archive/piwigo
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Improve security of sessions:

Browse source 
- use only cookies to store session id on client side
- use default php session system with database handler to store sessions on server side

git-svn-id: http://piwigo.org/svn/trunk@1004 68402e56-0260-453c-a942-63ccdbb3a9ee
This commit is contained in:
nikrou 2006-01-15 13:45:42 +00:00
parent b223bb495d
commit c3397a2c73
43 changed files with 252 additions and 354 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
about.php
View file

@ -45,7 +45,7 @@ $template->set_filenames(
$template->assign_vars(
array(
'U_HOME' => add_session_id(PHPWG_ROOT_PATH.'category.php')
'U_HOME' => PHPWG_ROOT_PATH.'category.php'
)
);

48
admin.php
View file

@ -65,29 +65,29 @@ $template->set_filenames(array('admin' => 'admin.tpl'));
$template->assign_vars(
array(
'U_HISTORY'=>add_session_id($link_start.'stats' ),
'U_FAQ'=>add_session_id($link_start.'help' ),
'U_SITES'=>add_session_id($link_start.'remote_site'),
'U_MAINTENANCE'=>add_session_id($link_start.'maintenance'),
'U_CONFIG_GENERAL'=>add_session_id($conf_link.'general' ),
'U_CONFIG_COMMENTS'=>add_session_id($conf_link.'comments' ),
'U_CONFIG_DISPLAY'=>add_session_id($conf_link.'default' ),
'U_CATEGORIES'=>add_session_id($link_start.'cat_list' ),
'U_MOVE'=>add_session_id($link_start.'cat_move' ),
'U_CAT_UPLOAD'=>add_session_id($opt_link.'upload'),
'U_CAT_COMMENTS'=>add_session_id($opt_link.'comments'),
'U_CAT_VISIBLE'=>add_session_id($opt_link.'visible'),
'U_CAT_STATUS'=>add_session_id($opt_link.'status'),
'U_CAT_OPTIONS'=>add_session_id($link_start.'cat_options'),
'U_CAT_UPDATE'=>add_session_id($link_start.'update'),
'U_WAITING'=>add_session_id($link_start.'waiting' ),
'U_COMMENTS'=>add_session_id($link_start.'comments' ),
'U_CADDIE'=>add_session_id($link_start.'element_set&cat=caddie'),
'U_THUMBNAILS'=>add_session_id($link_start.'thumbnail' ),
'U_USERS'=>add_session_id($link_start.'user_list' ),
'U_GROUPS'=>add_session_id($link_start.'group_list' ),
'U_RETURN'=>add_session_id(PHPWG_ROOT_PATH.'category.php'),
'U_ADMIN'=>add_session_id( PHPWG_ROOT_PATH.'admin.php' ),
'U_HISTORY'=> $link_start.'stats',
'U_FAQ'=> $link_start.'help',
'U_SITES'=> $link_start.'remote_site',
'U_MAINTENANCE'=> $link_start.'maintenance',
'U_CONFIG_GENERAL'=> $conf_link.'general',
'U_CONFIG_COMMENTS'=> $conf_link.'comments',
'U_CONFIG_DISPLAY'=> $conf_link.'default',
'U_CATEGORIES'=> $link_start.'cat_list',
'U_MOVE'=> $link_start.'cat_move',
'U_CAT_UPLOAD'=> $opt_link.'upload',
'U_CAT_COMMENTS'=> $opt_link.'comments',
'U_CAT_VISIBLE'=> $opt_link.'visible',
'U_CAT_STATUS'=> $opt_link.'status',
'U_CAT_OPTIONS'=> $link_start.'cat_options',
'U_CAT_UPDATE'=> $link_start.'update',
'U_WAITING'=> $link_start.'waiting',
'U_COMMENTS'=> $link_start.'comments',
'U_CADDIE'=> $link_start.'element_set&cat=caddie',
'U_THUMBNAILS'=> $link_start.'thumbnail',
'U_USERS'=> $link_start.'user_list',
'U_GROUPS'=> $link_start.'group_list',
'U_RETURN'=> PHPWG_ROOT_PATH.'category.php'
'U_ADMIN'=> PHPWG_ROOT_PATH.'admin.php',
'L_ADMIN' => $lang['admin'],
'L_ADMIN_HINT' => $lang['hint_admin']
)
@ -98,7 +98,7 @@ if ($conf['allow_random_representative'])
$template->assign_block_vars(
'representative',
array(
'URL' => add_session_id($opt_link.'representative')
'URL' => $opt_link.'representative'
)
);
}

21
admin/cat_list.php
View file

@ -65,7 +65,7 @@ function save_categories_order($categories)
$categories = array();
$base_url = PHPWG_ROOT_PATH.'admin.php?page=cat_list';
$navigation = '<a class="" href="'.add_session_id($base_url).'">';
$navigation = '<a class="" href="'.$base_url.'">';
$navigation.= $lang['home'];
$navigation.= '</a>';
@ -238,7 +238,7 @@ else
$template->assign_vars(array(
'CATEGORIES_NAV'=>$navigation,
'NEXT_RANK'=>$next_rank,
'F_ACTION'=>add_session_id($form_action),
'F_ACTION'=>$form_action,
'L_ADD_VIRTUAL'=>$lang['cat_add'],
'L_SUBMIT'=>$lang['submit'],
@ -318,14 +318,9 @@ foreach ($categories as $category)
'ID'=>$category['id'],
'RANK'=>$category['rank']*10,
'U_JUMPTO'=>
add_session_id(PHPWG_ROOT_PATH.'category.php?cat='.$category['id']),
'U_CHILDREN'=>
add_session_id($cat_list_url.'&amp;parent_id='.$category['id']),
'U_EDIT'=>
add_session_id($base_url.'cat_modify&amp;cat_id='.$category['id'])
'U_JUMPTO'=>PHPWG_ROOT_PATH.'category.php?cat='.$category['id'],
'U_CHILDREN'=>$cat_list_url.'&amp;parent_id='.$category['id'],
'U_EDIT'=>$base_url.'cat_modify&amp;cat_id='.$category['id']
)
);
@ -334,7 +329,7 @@ foreach ($categories as $category)
$template->assign_block_vars(
'category.delete',
array(
'URL'=>add_session_id($self_url.'&amp;delete='.$category['id'])
'URL'=>$self_url.'&amp;delete='.$category['id']
)
);
}
@ -344,7 +339,7 @@ foreach ($categories as $category)
$template->assign_block_vars(
'category.elements',
array(
'URL'=>add_session_id($base_url.'element_set&amp;cat='.$category['id'])
'URL'=>$base_url.'element_set&amp;cat='.$category['id']
)
);
}
@ -354,7 +349,7 @@ foreach ($categories as $category)
$template->assign_block_vars(
'category.permissions',
array(
'URL'=>add_session_id($base_url.'cat_perm&amp;cat='.$category['id'])
'URL'=>$base_url.'cat_perm&amp;cat='.$category['id']
)
);
}

