Mirrors/dolibarr
1
0
Fork 0
mirror of https://github.com/Dolibarr/dolibarr.git synced 2025-02-20 13:46:52 +01:00
Code Issues Packages Projects Releases Wiki Activity

Qual: Now creation of session is done before the loading of conf. This make code much easier to understand.

Browse Source
This commit is contained in:
Laurent Destailleur 2009-05-21 22:28:05 +00:00
parent 63b5f67069
commit fb0e668fc0
11 changed files with 65 additions and 72 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
htdocs/cashdesk/deconnexion.php
View File

@ -15,19 +15,20 @@
* along with this program; if not, write to the Free Software
* Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
*/
include('../master.inc.php');
// Init session
// Init session. Name of session is specific to Dolibarr instance.
$sessionname='DOLSESSID_'.md5($_SERVER["SERVER_NAME"].$_SERVER["DOCUMENT_ROOT"]);
if (! empty($conf->global->MAIN_SESSION_TIMEOUT)) ini_set('session.gc_maxlifetime',$conf->global->MAIN_SESSION_TIMEOUT);
$sessiontimeout='DOLSESSTIMEOUT_'.md5($_SERVER["SERVER_NAME"].$_SERVER["DOCUMENT_ROOT"]);
if (! empty($_COOKIE[$sessiontimeout])) ini_set('session.gc_maxlifetime',$sessiontimeout);
session_name($sessionname);
session_start();
dol_syslog("Start session name=".$sessionname." Session id()=".session_id().", _SESSION['dol_login']=".$_SESSION["dol_login"].", ".ini_get("session.gc_maxlifetime"));
include('../master.inc.php');
// Destroy session
$sessionname='DOLSESSID_'.md5($_SERVER["SERVER_NAME"].$_SERVER["DOCUMENT_ROOT"]);
if (! empty($conf->global->MAIN_SESSION_TIMEOUT)) ini_set('session.gc_maxlifetime',$conf->global->MAIN_SESSION_TIMEOUT);
$sessiontimeout='DOLSESSTIMEOUT_'.md5($_SERVER["SERVER_NAME"].$_SERVER["DOCUMENT_ROOT"]);
if (! empty($_COOKIE[$sessiontimeout])) ini_set('session.gc_maxlifetime',$sessiontimeout);
session_name($sessionname);
session_destroy();
dol_syslog("End of session ".$sessionname);

3
htdocs/cashdesk/include/environnement.php
View File

@ -18,7 +18,8 @@
// Init session. Name of session is specific to Dolibarr instance.
$sessionname='DOLSESSID_'.md5($_SERVER["SERVER_NAME"].$_SERVER["DOCUMENT_ROOT"]);
if (! empty($conf->global->MAIN_SESSION_TIMEOUT)) ini_set('session.gc_maxlifetime',$conf->global->MAIN_SESSION_TIMEOUT);
$sessiontimeout='DOLSESSTIMEOUT_'.md5($_SERVER["SERVER_NAME"].$_SERVER["DOCUMENT_ROOT"]);
if (! empty($_COOKIE[$sessiontimeout])) ini_set('session.gc_maxlifetime',$sessiontimeout);
session_name($sessionname);
session_start();
dol_syslog("Start session name=".$sessionname." Session id()=".session_id().", _SESSION['dol_login']=".$_SESSION["dol_login"].", ".ini_get("session.gc_maxlifetime"));

11
htdocs/cashdesk/index.php
View File

@ -15,19 +15,20 @@
* along with this program; if not, write to the Free Software
* Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
*/
include('../master.inc.php');
// Init session. Name of session is specific to Dolibarr instance.
$sessionname='DOLSESSID_'.md5($_SERVER["SERVER_NAME"].$_SERVER["DOCUMENT_ROOT"]);
if (! empty($conf->global->MAIN_SESSION_TIMEOUT)) ini_set('session.gc_maxlifetime',$conf->global->MAIN_SESSION_TIMEOUT);
$sessiontimeout='DOLSESSTIMEOUT_'.md5($_SERVER["SERVER_NAME"].$_SERVER["DOCUMENT_ROOT"]);
if (! empty($_COOKIE[$sessiontimeout])) ini_set('session.gc_maxlifetime',$sessiontimeout);
session_name($sessionname);
session_start();
dol_syslog("Start session name=".$sessionname." Session id()=".session_id().", _SESSION['dol_login']=".$_SESSION["dol_login"].", ".ini_get("session.gc_maxlifetime"));
if ( $_SESSION['uid'] > 0 ) {
include('../master.inc.php');
if ( $_SESSION['uid'] > 0 )
{
header ('Location: affIndex.php');
exit;
}
?>

