check if user is logged in

lam/lib/account.inc

@@ -1467,6 +1467,22 @@ function validateReCAPTCHA($secretKey) {
 	return $responseJSON->{'success'} === true;
 }
 
+/**
+ * Checks if the user is logged in. Stops script execution if not.
+ *
+ * @param boolean $check2ndFactor check if the 2nd factor was provided if required
+ */
+function enforceUserIsLoggedIn($check2ndFactor = true) {
+	if (!isset($_SESSION['loggedIn']) || ($_SESSION['loggedIn'] !== true)) {
+		logNewMessage(LOG_WARNING, 'Detected unauthorized access to page that requires login: ' . $_SERVER["SCRIPT_FILENAME"]);
+		die();
+	}
+	if ($check2ndFactor && isset($_SESSION['2factorRequired'])) {
+		die();
+		logNewMessage(LOG_WARNING, 'Detected unauthorized access to page that requires login (2nd factor not provided): ' . $_SERVER["SCRIPT_FILENAME"]);
+	}
+}
+
 class LAMException extends Exception {
 
 	private $title;

lam/templates/3rdParty/pla/lib/session_functions.php

@@ -21,6 +21,7 @@ function app_session_start() {
 	include_once '../../../../lib/config.inc';
 	include_once '../../../../lib/ldap.inc';
 	startSecureSession();
+	enforceUserIsLoggedIn();
 	$config_file = CONFDIR.'config.php';
 	$config = check_config($config_file);
 	# If we came via index.php, then set our $config.

lam/templates/account/edit.php

@@ -4,7 +4,7 @@ $Id$
 
   This code is part of LDAP Account Manager (http://www.ldap-account-manager.org/)
   Copyright (C) 2003 - 2006  Tilo Lutz
-                2005 - 2016  Roland Gruber
+                2005 - 2017  Roland Gruber
 
   This program is free software; you can redistribute it and/or modify
   it under the terms of the GNU General Public License as published by
@@ -47,6 +47,7 @@ include_once('../../lib/modules.inc');
 
 // Start session
 startSecureSession();
+enforceUserIsLoggedIn();
 
 // Redirect to startpage if user is not loged in
 if (!isLoggedIn()) {

lam/templates/delete.php

@@ -49,6 +49,7 @@ include_once('../lib/modules.inc');
 
 // Start session
 startSecureSession();
+enforceUserIsLoggedIn();
 
 if (!checkIfWriteAccessIsAllowed()) {
 	die();

lam/templates/initsuff.php

@@ -3,7 +3,7 @@
 $Id$
 
   This code is part of LDAP Account Manager (http://www.ldap-account-manager.org/)
-  Copyright (C) 2003 - 2015  Roland Gruber
+  Copyright (C) 2003 - 2017  Roland Gruber
 
   This program is free software; you can redistribute it and/or modify
   it under the terms of the GNU General Public License as published by
@@ -39,6 +39,7 @@ include_once("../lib/status.inc");
 
 // start session
 startSecureSession();
+enforceUserIsLoggedIn();
 
 if (!checkIfWriteAccessIsAllowed()) {
 	die();

lam/templates/lists/deletelink.php

@@ -3,7 +3,7 @@
 $Id$
 
   This code is part of LDAP Account Manager (http://www.ldap-account-manager.org/)
-  Copyright (C) 2007 - 2013  Roland Gruber
+  Copyright (C) 2007 - 2017  Roland Gruber
 
   This program is free software; you can redistribute it and/or modify
   it under the terms of the GNU General Public License as published by
@@ -39,6 +39,7 @@ include_once("../../lib/status.inc");
 
 // start session
 startSecureSession();
+enforceUserIsLoggedIn();
 
 setlanguage();
 

lam/templates/lists/list.php

@@ -3,7 +3,7 @@
 $Id$
 
   This code is part of LDAP Account Manager (http://www.ldap-account-manager.org/)
-  Copyright (C) 2003 - 2016  Roland Gruber
+  Copyright (C) 2003 - 2017  Roland Gruber
 
   This program is free software; you can redistribute it and/or modify
   it under the terms of the GNU General Public License as published by
@@ -38,6 +38,7 @@ include_once("../../lib/config.inc");
 