14
admin/cat_modify.php
View file

@ -171,13 +171,11 @@ $template->assign_vars(array(
'L_SUBMIT'=>$lang['submit'],
'L_SET_RANDOM_REPRESENTANT'=>$lang['cat_representant'],
'U_JUMPTO'=>
add_session_id(PHPWG_ROOT_PATH.'category.php?cat='.$category['id']),
'U_CHILDREN'=>
add_session_id($cat_list_url.'&amp;parent_id='.$category['id']),
'U_JUMPTO'=>PHPWG_ROOT_PATH.'category.php?cat='.$category['id'],
'U_CHILDREN'=>$cat_list_url.'&amp;parent_id='.$category['id'],
'U_HELP' => PHPWG_ROOT_PATH.'/popuphelp.php?page=cat_modify',
'F_ACTION'=>add_session_id($form_action)
'F_ACTION'=>$form_action
));
@ -186,7 +184,7 @@ if ('private' == $category['status'])
$template->assign_block_vars(
'permissions',
array(
'URL'=>add_session_id($base_url.'cat_perm&amp;cat='.$category['id'])
'URL'=>$base_url.'cat_perm&amp;cat='.$category['id']
)
);
}
@ -197,7 +195,7 @@ if ($category['nb_images'] > 0)
$template->assign_block_vars(
'elements',
array(
'URL'=>add_session_id($base_url.'element_set&amp;cat='.$category['id'])
'URL'=>$base_url.'element_set&amp;cat='.$category['id']
)
);
}
@ -267,7 +265,7 @@ else
$template->assign_block_vars(
'delete',
array(
'URL'=>add_session_id($self_url.'&amp;delete='.$category['id'])
'URL'=>$self_url.'&amp;delete='.$category['id']
)
);

2
admin/cat_move.php
View file

@ -68,7 +68,7 @@ $template->set_filenames(
$template->assign_vars(
array(
'F_ACTION' => add_session_id(PHPWG_ROOT_PATH.'admin.php?page=cat_move'),
'F_ACTION' => PHPWG_ROOT_PATH.'admin.php?page=cat_move',
)
);

2
admin/cat_options.php
View file

@ -153,7 +153,7 @@ $template->assign_vars(
'U_HELP' => PHPWG_ROOT_PATH.'/popuphelp.php?page=cat_options',
'F_ACTION'=>add_session_id($base_url.$page['section'])
'F_ACTION'=>$base_url.$page['section']
)
);

5
admin/cat_perm.php
View file

@ -207,10 +207,7 @@ $template->assign_vars(
'admin.php?page=cat_modify&amp;cat_id='
),
'U_HELP' => PHPWG_ROOT_PATH.'/popuphelp.php?page=cat_perm',
'F_ACTION' =>
add_session_id(
PHPWG_ROOT_PATH.'admin.php?page=cat_perm&amp;cat='.$page['cat']
)
'F_ACTION' => PHPWG_ROOT_PATH.'admin.php?page=cat_perm&amp;cat='.$page['cat']
)
);

6
admin/comments.php
View file

@ -117,7 +117,7 @@ $template->set_filenames(array('comments'=>'admin/comments.tpl'));
$template->assign_vars(
array(
'F_ACTION' => add_session_id(PHPWG_ROOT_PATH.'admin.php?page=comments')
'F_ACTION' => PHPWG_ROOT_PATH.'admin.php?page=comments'
)
);
@ -141,10 +141,8 @@ while ($row = mysql_fetch_array($result))
'comment',
array(
'U_PICTURE' =>
add_session_id(
PHPWG_ROOT_PATH.'admin.php?page=picture_modify'.
'&amp;image_id='.$row['image_id']
),
'&amp;image_id='.$row['image_id'],
'ID' => $row['id'],
'TN_SRC' => get_thumbnail_src($row['path'], @$row['tn_ext']),
'AUTHOR' => $row['author'],

2
admin/configuration.php
View file

@ -149,7 +149,7 @@ $template->assign_vars(
'U_HELP' => PHPWG_ROOT_PATH.'/popuphelp.php?page=configuration',
'F_ACTION'=>add_session_id($action)
'F_ACTION'=>$action
));
switch ($page['section'])

4
admin/element_set_unit.php
View file

@ -222,10 +222,8 @@ SELECT id,path,tn_ext,name,date_creation,comment,keywords,author,file
!empty($row['name']) ?
$row['name'] : get_name_from_file($row['file']),
'U_EDIT' =>
add_session_id(
PHPWG_ROOT_PATH.'admin.php?page=picture_modify'.
'&amp;image_id='.$row['id']
),
'&amp;image_id='.$row['id'],
'ID' => $row['id'],
'FILENAME' => $row['path'],
'TN_SRC' => $src,

3
admin/group_list.php
View file

@ -124,8 +124,7 @@ $template->set_filenames(array('group_list' => 'admin/group_list.tpl'));
$template->assign_vars(
array(
'F_ADD_ACTION' =>
add_session_id(PHPWG_ROOT_PATH.'admin.php?page=group_list')
'F_ADD_ACTION' => PHPWG_ROOT_PATH.'admin.php?page=group_list'
)
);

2
admin/group_perm.php
View file

@ -140,11 +140,9 @@ $template->assign_vars(
'L_CAT_OPTIONS_INFO'=>$lang['permuser_info'],
'F_ACTION' =>
add_session_id(
PHPWG_ROOT_PATH.
'admin.php?page=group_perm&amp;group_id='.
$page['group']
)
)
);

10
admin/intro.php
View file

@ -175,10 +175,8 @@ $template->assign_vars(
'DB_USERS' => sprintf(l10n('%d users'), $nb_users),
'DB_GROUPS' => sprintf(l10n('%d groups'), $nb_groups),
'DB_COMMENTS' => sprintf(l10n('%d comments'), $nb_comments),
'U_CHECK_UPGRADE' =>
add_session_id(PHPWG_ROOT_PATH.'admin.php?action=check_upgrade'),
'U_PHPINFO' =>
add_session_id(PHPWG_ROOT_PATH.'admin.php?action=phpinfo')
'U_CHECK_UPGRADE' => PHPWG_ROOT_PATH.'admin.php?action=check_upgrade',
'U_PHPINFO' => PHPWG_ROOT_PATH.'admin.php?action=phpinfo'
)
);
@ -215,7 +213,7 @@ if ($nb_waiting > 0)
$template->assign_block_vars(
'waiting',
array(
'URL' => add_session_id(PHPWG_ROOT_PATH.'admin.php?page=waiting'),
'URL' => PHPWG_ROOT_PATH.'admin.php?page=waiting',
'INFO' => sprintf(l10n('%d waiting for validation'), $nb_waiting)
)
);
@ -234,7 +232,7 @@ if ($nb_comments > 0)
$template->assign_block_vars(
'unvalidated',
array(
'URL' => add_session_id(PHPWG_ROOT_PATH.'admin.php?page=comments'),
'URL' => PHPWG_ROOT_PATH.'admin.php?page=comments',
'INFO' => sprintf(l10n('%d waiting for validation'), $nb_comments)
)
);