1
htdocs/langs/en_US/admin.lang
View File

@ -9,6 +9,7 @@ VersionDevelopment=Development
VersionUnknown=Unknown
VersionRecommanded=Recommended
SessionId=Session ID
SessionSavePath=Storage session localization
HTMLCharset=Charset for generated HTML pages
DBStoringCharset=Database charset to store data
DBSortingCharset=Database charset to sort data

1
htdocs/langs/fr_FR/admin.lang
View File

@ -9,6 +9,7 @@ VersionDevelopment = Développement
VersionUnknown = Inconnue
VersionRecommanded = Recommandé
SessionId = ID Session
SessionSavePath=Localisation sauvegarde sessions
HTMLCharset = Charset des pages HTML générées
DBStoringCharset = Charset base pour stockage données
DBSortingCharset = Charset base pour tri données

15
htdocs/lib/antispamimage.php
View File

@ -31,18 +31,17 @@ if (! defined('NOREQUIRESOC')) define('NOREQUIRESOC','1');
// This is to make Dolibarr working with Plesk
set_include_path($_SERVER['DOCUMENT_ROOT'].'/htdocs');
// Init session. Name of session is specific to Dolibarr instance.
$sessionname='DOLSESSID_'.md5($_SERVER["SERVER_NAME"].$_SERVER["DOCUMENT_ROOT"]);
$sessiontimeout='DOLSESSTIMEOUT_'.md5($_SERVER["SERVER_NAME"].$_SERVER["DOCUMENT_ROOT"]);
if (! empty($_COOKIE[$sessiontimeout])) ini_set('session.gc_maxlifetime',$sessiontimeout);
session_name($sessionname);
session_start();
require_once("../master.inc.php");
require_once DOL_DOCUMENT_ROOT.'/../external-libs/Artichow/Artichow.cfg.php';
require_once ARTICHOW."/AntiSpam.class.php";
// Init session. Name of session is specific to Dolibarr instance.
$sessionname='DOLSESSID_'.md5($_SERVER["SERVER_NAME"].$_SERVER["DOCUMENT_ROOT"]);
if (! empty($conf->global->MAIN_SESSION_TIMEOUT)) ini_set('session.gc_maxlifetime',$conf->global->MAIN_SESSION_TIMEOUT);
session_name($sessionname);
session_start();
dol_syslog("Start session name=".$sessionname." Session id()=".session_id().", _SESSION['dol_login']=".$_SESSION["dol_login"].", ".ini_get("session.gc_maxlifetime"));
// On cree l'objet anti-spam
$object = new AntiSpam();