 // start session
 startSecureSession();
+enforceUserIsLoggedIn();
 
 setlanguage();
 

lam/templates/lists/userlink.php

@@ -3,7 +3,7 @@
 $Id$
 
   This code is part of LDAP Account Manager (http://www.ldap-account-manager.org/)
-  Copyright (C) 2003 - 2010  Roland Gruber
+  Copyright (C) 2003 - 2017  Roland Gruber
 
   This program is free software; you can redistribute it and/or modify
   it under the terms of the GNU General Public License as published by
@@ -39,6 +39,7 @@ include_once("../../lib/status.inc");
 
 // start session
 startSecureSession();
+enforceUserIsLoggedIn();
 
 setlanguage();
 

lam/templates/logout.php

@@ -3,7 +3,7 @@
 $Id$
 
   This code is part of LDAP Account Manager (http://www.ldap-account-manager.org/)
-  Copyright (C) 2003 - 2006  Roland Gruber
+  Copyright (C) 2003 - 2017  Roland Gruber
 
   This program is free software; you can redistribute it and/or modify
   it under the terms of the GNU General Public License as published by
@@ -44,6 +44,7 @@ include_once("../lib/ldap.inc");
 
 // start session
 startSecureSession();
+enforceUserIsLoggedIn();
 
 // log message
 $ldapUser = $_SESSION['ldap']->decrypt_login();

lam/templates/main.php

@@ -4,7 +4,7 @@ namespace LAM\INIT;
 $Id$
 
   This code is part of LDAP Account Manager (http://www.ldap-account-manager.org/)
-  Copyright (C) 2003 - 2016  Roland Gruber
+  Copyright (C) 2003 - 2017  Roland Gruber
 
   This program is free software; you can redistribute it and/or modify
   it under the terms of the GNU General Public License as published by
@@ -36,6 +36,7 @@ include_once '../lib/profiles.inc';
 
 // start session
 startSecureSession();
+enforceUserIsLoggedIn();
 
 setlanguage();
 

lam/templates/misc/ajax.php

@@ -63,6 +63,7 @@ class lamAjax {
 		validateSecurityToken(false);
 
 		if (isset($_GET['module']) && isset($_GET['scope']) && in_array($_GET['module'], getAvailableModules($_GET['scope']))) {
+			enforceUserIsLoggedIn();
 			if (isset($_GET['useContainer']) && ($_GET['useContainer'] == '1')) {
 				if (!isset($_SESSION['account'])) die();
 				$module = $_SESSION['account']->getAccountModule($_GET['module']);
@@ -82,12 +83,13 @@ class lamAjax {
 		}
 
 		$jsonInput = $_POST['jsonInput'];
+		if ($function == 'passwordStrengthCheck') {
+			lamAjax::checkPasswordStrength($jsonInput);
+		}
+		enforceUserIsLoggedIn();
 		if ($function == 'passwordChange') {
 			lamAjax::managePasswordChange($jsonInput);
 		}
-		elseif ($function == 'passwordStrengthCheck') {
-			lamAjax::checkPasswordStrength($jsonInput);
-		}
 		elseif ($function == 'upload') {
 			include_once('../../lib/upload.inc');
 			$typeManager = new \LAM\TYPES\TypeManager();

lam/templates/multiEdit.php

@@ -21,7 +21,7 @@ use \htmlInputTextarea;
 $Id$
 
   This code is part of LDAP Account Manager (http://www.ldap-account-manager.org/)
-  Copyright (C) 2013 - 2016  Roland Gruber
+  Copyright (C) 2013 - 2017  Roland Gruber
 
   This program is free software; you can redistribute it and/or modify
   it under the terms of the GNU General Public License as published by
@@ -57,6 +57,7 @@ include_once("../lib/status.inc");
 
 // start session
 startSecureSession();
+enforceUserIsLoggedIn();
 
 // die if no write access
 if (!checkIfWriteAccessIsAllowed()) die();

lam/templates/ou_edit.php

@@ -50,6 +50,7 @@ include_once("../lib/status.inc");
 
 // start session
 startSecureSession();
+enforceUserIsLoggedIn();
 