10
admin/maintenance.php
View file

@ -98,11 +98,11 @@ $start_url = PHPWG_ROOT_PATH.'admin.php?page=maintenance&amp;action=';
$template->assign_vars(
array(
'U_MAINT_CATEGORIES' => add_session_id($start_url.'categories'),
'U_MAINT_IMAGES' => add_session_id($start_url.'images'),
'U_MAINT_HISTORY' => add_session_id($start_url.'history'),
'U_MAINT_SESSIONS' => add_session_id($start_url.'sessions'),
'U_MAINT_FEEDS' => add_session_id($start_url.'feeds'),
'U_MAINT_CATEGORIES' => $start_url.'categories',
'U_MAINT_IMAGES' => $start_url.'images',
'U_MAINT_HISTORY' => $start_url.'history',
'U_MAINT_SESSIONS' => $start_url.'sessions',
'U_MAINT_FEEDS' => $start_url.'feeds',
'U_HELP' => PHPWG_ROOT_PATH.'/popuphelp.php?page=maintenance',
)
);

6
admin/picture_modify.php
View file

@ -195,12 +195,10 @@ $template->set_filenames(
$template->assign_vars(
array(
'U_SYNC' =>
add_session_id(
PHPWG_ROOT_PATH.'admin.php?page=picture_modify'.
'&amp;image_id='.$_GET['image_id'].
(isset($_GET['cat_id']) ? '&amp;cat_id='.$_GET['cat_id'] : '').
'&amp;sync_metadata=1'
),
'&amp;sync_metadata=1',
'PATH'=>$row['path'],
@ -230,10 +228,8 @@ $template->assign_vars(
stripslashes($_POST['description']) : @$row['comment'],
'F_ACTION' =>
add_session_id(
PHPWG_ROOT_PATH.'admin.php'
.get_query_string_diff(array('sync_metadata'))
)
)
);

12
admin/remote_site.php
View file

@ -515,7 +515,7 @@ $template->assign_vars(
'U_HELP' => PHPWG_ROOT_PATH.'/popuphelp.php?page=remote_site',
'F_ACTION'=>add_session_id(PHPWG_ROOT_PATH.'admin.php?page=remote_site')
'F_ACTION'=>PHPWG_ROOT_PATH.'admin.php?page=remote_site'
)
);
@ -686,7 +686,7 @@ else
'local',
array(
'URL' => $url,
'U_UPDATE' => add_session_id($base_url.'local_update')
'U_UPDATE' => $base_url.'local_update'
)
);
@ -731,10 +731,10 @@ while ($row = mysql_fetch_array($result))
'sites.site',
array(
'NAME' => $row['galleries_url'],
'U_GENERATE' => add_session_id($base_url.'generate'),
'U_UPDATE' => add_session_id($base_url.'update'),
'U_CLEAN' => add_session_id($base_url.'clean'),
'U_DELETE' => add_session_id($base_url.'delete')
'U_GENERATE' => $base_url.'generate',
'U_UPDATE' => $base_url.'update',
'U_CLEAN' => $base_url.'clean',
'U_DELETE' => $base_url.'delete'
)
);
}

10
admin/stats.php
View file

@ -62,7 +62,7 @@ if (isset($_GET['day']) && isset($_GET['month']) && isset($_GET['year']) )
$date_of_day=$_GET['day'].' '.$lang['month'][$_GET['month']].' '.$_GET['year'];
$title_page=$lang['stats_day_title'].' du '.$date_of_day;
$url_back = PHPWG_ROOT_PATH."admin.php?page=stats";
$url_back = add_session_id($url_back);
$url_back = $url_back;
$title_details='<a href='.$url_back.'>'.$lang['stats_day_title'].'</a>';
$title_day = $date_of_day;
}
@ -71,7 +71,7 @@ elseif ( isset($_GET['month']) && isset($_GET['year']) )
$date_of_day=$lang['month'][$_GET['month']].' '.$_GET['year'];
$title_page=$lang['stats_month_title'].' : '.$date_of_day;
$url_back = PHPWG_ROOT_PATH."admin.php?page=stats";
$url_back = add_session_id($url_back);
$url_back = $url_back;
$title_details='<a href='.$url_back.'>'.$lang['stats_day_title'].'</a>';
$title_day=$lang['today'];
}
@ -105,7 +105,7 @@ $template->assign_vars(array(
'L_STAT_FILE'=>$lang['stats_file'],
'L_STAT_PICTURE'=>$lang['stats_picture'],
'IMG_REPORT'=>add_session_id($url_img)
'IMG_REPORT'=>$url_img
));
//---------------------------------------------------------------- log history
@ -141,7 +141,7 @@ while ( $row = mysql_fetch_array( $result ) )
.'&amp;day='.$row['d']
;
$value = '<a href="'.add_session_id($url).'">';
$value = '<a href="'.$url.'">';
$value.= $row['d'].' ('.$week_day.')';
$value.= "</a>";
}
@ -160,7 +160,7 @@ while ( $row = mysql_fetch_array( $result ) )
.'&amp;month='.$row['m']
;
$value = '<a href="'.add_session_id($url).'">';
$value = '<a href="'.$url.'">';
$value.= $lang['month'][$row['m']].' '.$row['y'];
$value.= "</a>";
}

2
admin/thumbnail.php
View file

@ -358,7 +358,7 @@ if (count($remainings) > 0)
$template->assign_block_vars(
'params',
array(
'F_ACTION'=>add_session_id($form_url),
'F_ACTION'=>$form_url,
$gdlabel=>'checked="checked"',
$nlabel=>'checked="checked"',
'WIDTH_TN'=>$width,

6
admin/user_list.php
View file

@ -424,7 +424,7 @@ while ($row = mysql_fetch_array($result))
$template->set_filenames(array('user_list'=>'admin/user_list.tpl'));
$base_url = add_session_id(PHPWG_ROOT_PATH.'admin.php?page=user_list');
$base_url = PHPWG_ROOT_PATH.'admin.php?page=user_list';
if (isset($_GET['start']) and is_numeric($_GET['start']))
{
@ -790,8 +790,8 @@ foreach ($page['filtered_users'] as $num => $local_user)
'CLASS' => ($num % 2 == 1) ? 'row2' : 'row1',
'ID' => $local_user['id'],
'CHECKED' => $checked,
'U_MOD' => add_session_id($profile_url.$local_user['id']),
'U_PERM' => add_session_id($perm_url.$local_user['id']),
'U_MOD' => $profile_url.$local_user['id'],
'U_PERM' => $perm_url.$local_user['id'],
'USERNAME' => $local_user['username'],
'STATUS' => $lang['user_status_'.$local_user['status']],
'EMAIL' => isset($local_user['email']) ? $local_user['email'] : '',

2
admin/user_perm.php
View file

@ -133,11 +133,9 @@ $template->assign_vars(
'L_CAT_OPTIONS_FALSE'=>$lang['forbidden'],
'F_ACTION' =>
add_session_id(
PHPWG_ROOT_PATH.
'admin.php?page=user_perm'.
'&amp;user_id='.$page['user']
)
)
);

2
admin/waiting.php
View file

@ -148,7 +148,7 @@ $template->assign_vars(array(
'L_RESET'=>$lang['reset'],
'L_DELETE'=>$lang['delete'],
'F_ACTION'=>add_session_id(str_replace( '&', '&amp;', $_SERVER['REQUEST_URI'] ))
'F_ACTION'=>str_replace( '&', '&amp;', $_SERVER['REQUEST_URI'])
));
//---------------------------------------------------------------- form display