21
htdocs/main.inc.php
View File

@ -119,21 +119,20 @@ if (! defined('NOCSRFCHECK') && ! empty($_SERVER['HTTP_HOST']) && ! empty($_SERV
// This is to make Dolibarr working with Plesk
set_include_path($_SERVER['DOCUMENT_ROOT'].'/htdocs');
// Security session
// TODO MULTICOMP Must fix this. Using 2 session in same page will create problems on some session handlers
$sessionname="DOLSESSID_SECURITY";
// Init session. Name of session is specific to Dolibarr instance.
$sessionname='DOLSESSID_'.md5($_SERVER["SERVER_NAME"].$_SERVER["DOCUMENT_ROOT"]);
if (! empty($_SERVER["DOLSESSTIMEOUT"])) ini_set('session.gc_maxlifetime',$_SERVER["DOLSESSTIMEOUT"]);
if (! empty($_COOKIE["DOLSESSTIMEOUT"])) ini_set('session.gc_maxlifetime',$_REQUEST["DOLSESSTIMEOUT"]);
session_name($sessionname);
session_start();
// Security. TODO Check if this is usefull.
if (!isset($_SESSION['cryptkey'])) $_SESSION['cryptkey'] = mt_rand();
// Set and init common variables
// This include will set: config file variable $dolibarr_xxx, $conf, $langs and $mysoc objects
require_once("master.inc.php");
//Fermeture de la session de securite, ses donnees sont sauvegardees
// TODO MULTICOMP Must fix this. Using 2 session in same page will create problems on some web servers.
session_write_close();
// Check if HTTPS
if ($conf->file->main_force_https)
{
@ -173,20 +172,12 @@ if (! defined('NOREQUIREHTML')) require_once(DOL_DOCUMENT_ROOT ."/html.form.clas
if (! defined('NOREQUIREAJAX') && $conf->use_javascript_ajax) require_once(DOL_DOCUMENT_ROOT.'/lib/ajax.lib.php'); // Need 20ko memory
//stopwithmem();
// Init session. Name of session is specific to Dolibarr instance.
$sessionname='DOLSESSID_'.md5($_SERVER["SERVER_NAME"].$_SERVER["DOCUMENT_ROOT"]);
if (! empty($conf->global->MAIN_SESSION_TIMEOUT)) ini_set('session.gc_maxlifetime',$conf->global->MAIN_SESSION_TIMEOUT);
session_name($sessionname);
session_start();
dol_syslog("Start session name=".$sessionname." Session id()=".session_id().", _SESSION['dol_login']=".(isset($_SESSION["dol_login"])?$_SESSION["dol_login"]:'').", ".ini_get("session.gc_maxlifetime"));
// Creation d'un jeton contre les failles CSRF
$token = md5(uniqid(mt_rand(),TRUE)); // Genere un hash d'un nombre aleatoire
// roulement des jetons car cree a chaque appel
if (isset($_SESSION['token_level_1'])) $_SESSION['token_level_2'] = $_SESSION['token_level_1'];
if (isset($_SESSION['newtoken'])) $_SESSION['token_level_1'] = $_SESSION['newtoken'];
$_SESSION['newtoken'] = $token;
// Verification de la presence et de la validite du jeton
if (isset($_POST['token']) && isset($_SESSION['token_level_1']) && isset($_SESSION['token_level_2']))
{

43
htdocs/master.inc.php
View File

@ -205,32 +205,35 @@ if (! defined('NOREQUIREUSER'))
*/
if (! defined('NOREQUIREDB'))
{
// TODO MULTICOMP Must fix this. Using cookie object inside the master.inc.php
// should be forbidden. Must replace cookie usage with session to save
// a lot of code and avoid cookie forging.
$entityCookieName="DOLENTITYID_dolibarr";
// Retrieve the entity
if (isset($_POST["loginfunction"]) && isset($_POST["entity"])) // Just after a login page
if (session_id() && isset($_SESSION["dol_entity"])) // Entity inside an opened session
{
$conf->entity = $_POST["entity"];
}
else if (isset($_COOKIE[$entityCookieName])) // Inside a browser navigation
{
include_once(DOL_DOCUMENT_ROOT."/core/cookie.class.php");
// Utilisation de $_SESSION['cryptkey'] comme cle de cryptage
$entityCookie = new DolCookie($_SESSION['cryptkey']);
$conf->entity = $entityCookie->_getCookie($entityCookieName);
}
elseif (session_id() && isset($_SESSION["dol_entity"])) // Inside an opened session
{
// TODO MULTICOMP This is not used for the moment as session is started after for the moment
$conf->entity = $_SESSION["dol_entity"];
}
elseif (isset($_ENV["dol_entity"])) // If inside a CLI script
elseif (isset($_ENV["dol_entity"])) // Entity inside a CLI script
{
$conf->entity = $_ENV["dol_entity"];
}
else // Entity from login page
{
if (isset($_POST["loginfunction"]) && isset($_POST["entity"])) // Just after a login page
{
$conf->entity = $_POST["entity"];
}
else
{
// TODO MULTICOMP This can be removed now.
// Cookie usage replaced with session to save a lot of code and avoid cookie forging.
$entityCookieName="DOLENTITYID_dolibarr";
if (isset($_COOKIE[$entityCookieName])) // Should not be used anymore
{
include_once(DOL_DOCUMENT_ROOT."/core/cookie.class.php");
// Utilisation de $_SESSION['cryptkey'] comme cle de cryptage
$entityCookie = new DolCookie($_SESSION['cryptkey']);
$conf->entity = $entityCookie->_getCookie($entityCookieName);
}
}
}
$conf->setValues($db);
}