 // die if no write access
 if (!checkIfWriteAccessIsAllowed()) die();

lam/templates/pdfedit/pdfmain.php

@@ -15,13 +15,12 @@ use \htmlInputFileUpload;
 use \htmlHelpLink;
 use \htmlInputField;
 use \htmlHiddenInput;
-use \htmlDiv;
 /*
 $Id$
 
   This code is part of LDAP Account Manager (http://www.ldap-account-manager.org/)
   Copyright (C) 2003 - 2006  Michael Duergner
-                2005 - 2016  Roland Gruber
+                2005 - 2017  Roland Gruber
 
   This program is free software; you can redistribute it and/or modify
   it under the terms of the GNU General Public License as published by
@@ -60,6 +59,7 @@ include_once("../../lib/modules.inc");
 
 // start session
 startSecureSession();
+enforceUserIsLoggedIn();
 
 // die if no write access
 if (!checkIfWriteAccessIsAllowed()) die();

lam/templates/pdfedit/pdfpage.php

@@ -19,7 +19,7 @@ $Id$
 
   This code is part of LDAP Account Manager (http://www.ldap-account-manager.org/)
   Copyright (C) 2003 - 2006  Michael Duergner
-                2007 - 2016  Roland Gruber
+                2007 - 2017  Roland Gruber
 
   This program is free software; you can redistribute it and/or modify
   it under the terms of the GNU General Public License as published by
@@ -62,6 +62,7 @@ include_once('../../lib/xml_parser.inc');
 
 // start session
 startSecureSession();
+enforceUserIsLoggedIn();
 
 // die if no write access
 if (!checkIfWriteAccessIsAllowed()) die();

lam/templates/profedit/profilemain.php

@@ -18,7 +18,7 @@ use \htmlInputField;
 $Id$
 
   This code is part of LDAP Account Manager (http://www.ldap-account-manager.org/)
-  Copyright (C) 2003 - 2016  Roland Gruber
+  Copyright (C) 2003 - 2017  Roland Gruber
 
   This program is free software; you can redistribute it and/or modify
   it under the terms of the GNU General Public License as published by
@@ -54,6 +54,7 @@ include_once("../../lib/config.inc");
 
 // start session
 startSecureSession();
+enforceUserIsLoggedIn();
 
 // die if no write access
 if (!checkIfWriteAccessIsAllowed()) die();

lam/templates/profedit/profilepage.php

@@ -12,7 +12,7 @@ use \htmlHiddenInput;
 $Id$
 
   This code is part of LDAP Account Manager (http://www.ldap-account-manager.org/)
-  Copyright (C) 2003 - 2016  Roland Gruber
+  Copyright (C) 2003 - 2017  Roland Gruber
 
   This program is free software; you can redistribute it and/or modify
   it under the terms of the GNU General Public License as published by
@@ -52,6 +52,7 @@ include_once("../../lib/status.inc");
 
 // start session
 startSecureSession();
+enforceUserIsLoggedIn();
 
 // die if no write access
 if (!checkIfWriteAccessIsAllowed()) die();

lam/templates/schema/schema.php

@@ -3,7 +3,7 @@
 $Id$
 
   Copyright (C) 2004 David Smith
-  modified to fit for LDAP Account Manager 2005 - 2012 Roland Gruber
+  modified to fit for LDAP Account Manager 2005 - 2017 Roland Gruber
 
   This program is free software; you can redistribute it and/or modify
   it under the terms of the GNU General Public License as published by
@@ -42,6 +42,7 @@ require_once("../../lib/schema.inc");
 
 // start session
 startSecureSession();
+enforceUserIsLoggedIn();
 
 checkIfToolIsActive('toolSchemaBrowser');
 

lam/templates/serverInfo.php

@@ -3,7 +3,7 @@
 $Id$
 
   This code is part of LDAP Account Manager (http://www.ldap-account-manager.org/)
-  Copyright (C) 2009 - 2012  Roland Gruber
+  Copyright (C) 2009 - 2017  Roland Gruber
 
   This program is free software; you can redistribute it and/or modify
   it under the terms of the GNU General Public License as published by
@@ -35,6 +35,7 @@ include_once("../lib/config.inc");
 