47
category.php
View file

@ -31,10 +31,13 @@ include_once( PHPWG_ROOT_PATH.'include/common.inc.php' );
//---------------------------------------------------------------------- logout
if ( isset( $_GET['act'] )
and $_GET['act'] == 'logout'
and isset( $_COOKIE['id'] ) )
and isset( $_COOKIE[session_name()] ) )
{
// cookie deletion if exists
setcookie( 'id', '', 0, cookie_path() );
$_SESSION = array();
session_unset();
session_destroy();
setcookie(session_name(),'',0,'/');
$url = 'category.php';
redirect( $url );
}
@ -163,15 +166,15 @@ $template->assign_vars(
'L_PROFILE_HINT' => $lang['hint_customize'],
'L_REMEMBER_ME' => $lang['remember_me'],
'F_IDENTIFY' => add_session_id( PHPWG_ROOT_PATH.'identification.php' ),
'F_IDENTIFY' => PHPWG_ROOT_PATH.'identification.php',
'T_RECENT' => $icon_recent,
'U_HOME' => add_session_id( PHPWG_ROOT_PATH.'category.php' ),
'U_REGISTER' => add_session_id( PHPWG_ROOT_PATH.'register.php' ),
'U_LOST_PASSWORD' => add_session_id(PHPWG_ROOT_PATH.'password.php'),
'U_HOME' => PHPWG_ROOT_PATH.'category.php',
'U_REGISTER' => PHPWG_ROOT_PATH.'register.php',
'U_LOST_PASSWORD' => PHPWG_ROOT_PATH.'password.php',
'U_LOGOUT' => PHPWG_ROOT_PATH.'category.php?act=logout',
'U_ADMIN'=>add_session_id( PHPWG_ROOT_PATH.'admin.php' ),
'U_PROFILE'=>add_session_id(PHPWG_ROOT_PATH.'profile.php')
'U_ADMIN'=> PHPWG_ROOT_PATH.'admin.php',
'U_PROFILE'=> PHPWG_ROOT_PATH.'profile.php'
)
);
//-------------------------------------------------------------- external links
@ -198,7 +201,7 @@ if ( !$user['is_the_guest'] )
$template->assign_block_vars(
'special_cat',
array(
'URL' => add_session_id(PHPWG_ROOT_PATH.'category.php?cat=fav'),
'URL' => PHPWG_ROOT_PATH.'category.php?cat=fav',
'TITLE' => $lang['favorite_cat_hint'],
'NAME' => $lang['favorite_cat']
));
@ -207,7 +210,7 @@ if ( !$user['is_the_guest'] )
$template->assign_block_vars(
'special_cat',
array(
'URL' => add_session_id(PHPWG_ROOT_PATH.'category.php?cat=most_visited'),
'URL' => PHPWG_ROOT_PATH.'category.php?cat=most_visited',
'TITLE' => $lang['most_visited_cat_hint'],
'NAME' => $lang['most_visited_cat']
));
@ -217,7 +220,7 @@ if ($conf['rate'])
$template->assign_block_vars(
'special_cat',
array(
'URL' => add_session_id(PHPWG_ROOT_PATH.'category.php?cat=best_rated'),
'URL' => PHPWG_ROOT_PATH.'category.php?cat=best_rated',
'TITLE' => $lang['best_rated_cat_hint'],
'NAME' => $lang['best_rated_cat']
)
@ -227,7 +230,7 @@ if ($conf['rate'])
$template->assign_block_vars(
'special_cat',
array(
'URL' => add_session_id(PHPWG_ROOT_PATH.'random.php'),
'URL' => PHPWG_ROOT_PATH.'random.php',
'TITLE' => $lang['random_cat_hint'],
'NAME' => $lang['random_cat']
));
@ -235,7 +238,7 @@ $template->assign_block_vars(
$template->assign_block_vars(
'special_cat',
array(
'URL' => add_session_id(PHPWG_ROOT_PATH.'category.php?cat=recent_pics'),
'URL' => PHPWG_ROOT_PATH.'category.php?cat=recent_pics',
'TITLE' => $lang['recent_pics_cat_hint'],
'NAME' => $lang['recent_pics_cat']
));
@ -243,7 +246,7 @@ $template->assign_block_vars(
$template->assign_block_vars(
'special_cat',
array(
'URL' => add_session_id(PHPWG_ROOT_PATH.'category.php?cat=recent_cats'),
'URL' => PHPWG_ROOT_PATH.'category.php?cat=recent_cats',
'TITLE' => $lang['recent_cats_cat_hint'],
'NAME' => $lang['recent_cats_cat']
));
@ -251,7 +254,7 @@ $template->assign_block_vars(
$template->assign_block_vars(
'special_cat',
array(
'URL' => add_session_id(PHPWG_ROOT_PATH.'category.php?cat=calendar'),
'URL' => PHPWG_ROOT_PATH.'category.php?cat=calendar',
'TITLE' => $lang['calendar_hint'],
'NAME' => $lang['calendar']
));
@ -290,21 +293,21 @@ else
$template->assign_block_vars('summary', array(
'TITLE'=>$lang['hint_search'],
'NAME'=>$lang['search'],
'U_SUMMARY'=>add_session_id( 'search.php' ),
'U_SUMMARY'=> 'search.php',
));
// comments link
$template->assign_block_vars('summary', array(
'TITLE'=>$lang['hint_comments'],
'NAME'=>$lang['comments'],
'U_SUMMARY'=>add_session_id( 'comments.php' ),
'U_SUMMARY'=> 'comments.php',
));
// about link
$template->assign_block_vars('summary', array(
'TITLE'=>$lang['about_page_title'],
'NAME'=>$lang['About'],
'U_SUMMARY'=>add_session_id( 'about.php?'.str_replace( '&', '&amp;', $_SERVER['QUERY_STRING'] ) )
'U_SUMMARY'=> 'about.php?'.str_replace( '&', '&amp;', $_SERVER['QUERY_STRING'] )
));
// notification
@ -313,7 +316,7 @@ $template->assign_block_vars(
array(
'TITLE'=>l10n('notification'),
'NAME'=>l10n('Notification'),
'U_SUMMARY'=>add_session_id(PHPWG_ROOT_PATH.'notification.php')
'U_SUMMARY'=> PHPWG_ROOT_PATH.'notification.php'
));
if (isset($page['cat'])
@ -324,10 +327,8 @@ if (isset($page['cat'])
'edit',
array(
'URL' =>
add_session_id(
PHPWG_ROOT_PATH.'admin.php?page=cat_modify'
.'&amp;cat_id='.$page['cat']
)
)
);
}
@ -352,10 +353,8 @@ if (isset($page['cat'])
'caddie',
array(
'URL' =>
add_session_id(
PHPWG_ROOT_PATH.'category.php'
.get_query_string_diff(array('caddie')).'&amp;caddie=1')
)
);
}
}
@ -383,7 +382,7 @@ if ( isset ( $page['cat'] ) )
$url = PHPWG_ROOT_PATH.'upload.php?cat='.$page['cat'];
$template->assign_block_vars(
'upload',
array('U_UPLOAD'=>add_session_id( $url ))
array('U_UPLOAD'=> $url )
);
}

