDR'];
$_SESSION['sec_sessionTime'] = time();
$_SESSION['cfgMain'] = new LAMCfgMain();
}
// check session id // check session id
if (! isset($_SESSION["sec_session_id"]) || ($_SESSION["sec_session_id"] != session_id())) { if (! isset($_SESSION["sec_session_id"]) || ($_SESSION["sec_session_id"] != session_id())) {
// session id is invalid // session id is invalid
@ -126,7 +134,7 @@ function logoffAndBackToLoginPage() {
// close LDAP connection // close LDAP connection
@$_SESSION["ldap"]->destroy(); @$_SESSION["ldap"]->destroy();
} }
elseif (isset($_SESSION['selfService_clientDN'])) { elseif (isset($_SESSION['selfService_clientDN']) || (strpos($_SERVER['REQUEST_URI'], '/selfService/') !== false)) {
logNewMessage(LOG_WARNING, 'Self service session of DN ' . Ldap::decrypt($_SESSION['selfService_clientDN'], 'SelfService') . ' expired.'); logNewMessage(LOG_WARNING, 'Self service session of DN ' . Ldap::decrypt($_SESSION['selfService_clientDN'], 'SelfService') . ' expired.');
} }
// delete key and iv in cookie // delete key and iv in cookie
@ -138,7 +146,7 @@ function logoffAndBackToLoginPage() {
$paths = array('./', '../', '../../', '../../../', '../../../../'); $paths = array('./', '../', '../../', '../../../', '../../../../');
$page = 'login.php'; $page = 'login.php';
$pageSuffix = '?expired=yes'; $pageSuffix = '?expired=yes';
if (isset($_SESSION['selfService_clientDN'])) { if (isset($_SESSION['selfService_clientDN']) || (strpos($_SERVER['REQUEST_URI'], '/selfService/') !== false)) {
$scope = $_GET['scope']; $scope = $_GET['scope'];
$name = $_GET['name']; $name = $_GET['name'];
if (!preg_match('/^[0-9a-zA-Z _-]+$/', $scope) || !preg_match('/^[0-9a-zA-Z _-]+$/', $name)) { if (!preg_match('/^[0-9a-zA-Z _-]+$/', $scope) || !preg_match('/^[0-9a-zA-Z _-]+$/', $name)) {