 // start session
 startSecureSession();
+enforceUserIsLoggedIn();
 
 checkIfToolIsActive('toolServerInformation');
 

lam/templates/tests/index.php

@@ -3,7 +3,7 @@
 $Id$
 
   This code is part of LDAP Account Manager (http://www.ldap-account-manager.org/)
-  Copyright (C) 2006 - 2012  Roland Gruber
+  Copyright (C) 2006 - 2017  Roland Gruber
 
   This program is free software; you can redistribute it and/or modify
   it under the terms of the GNU General Public License as published by
@@ -35,6 +35,7 @@ include_once("../../lib/config.inc");
 
 // start session
 startSecureSession();
+enforceUserIsLoggedIn();
 
 // die if no write access
 if (!checkIfWriteAccessIsAllowed()) die();

lam/templates/tests/lamdaemonTest.php

@@ -3,7 +3,7 @@
 $Id$
 
   This code is part of LDAP Account Manager (http://www.ldap-account-manager.org/)
-  Copyright (C) 2006 - 2016  Roland Gruber
+  Copyright (C) 2006 - 2017  Roland Gruber
 
   This program is free software; you can redistribute it and/or modify
   it under the terms of the GNU General Public License as published by
@@ -36,6 +36,7 @@ include_once("../../lib/config.inc");
 
 // start session
 startSecureSession();
+enforceUserIsLoggedIn();
 
 // die if no write access
 if (!checkIfWriteAccessIsAllowed()) die();

lam/templates/tests/schemaTest.php

@@ -3,7 +3,7 @@
 $Id$
 
   This code is part of LDAP Account Manager (http://www.ldap-account-manager.org/)
-  Copyright (C) 2007 - 2016  Roland Gruber
+  Copyright (C) 2007 - 2017  Roland Gruber
 
   This program is free software; you can redistribute it and/or modify
   it under the terms of the GNU General Public License as published by
@@ -39,6 +39,7 @@ include_once("../../lib/schema.inc");
 
 // start session
 startSecureSession();
+enforceUserIsLoggedIn();
 
 // die if no write access
 if (!checkIfWriteAccessIsAllowed()) die();

lam/templates/tools.php

@@ -3,7 +3,7 @@
 $Id$
 
   This code is part of LDAP Account Manager (http://www.ldap-account-manager.org/)
-  Copyright (C) 2003 - 2011  Roland Gruber
+  Copyright (C) 2003 - 2017  Roland Gruber
 
   This program is free software; you can redistribute it and/or modify
   it under the terms of the GNU General Public License as published by
@@ -37,6 +37,7 @@ include_once("../lib/tools.inc");
 
 // start session
 startSecureSession();
+enforceUserIsLoggedIn();
 
 setlanguage();
 

lam/templates/tree/treeViewContainer.php

@@ -3,7 +3,7 @@
 $Id$
 
   This code is part of LDAP Account Manager (http://www.ldap-account-manager.org/)
-  Copyright (C) 2010 - 2011  Roland Gruber
+  Copyright (C) 2010 - 2017  Roland Gruber
 
   This program is free software; you can redistribute it and/or modify
   it under the terms of the GNU General Public License as published by
@@ -36,6 +36,7 @@ include_once("../../lib/config.inc");
 
 // start session
 startSecureSession();
+enforceUserIsLoggedIn();
 
 setlanguage();
 

lam/templates/upload/massBuildAccounts.php

@@ -48,6 +48,7 @@ include_once('../../lib/modules.inc');
 
 // Start session
 startSecureSession();
+enforceUserIsLoggedIn();
 
 // check if this tool may be run
 checkIfToolIsActive('toolFileUpload');

lam/templates/upload/massDoUpload.php

@@ -45,6 +45,7 @@ include_once('../../lib/pdf.inc');
 
 // Start session
 startSecureSession();
+enforceUserIsLoggedIn();
 
 // check if this tool may be run
 checkIfToolIsActive('toolFileUpload');

lam/templates/upload/masscreate.php

@@ -62,6 +62,7 @@ include_once('../../lib/upload.inc');
 
 // Start session
 startSecureSession();
+enforceUserIsLoggedIn();
 
 // check if this tool may be run
 checkIfToolIsActive('toolFileUpload');

lam/tmp/.gitignore

@@ -1 +0,0 @@
-/*.jpg