6
comments.php
View file

@ -179,7 +179,7 @@ $template->assign_vars(
'F_KEYWORD'=>@$_GET['keyword'],
'F_AUTHOR'=>@$_GET['author'],
'U_HOME' => add_session_id(PHPWG_ROOT_PATH.'category.php')
'U_HOME' => PHPWG_ROOT_PATH.'category.php'
)
);
@ -414,7 +414,7 @@ SELECT id, uppercats
array(
'TITLE_IMG'=>$name,
'I_THUMB'=>$thumbnail_src,
'U_THUMB'=>add_session_id($url)
'U_THUMB'=>$url
));
$author = $comment['author'];
@ -426,7 +426,7 @@ SELECT id, uppercats
$template->assign_block_vars(
'comment',
array(
'U_PICTURE' => add_session_id($url),
'U_PICTURE' => $url,
'TN_SRC' => $thumbnail_src,
'AUTHOR' => $author,
'DATE'=>format_date($comment['date'],'mysql_datetime',true),

13
identification.php
View file

@ -51,8 +51,9 @@ SELECT '.$conf['user_fields']['id'].' AS id,
{
$session_length = $conf['remember_me_length'];
}
$session_id = session_create($row['id'], $session_length);
redirect('category.php?id='.$session_id);
session_start();
$_SESSION['id'] = $row['id'];
redirect('category.php');
}
else
{
@ -80,11 +81,11 @@ $template->assign_vars(
'L_FORGET' => $lang['ident_forgotten_password'],
'L_REMEMBER_ME'=>$lang['remember_me'],
'U_REGISTER' => add_session_id(PHPWG_ROOT_PATH.'register.php'),
'U_LOST_PASSWORD' => add_session_id(PHPWG_ROOT_PATH.'password.php'),
'U_HOME' => add_session_id(PHPWG_ROOT_PATH.'category.php'),
'U_REGISTER' => PHPWG_ROOT_PATH.'register.php',
'U_LOST_PASSWORD' => PHPWG_ROOT_PATH.'password.php',
'U_HOME' => PHPWG_ROOT_PATH.'category.php',
'F_LOGIN_ACTION' => add_session_id(PHPWG_ROOT_PATH.'identification.php')
'F_LOGIN_ACTION' => PHPWG_ROOT_PATH.'identification.php'
));
if ($conf['authorize_remembering'])

11
include/category_calendar.inc.php
View file

@ -67,7 +67,6 @@ foreach ($calendar_years as $calendar_year => $nb_picture_year)
{
$url = PHPWG_ROOT_PATH.'category.php?cat=calendar';
$url.= '&amp;year='.$calendar_year;
$url = add_session_id($url);
$years_nav_bar.= ' <a href="'.$url.'">'.$calendar_year.'</a>';
}
}
@ -124,7 +123,7 @@ SELECT DISTINCT(MONTH('.$conf['calendar_datefield'].')) AS month
$url = PHPWG_ROOT_PATH.'category.php?cat=calendar&amp;month=';
$url.= $page['calendar_year'].'.'.sprintf('%02s', $calendar_month);
$months_nav_bar.= ' ';
$months_nav_bar.= '<a href="'.add_session_id($url).'">';
$months_nav_bar.= '<a href="'.$url.'">';
$months_nav_bar.= $lang['month'][(int)$calendar_month];
$months_nav_bar.= '</a>';
}
@ -248,7 +247,7 @@ SELECT file,tn_ext,'.$conf['calendar_datefield'].',path
'IMAGE_ALT'=>$row['file'],
'IMAGE_TITLE'=>$thumbnail_title,
'U_IMG_LINK'=>add_session_id($url_link)
'U_IMG_LINK'=>$url_link
)
);
@ -308,7 +307,7 @@ SELECT file,tn_ext,'.$conf['calendar_datefield'].',path
'IMAGE_ALT'=>$row['file'],
'IMAGE_TITLE'=>$thumbnail_title,
'U_IMG_LINK'=>add_session_id($url_link)
'U_IMG_LINK'=>$url_link
)
);
@ -362,7 +361,7 @@ SELECT file,tn_ext,'.$conf['calendar_datefield'].',path
'IMAGE_ALT'=>$row['file'],
'IMAGE_TITLE'=>$thumbnail_title,
'U_IMG_LINK'=>add_session_id($url_link)
'U_IMG_LINK'=>$url_link
)
);
@ -436,7 +435,7 @@ SELECT file,tn_ext,'.$conf['calendar_datefield'].',path
'IMAGE_ALT'=>$row['file'],
'IMAGE_TITLE'=>$thumbnail_title,
'U_IMG_LINK'=>add_session_id($url_link)
'U_IMG_LINK'=>$url_link
)
);

2
include/category_default.inc.php
View file

@ -89,7 +89,7 @@ while ($row = mysql_fetch_array($result))
'IMAGE_TITLE' => $thumbnail_title,
'IMAGE_TS' => get_icon($row['date_available']),
'U_IMG_LINK' => add_session_id($url_link)
'U_IMG_LINK' => $url_link
)
);

2
include/category_recent_cats.inc.php
View file

@ -78,7 +78,7 @@ while ( $row = mysql_fetch_array( $result ) )
'IMAGE_ALT' => $row['file'],
'IMAGE_TITLE' => $lang['hint_category'],
'U_IMG_LINK' => add_session_id($url_link)
'U_IMG_LINK' => $url_link
)
);

2
include/category_subcats.inc.php
View file

@ -152,7 +152,7 @@ SELECT id, path, tn_ext
'IMAGE_TITLE' => $lang['hint_category'],
'IMAGE_TS' => get_icon(@$item['date_last']),
'U_IMG_LINK' =>
add_session_id(PHPWG_ROOT_PATH.'category.php?cat='.$item['category'])
PHPWG_ROOT_PATH.'category.php?cat='.$item['category']
)
);

25
include/config_default.inc.php
View file

@ -264,6 +264,21 @@ $conf['use_exif_mapping'] = array(
// | sessions |
// +-----------------------------------------------------------------------+
// specifies to use cookie to store the session id on client side
$conf['session_use_cookies'] = 1;
// specifies to only use cookie to store the session id on client side
$conf['session_use_only_cookies'] = 1;
// do not use transparent session id support
$conf['session_use_trans_sid'] = 0;
// specifies the name of the session which is used as cookie name
$conf['session_name'] = 'pwg_id';
// comment the line below to use file handler for sessions.
$conf['session_save_handler'] = 'db';
// authorize_remembering : permits user to stay logged for a long time. It
// creates a cookie on client side.
$conf['authorize_remembering'] = true;
@ -275,16 +290,6 @@ $conf['remember_me_length'] = 31536000;
// session_length : time of validity for normal session, in seconds.
$conf['session_length'] = 3600;
// session_id_size : a session identifier is compound of alphanumeric
// characters and is case sensitive. Each character is among 62
// possibilities. The number of possible sessions is
// 62^$conf['session_id_size'].
//
// 62^5 = 916,132,832
// 62^10 = 839,299,365,868,340,224
//
$conf['session_id_size'] = 10;
// +-----------------------------------------------------------------------+
// | debug |
// +-----------------------------------------------------------------------+