6
htdocs/public/paybox/newpayment.php
View File

@ -26,12 +26,14 @@
* \version $Id$
*/
// Creation d'un jeton contre les failles CSRF
// Init session. Name of session is specific to Dolibarr instance.
$sessionname='DOLSESSID_'.md5($_SERVER["SERVER_NAME"].$_SERVER["DOCUMENT_ROOT"]);
$sessiontimeout='DOLSESSTIMEOUT_'.md5($_SERVER["SERVER_NAME"].$_SERVER["DOCUMENT_ROOT"]);
if (! empty($_COOKIE[$sessiontimeout])) ini_set('session.gc_maxlifetime',$sessiontimeout);
session_name($sessionname);
session_start();
// Creation d'un jeton contre les failles CSRF
$token = md5(uniqid(mt_rand(),TRUE)); // Genere un hash d'un nombre aleatoire
// roulement des jetons car cree a chaque appel
if (isset($_SESSION['newtoken'])) $_SESSION['token'] = $_SESSION['newtoken'];

11
htdocs/user/logout.php
View File

@ -49,19 +49,12 @@ session_unregister("dol_entity");
// Destroy session
$sessionname='DOLSESSID_'.md5($_SERVER["SERVER_NAME"].$_SERVER["DOCUMENT_ROOT"]);
if (! empty($conf->global->MAIN_SESSION_TIMEOUT)) ini_set('session.gc_maxlifetime',$conf->global->MAIN_SESSION_TIMEOUT);
$sessiontimeout='DOLSESSTIMEOUT_'.md5($_SERVER["SERVER_NAME"].$_SERVER["DOCUMENT_ROOT"]);
if (! empty($_COOKIE[$sessiontimeout])) ini_set('session.gc_maxlifetime',$sessiontimeout);
session_name($sessionname);
session_destroy();
dol_syslog("End of session ".$sessionname);
// Destroy security session
// TODO MULTICOMP Must fix this. Using 2 session in same page will create problems on some PHP session handlers.
$sessionname="DOLSESSID_SECURITY";
session_name($sessionname);
session_destroy();
dol_syslog("End of session ".$sessionname);
// Destroy entity cookie
// TODO MULTICOMP Must fix this. Use session instead of cookie.
if ($conf->multicompany->enabled)

14
htdocs/user/passwordforgotten.php
View File

@ -25,18 +25,18 @@
// This is to make Dolibarr working with Plesk
set_include_path($_SERVER['DOCUMENT_ROOT'].'/htdocs');
// Init session. Name of session is specific to Dolibarr instance.
$sessionname='DOLSESSID_'.md5($_SERVER["SERVER_NAME"].$_SERVER["DOCUMENT_ROOT"]);
$sessiontimeout='DOLSESSTIMEOUT_'.md5($_SERVER["SERVER_NAME"].$_SERVER["DOCUMENT_ROOT"]);
if (! empty($_COOKIE[$sessiontimeout])) ini_set('session.gc_maxlifetime',$sessiontimeout);
session_name($sessionname);
session_start();
require("../master.inc.php");
require_once(DOL_DOCUMENT_ROOT."/contact.class.php");
require_once(DOL_DOCUMENT_ROOT."/lib/ldap.class.php");
require_once(DOL_DOCUMENT_ROOT."/lib/usergroups.lib.php");
// Init session. Name of session is specific to Dolibarr instance.
$sessionname='DOLSESSID_'.md5($_SERVER["SERVER_NAME"].$_SERVER["DOCUMENT_ROOT"]);
if (! empty($conf->global->MAIN_SESSION_TIMEOUT)) ini_set('session.gc_maxlifetime',$conf->global->MAIN_SESSION_TIMEOUT);
session_name($sessionname);
session_start();
dol_syslog("Start session name=".$sessionname." Session id()=".session_id().", _SESSION['dol_login']=".$_SESSION["dol_login"].", ".ini_get("session.gc_maxlifetime"));
$user->getrights('user');
$langs->load("main");