2
include/functions_category.inc.php
View file

@ -47,7 +47,7 @@ function check_restrictions($category_id)
if (in_array($category_id, explode(',', $user['forbidden_categories'])))
{
echo '<div style="text-align:center;">'.$lang['access_forbiden'].'<br />';
echo '<a href="'.add_session_id( './category.php' ).'">';
echo '<a href="./category.php">';
echo $lang['thumbnails'].'</a></div>';
exit();
}

20
include/functions_html.inc.php
View file

@ -81,7 +81,7 @@ function create_navigation_bar($url, $nb_element, $start,
if ($cur_page != 1)
{
$navbar.= '<a href="';
$navbar.= add_session_id($url.'&amp;start=0');
$navbar.= $url.'&amp;start=0';
$navbar.= '" class="'.$link_class.'">'.$lang['first_page'];
$navbar.= '</a>';
}
@ -95,7 +95,7 @@ function create_navigation_bar($url, $nb_element, $start,
{
$previous = $start - $nb_element_page;
$navbar.= '<a href="';
$navbar.= add_session_id( $url.'&amp;start='.$previous );
$navbar.= $url.'&amp;start='.$previous;
$navbar.= '" class="'.$link_class.'">'.$lang['previous_page'];
$navbar.= '</a>';
}
@ -108,7 +108,7 @@ function create_navigation_bar($url, $nb_element, $start,
if ($cur_page > $pages_around + 1)
{
$navbar.= '&nbsp;<a href="';
$navbar.= add_session_id($url.'&amp;start=0');
$navbar.= $url.'&amp;start=0';
$navbar.= '" class="'.$link_class.'">1</a>';
if ($cur_page > $pages_around + 2)
{
@ -129,7 +129,7 @@ function create_navigation_bar($url, $nb_element, $start,
{
$temp_start = ($i - 1) * $nb_element_page;
$navbar.= '&nbsp;<a href="';
$navbar.= add_session_id($url.'&amp;start='.$temp_start);
$navbar.= $url.'&amp;start='.$temp_start;
$navbar.= '" class="'.$link_class.'">'.$i.'</a>';
}
else
@ -147,7 +147,7 @@ function create_navigation_bar($url, $nb_element, $start,
$navbar.= ' ...';
}
$navbar.= ' <a href="';
$navbar.= add_session_id($url.'&amp;start='.$temp_start);
$navbar.= $url.'&amp;start='.$temp_start;
$navbar.= '" class="'.$link_class.'">'.$maximum.'</a>';
}
@ -158,7 +158,7 @@ function create_navigation_bar($url, $nb_element, $start,
{
$next = $start + $nb_element_page;
$navbar.= '<a href="';
$navbar.= add_session_id( $url.'&amp;start='.$next );
$navbar.= $url.'&amp;start='.$next;
$navbar.= '" class="'.$link_class.'">'.$lang['next_page'].'</a>';
}
else
@ -172,7 +172,7 @@ function create_navigation_bar($url, $nb_element, $start,
{
$temp_start = ($maximum - 1) * $nb_element_page;
$navbar.= '<a href="';
$navbar.= add_session_id($url.'&amp;start='.$temp_start);
$navbar.= $url.'&amp;start='.$temp_start;
$navbar.= '" class="'.$link_class.'">'.$lang['last_page'];
$navbar.= '</a>';
}
@ -241,7 +241,7 @@ function get_cat_display_name($cat_informations,
else
{
$output.= '<a class=""';
$output.= ' href="'.add_session_id(PHPWG_ROOT_PATH.$url.$id).'">';
$output.= ' href="'.PHPWG_ROOT_PATH.$url.$id.'">';
$output.= $name.'</a>';
}
}
@ -310,7 +310,7 @@ SELECT id,name
{
$output.= '
<a class=""
href="'.add_session_id(PHPWG_ROOT_PATH.$url.$category_id).'">'.$name.'</a>';
href="'.PHPWG_ROOT_PATH.$url.$category_id.'">'.$name.'</a>';
}
}
if ($replace_space)
@ -369,7 +369,7 @@ function get_html_menu_category($categories)
}
$menu.= '>';
$url = add_session_id(PHPWG_ROOT_PATH.'category.php?cat='.$category['id']);
$url = PHPWG_ROOT_PATH.'category.php?cat='.$category['id'];
$menu.= "\n".'<a href="'.$url.'">'.$category['name'].'</a>';
if ($category['nb_images'] > 0)

164
include/functions_session.inc.php
View file

@ -25,115 +25,77 @@
// | USA. |
// +-----------------------------------------------------------------------+
// The function generate_key creates a string with pseudo random characters.
// the size of the string depends on the $conf['session_id_size'].
// Characters used are a-z A-Z and numerical values. Examples :
// "Er4Tgh6", "Rrp08P", "54gj"
// input : none (using global variable)
// output : $key
function generate_key($size)
{
global $conf;
$md5 = md5(substr(microtime(), 2, 6));
$init = '';
for ( $i = 0; $i < strlen( $md5 ); $i++ )
{
if ( is_numeric( $md5[$i] ) ) $init.= $md5[$i];
}
$init = substr( $init, 0, 8 );
mt_srand( $init );
$key = '';
for ( $i = 0; $i < $size; $i++ )
{
$c = mt_rand( 0, 2 );
if ( $c == 0 ) $key .= chr( mt_rand( 65, 90 ) );
else if ( $c == 1 ) $key .= chr( mt_rand( 97, 122 ) );
else $key .= mt_rand( 0, 9 );
}
return $key;
if (isset($conf['session_save_handler']) and ($conf['session_save_handler'] == 'db')) {
session_set_save_handler('pwg_session_open',
'pwg_session_close',
'pwg_session_read',
'pwg_session_write',
'pwg_session_destroy',
'pwg_session_gc'
);
}
/**
* create a new session and returns the session identifier
*
* - find a non-already-used session key
* - create a session in database
* - return session identifier
*
* @param int userid
* @param int session_lentgh : in seconds
* @return string
*/
function session_create($userid, $session_length)
{
global $conf;
ini_set('session.use_cookies', $conf['session_use_cookies']);
ini_set('session.use_only_cookies', $conf['session_use_only_cookies']);
ini_set('session.use_trans_sid', $conf['session_use_trans_sid']);
ini_set('session.name', $conf['session_name']);
// 1. searching an unused session key
$id_found = false;
while (!$id_found)
{
$generated_id = generate_key($conf['session_id_size']);
$query = '
SELECT id
FROM '.SESSIONS_TABLE.'
WHERE id = \''.$generated_id.'\'
;';
$result = pwg_query($query);
if (mysql_num_rows($result) == 0)
{
$id_found = true;
}
function pwg_session_open($path, $name)
{
return true;
}
function pwg_session_close()
{
pwg_session_gc();
return true;
}
function pwg_session_read($session_id)
{
$query = "SELECT data FROM " . SESSIONS_TABLE;
$query .= " WHERE id = '$session_id'";
$result = pwg_query($query);
if ($result) {
$row = mysql_fetch_assoc($result);
return $row['data'];
} else {
return '';
}
// 3. inserting session in database
$query = '
INSERT INTO '.SESSIONS_TABLE.'
(id,user_id,expiration)
VALUES
(\''.$generated_id.'\','.$userid.',
ADDDATE(NOW(), INTERVAL '.$session_length.' SECOND))
;';
}
function pwg_session_write($session_id, $data)
{
$query = "SELECT id FROM " . SESSIONS_TABLE;
$query .= " WHERE id = '$session_id'";
$result = pwg_query($query);
if (mysql_num_rows($result)) {
$query = "UPDATE " . SESSIONS_TABLE . " SET expiration = now()";
$query .= " WHERE id = '$session_id'";
pwg_query($query);
} else {
$query = "INSERT INTO " . SESSIONS_TABLE . " (id,data,expiration)";
$query .= " VALUES('$session_id','$data',now())";
pwg_query($query);
}
return true;
}
function pwg_session_destroy($session_id)
{
$query = "DELETE FROM " . SESSIONS_TABLE;
$query .= " WHERE id = '$session_id'";
pwg_query($query);
$expiration = $session_length + time();
setcookie('id', $generated_id, $expiration, cookie_path());
return $generated_id;
return true;
}
// add_session_id adds the id of the session to the string given in
// parameter as $url. If the session id is the first parameter to the url,
// it is preceded by a '?', else it is preceded by a '&amp;'. If the
// parameter $redirect is set to true, '&' is used instead of '&'.
function add_session_id( $url, $redirect = false )
function pwg_session_gc()
{
global $page, $user, $conf;
global $conf;
if ($user['is_the_guest']
or $user['has_cookie']
or $conf['apache_authentication'])
{
return $url;
}
if (preg_match('/\.php\?/', $url))
{
$separator = $redirect ? '&' : '&amp;';
}
else
{
$separator = '?';
}
return $url.$separator.'id='.$page['session_id'];
}
// cookie_path returns the path to use for the PhpWebGallery cookie.
// If PhpWebGallery is installed on :
// http://domain.org/meeting/gallery/category.php
// cookie_path will return : "/meeting/gallery"
function cookie_path()
{
return substr($_SERVER['PHP_SELF'],0,strrpos( $_SERVER['PHP_SELF'],'/'));
$query = "DELETE FROM " . SESSIONS_TABLE;
$query .= " WHERE UNIX_TIMESTAMP(NOW()) - UNIX_TIMESTAMP(expiration) > " . $conf['session_length'];
pwg_query($query);
return true;
}
?>

2
include/page_header.php
View file

@ -61,7 +61,7 @@ if ( isset( $refresh ) and intval($refresh) >= 0 and isset( $url_link ) )
$template->assign_vars(
array(
'REFRESH_TIME' => $refresh,
'U_REFRESH' => add_session_id( $url_link )
'U_REFRESH' => $url_link
));
$template->assign_block_vars('refresh', array());
}

63
include/user.inc.php
View file

@ -26,55 +26,24 @@
// +-----------------------------------------------------------------------+
// retrieving connected user informations
if (isset($_COOKIE['id']))
if (isset($_COOKIE[session_name()]))
{
$session_id = $_COOKIE['id'];
$user['has_cookie'] = true;
}
else if (isset($_GET['id']))
session_start();
if (isset($_SESSION['id']))
{
$user['id'] = $_SESSION['id'];
}
else
{
// session timeout
$user['id'] = $conf['guest_id'];
$user['is_the_guest'] = true;
}
}
else
{
$session_id = $_GET['id'];
$user['has_cookie'] = false;
}
else
{
$user['has_cookie'] = false;
}
if (isset($session_id)
and ereg("^[0-9a-zA-Z]{".$conf['session_id_size']."}$", $session_id))
{
$page['session_id'] = $session_id;
$query = '
SELECT user_id,expiration,NOW() AS now
FROM '.SESSIONS_TABLE.'
WHERE id = \''.$page['session_id'].'\'
;';
$result = pwg_query($query);
if (mysql_num_rows($result) > 0)
{
$row = mysql_fetch_array($result);
if (strnatcmp($row['expiration'], $row['now']) < 0)
{
// deletion of the session from the database, because it is
// out-of-date
$delete_query = '
DELETE FROM '.SESSIONS_TABLE.'
WHERE id = \''.$page['session_id'].'\'
;';
pwg_query($delete_query);
}
else
{
$user['id'] = $row['user_id'];
$user['is_the_guest'] = false;
}
}
}
if (!isset($user['id']))
{
$user['id'] = $conf['guest_id'];
$user['is_the_guest'] = true;
$user['id'] = $conf['guest_id'];
$user['is_the_guest'] = true;
}
// using Apache authentication override the above user search

2
install/phpwebgallery_structure.sql
View file

@ -183,7 +183,7 @@ CREATE TABLE `phpwebgallery_rate` (
DROP TABLE IF EXISTS `phpwebgallery_sessions`;
CREATE TABLE `phpwebgallery_sessions` (
`id` varchar(255) binary NOT NULL default '',
`user_id` smallint(5) NOT NULL default '0',
`data` text NOT NULL,
`expiration` datetime NOT NULL default '0000-00-00 00:00:00',
PRIMARY KEY (`id`)
) TYPE=MyISAM;

2
notification.php
View file

@ -58,7 +58,7 @@ $template->set_filenames(array('notification'=>'notification.tpl'));
$template->assign_vars(
array(
'FEED_URL' => PHPWG_ROOT_PATH.'feed.php?feed='.$page['feed'],
'U_HOME' => add_session_id(PHPWG_ROOT_PATH.'category.php')
'U_HOME' => PHPWG_ROOT_PATH.'category.php'
)
);

2
password.php
View file

@ -176,7 +176,7 @@ $template->set_filenames(array('password'=>'password.tpl'));
$template->assign_vars(
array(
'U_HOME' => add_session_id(PHPWG_ROOT_PATH.'category.php')
'U_HOME' => PHPWG_ROOT_PATH.'category.php'
)
);

47
picture.php
View file

@ -76,7 +76,7 @@ while ($row = mysql_fetch_array($result))
if (!$belongs)
{
echo '<div style="text-align:center;">'.$lang['access_forbiden'].'<br />';
echo '<a href="'.add_session_id( PHPWG_ROOT_PATH.'category.php' ).'">';
echo '<a href="'.PHPWG_ROOT_PATH.'category.php'.'">';
echo $lang['thumbnails'].'</a></div>';
exit();
}
@ -323,18 +323,17 @@ if ( isset( $_GET['add_fav'] ) )
{
// there is no favorite picture anymore we redirect the user to the
// category page
$url = add_session_id($url_up);
redirect($url);
redirect($url_up);
}
else if (!$has_prev)
{
$url = str_replace( '&amp;', '&', $picture['next']['url'] );
$url = add_session_id( $url, true);
redirect( $url );
}
else
{
$url = str_replace('&amp;', '&', $picture['prev']['url'] );
$url = add_session_id( $url, true);
redirect( $url );
}
redirect( $url );
}
@ -522,12 +521,12 @@ $template->assign_vars(array(
'L_UP_HINT' => $lang['home_hint'],
'L_UP_ALT' => $lang['home'],
'U_HOME' => add_session_id(PHPWG_ROOT_PATH.'category.php'),
'U_UP' => add_session_id($url_up),
'U_METADATA' => add_session_id($url_metadata),
'U_ADMIN' => add_session_id($url_admin),
'U_SLIDESHOW'=> add_session_id($url_slide),
'U_ADD_COMMENT' => add_session_id(str_replace( '&', '&amp;', $_SERVER['REQUEST_URI'] ))
'U_HOME' => (PHPWG_ROOT_PATH.'category.php'),
'U_UP' => $url_up,
'U_METADATA' => $url_metadata,
'U_ADMIN' => $url_admin,
'U_SLIDESHOW'=> $url_slide,
'U_ADD_COMMENT' => str_replace( '&', '&amp;', $_SERVER['REQUEST_URI'] )
)
);
@ -584,10 +583,8 @@ if ('admin' == $user['status'])
'caddie',
array(
'URL' =>
add_session_id(
PHPWG_ROOT_PATH.'picture.php'
.get_query_string_diff(array('caddie')).'&amp;caddie=1')
)
);
}
@ -645,7 +642,7 @@ if ($has_prev)
array(
'TITLE_IMG' => $picture['prev']['name'],
'IMG' => $picture['prev']['thumbnail'],
'U_IMG' => add_session_id($picture['prev']['url'])
'U_IMG' => $picture['prev']['url']
));
}
@ -656,7 +653,7 @@ if ($has_next)
array(
'TITLE_IMG' => $picture['next']['name'],
'IMG' => $picture['next']['thumbnail'],
'U_IMG' => add_session_id($picture['next']['url'])
'U_IMG' => $picture['next']['url']
));
}
@ -679,11 +676,9 @@ if (!empty($picture['current']['author']))
{
$infos['INFO_AUTHOR'] =
'<a href="'.
add_session_id(
PHPWG_ROOT_PATH.'category.php?cat=search'.
'&amp;search=author:'.$picture['current']['author']
).
'">'.$picture['current']['author'].'</a>';
.'">'.$picture['current']['author'].'</a>';
}
else
{
@ -695,11 +690,9 @@ if (!empty($picture['current']['date_creation']))
{
$infos['INFO_CREATION_DATE'] =
'<a href="'.
add_session_id(
PHPWG_ROOT_PATH.'category.php?cat=search'.
'&amp;search=date_creation:'.$picture['current']['date_creation']
).
'">'.format_date($picture['current']['date_creation']).'</a>';
.'">'.format_date($picture['current']['date_creation']).'</a>';
}
else
{
@ -709,12 +702,10 @@ else
// date of availability
$infos['INFO_AVAILABILITY_DATE'] =
'<a href="'.
add_session_id(
PHPWG_ROOT_PATH.'category.php?cat=search'.
'&amp;search=date_available:'.
substr($picture['current']['date_available'], 0, 10)
).
'">'.
.'">'.
format_date($picture['current']['date_available'], 'mysql_datetime').
'</a>';
@ -763,10 +754,8 @@ if (!empty($picture['current']['keywords']))
preg_replace(
'/([^,]+)/',
'<a href="'.
add_session_id(
PHPWG_ROOT_PATH.'category.php?cat=search&amp;search=keywords:$1'
).
'">$1</a>',
.'">$1</a>',
$picture['current']['keywords']
);
}
@ -890,7 +879,7 @@ if ( isset( $_GET['slideshow'] ) )
if ( !is_numeric( $_GET['slideshow'] ) ) $_GET['slideshow'] = $conf['slideshow_period'];
$template->assign_block_vars('stop_slideshow', array(
'U_SLIDESHOW'=>add_session_id( $picture['current']['url'] )
'U_SLIDESHOW'=>$picture['current']['url']
));
}
@ -1043,7 +1032,7 @@ if ($page['show_comments'])
{
$template->assign_block_vars(
'comments.comment.delete',
array('U_COMMENT_DELETE'=>add_session_id( $url.'&amp;del='.$row['id'])
array('U_COMMENT_DELETE'=> $url.'&amp;del='.$row['id']
));
}
}

6
profile.php
View file

@ -136,7 +136,7 @@ SELECT '.$conf['user_fields']['password'].' AS password
// redirection
$url = PHPWG_ROOT_PATH.'category.php?'.$_SERVER['QUERY_STRING'];
redirect(add_session_id($url));
redirect($url);
}
}
// +-----------------------------------------------------------------------+
@ -198,9 +198,9 @@ $template->assign_vars(
'L_RETURN' => $lang['home'],
'L_RETURN_HINT' => $lang['home_hint'],
'U_RETURN' => add_session_id(PHPWG_ROOT_PATH.'category.php'),
'U_RETURN' => PHPWG_ROOT_PATH.'category.php',
'F_ACTION'=>add_session_id($url_action),
'F_ACTION'=>$url_action,
));
$blockname = 'template_option';

2
random.php
View file

@ -59,5 +59,5 @@ while ($row = mysql_fetch_array($result))
// | redirect |
// +-----------------------------------------------------------------------+
$url = PHPWG_ROOT_PATH.'category.php?cat=list&amp;list='.implode(',', $ids);
redirect(add_session_id($url));
redirect($url);
?>

4
register.php
View file

@ -75,9 +75,9 @@ $template->assign_vars(array(
'L_CONFIRM_PASSWORD' => $lang['reg_confirm'],
'L_EMAIL' => $lang['mail_address'],
'U_HOME' => add_session_id(PHPWG_ROOT_PATH.'category.php'),
'U_HOME' => PHPWG_ROOT_PATH.'category.php',
'F_ACTION' => add_session_id('register.php'),
'F_ACTION' => 'register.php',
'F_LOGIN' => $login,
'F_EMAIL' => $email
));

5
search.php
View file

@ -129,7 +129,6 @@ if (isset($_POST['submit']))
if (isset($_POST['submit']) and count($errors) == 0)
{
$url = 'category.php?cat=search&search='.$search_string;
$url = add_session_id($url, true);
redirect($url);
}
//----------------------------------------------------- template initialization
@ -180,9 +179,9 @@ $template->assign_vars(array(
'TODAY_DAY' => date('d', time()),
'TODAY_MONTH' => date('m', time()),
'TODAY_YEAR' => date('Y', time()),
'S_SEARCH_ACTION' => add_session_id( 'search.php' ),
'S_SEARCH_ACTION' => 'search.php',
'U_HELP' => PHPWG_ROOT_PATH.'/popuphelp.php?page=search',
'U_HOME' => add_session_id( 'category.php' )
'U_HOME' => 'category.php'
)
);

6
upload.php
View file

@ -125,7 +125,7 @@ if ( isset( $page['cat'] ) and is_numeric( $page['cat'] ) )
if ($page['cat_site_id'] != 1 or !$page['cat_uploadable'])
{
echo '<div style="text-align:center;">'.$lang['upload_forbidden'].'<br />';
echo '<a href="'.add_session_id( './category.php' ).'">';
echo '<a href="./category.php">';
echo $lang['thumbnails'].'</a></div>';
exit();
}
@ -299,9 +299,9 @@ $template->assign_vars(array(
'L_UPLOAD_DONE' => $lang['upload_successful'],
'L_MANDATORY' => $lang['mandatory'],
'F_ACTION' => add_session_id( $u_form ),
'F_ACTION' => $u_form,
'U_RETURN' => add_session_id(PHPWG_ROOT_PATH.'category.php?'.$_SERVER['QUERY_STRING'])
'U_RETURN' => PHPWG_ROOT_PATH.'category.php?'.$_SERVER['QUERY_STRING']
));
if ( !$page['upload_successful'] )