aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorrvelices <rv-github@modusoptimus.com>2008-10-16 00:35:30 +0000
committerrvelices <rv-github@modusoptimus.com>2008-10-16 00:35:30 +0000
commitf7f8c1688ef30ecb2f40fe279ba34d250d4ec8be (patch)
tree8d6fde76195c05586163fd33ed9df706367c30aa
parent7807d6586a198c75e3d4f72c4b360bee061b817f (diff)
- security paranoia: protect session/remember me cookies from XSS attacks (works only if php>=5.2 and with IE/FF maybe others)
git-svn-id: http://piwigo.org/svn/branches/2.0@2756 68402e56-0260-453c-a942-63ccdbb3a9ee
Diffstat (limited to '')
-rw-r--r--include/functions_session.inc.php3
-rw-r--r--include/functions_user.inc.php34
-rw-r--r--include/user.inc.php9
-rw-r--r--include/ws_functions.inc.php22
4 files changed, 40 insertions, 28 deletions
diff --git a/include/functions_session.inc.php b/include/functions_session.inc.php
index dce1551ea..ed026a175 100644
--- a/include/functions_session.inc.php
+++ b/include/functions_session.inc.php
@@ -66,6 +66,7 @@ if (isset($conf['session_save_handler'])
ini_set('session.use_cookies', $conf['session_use_cookies']);
ini_set('session.use_only_cookies', $conf['session_use_only_cookies']);
ini_set('session.use_trans_sid', intval($conf['session_use_trans_sid']));
+ ini_set('session.cookie_httponly', 1);
}
session_name($conf['session_name']);
session_set_cookie_params(0, cookie_path());
@@ -227,4 +228,4 @@ function pwg_unset_session_var($var)
return true;
}
-?>
+?> \ No newline at end of file
diff --git a/include/functions_user.inc.php b/include/functions_user.inc.php
index 02aa2a5d8..074a8aae9 100644
--- a/include/functions_user.inc.php
+++ b/include/functions_user.inc.php
@@ -1013,16 +1013,28 @@ function log_user($user_id, $remember_me)
if ($key!==false)
{
$cookie = $user_id.'-'.$now.'-'.$key;
- setcookie($conf['remember_me_name'],
+ if (version_compare(PHP_VERSION, '5.2', '>=') )
+ {
+ setcookie($conf['remember_me_name'],
+ $cookie,
+ time()+$conf['remember_me_length'],
+ cookie_path(),ini_get('session.cookie_domain'),ini_get('session.cookie_secure'),
+ ini_get('session.cookie_httponly')
+ );
+ }
+ else
+ {
+ setcookie($conf['remember_me_name'],
$cookie,
time()+$conf['remember_me_length'],
- cookie_path()
+ cookie_path(),ini_get('session.cookie_domain'),ini_get('session.cookie_secure')
);
+ }
}
}
else
{ // make sure we clean any remember me ...
- setcookie($conf['remember_me_name'], '', 0, cookie_path());
+ setcookie($conf['remember_me_name'], '', 0, cookie_path(),ini_get('session.cookie_domain'));
}
if ( session_id()!="" )
{ // we regenerate the session for security reasons
@@ -1062,7 +1074,7 @@ function auto_login() {
return true;
}
}
- setcookie($conf['remember_me_name'], '', 0, cookie_path());
+ setcookie($conf['remember_me_name'], '', 0, cookie_path(),ini_get('session.cookie_domain'));
}
return false;
}
@@ -1092,6 +1104,20 @@ SELECT '.$conf['user_fields']['id'].' AS id,
return false;
}
+/** Performs all the cleanup on user logout */
+function logout_user()
+{
+ global $conf;
+ $_SESSION = array();
+ session_unset();
+ session_destroy();
+ setcookie(session_name(),'',0,
+ ini_get('session.cookie_path'),
+ ini_get('session.cookie_domain')
+ );
+ setcookie($conf['remember_me_name'], '', 0, cookie_path(),ini_get('session.cookie_domain'));
+}
+
/*
* Return user status used in this library
* @return string
diff --git a/include/user.inc.php b/include/user.inc.php
index 9d7d2f242..0084a3aff 100644
--- a/include/user.inc.php
+++ b/include/user.inc.php
@@ -29,14 +29,7 @@ if (isset($_COOKIE[session_name()]))
session_start();
if (isset($_GET['act']) and $_GET['act'] == 'logout')
{ // logout
- $_SESSION = array();
- session_unset();
- session_destroy();
- setcookie(session_name(),'',0,
- ini_get('session.cookie_path'),
- ini_get('session.cookie_domain')
- );
- setcookie($conf['remember_me_name'], '', 0, cookie_path());
+ logout_user();
redirect(make_index_url());
}
elseif (!empty($_SESSION['pwg_uid']))
diff --git a/include/ws_functions.inc.php b/include/ws_functions.inc.php
index 4f75c8e49..e4470f6c4 100644
--- a/include/ws_functions.inc.php
+++ b/include/ws_functions.inc.php
@@ -1107,17 +1107,9 @@ function ws_session_login($params, &$service)
*/
function ws_session_logout($params, &$service)
{
- global $user, $conf;
if (!is_a_guest())
{
- $_SESSION = array();
- session_unset();
- session_destroy();
- setcookie(session_name(),'',0,
- ini_get('session.cookie_path'),
- ini_get('session.cookie_domain')
- );
- setcookie($conf['remember_me_name'], '', 0, cookie_path());
+ logout_user();
}
return true;
}
@@ -1355,7 +1347,7 @@ function ws_categories_add($params, &$service)
}
invalidate_user_cache();
-
+
return $creation_output;
}
@@ -1393,18 +1385,18 @@ function ws_images_exist($params, &$service)
-1,
PREG_SPLIT_NO_EMPTY
);
-
+
$query = '
SELECT
id,
md5sum
FROM '.IMAGES_TABLE.'
- WHERE md5sum IN (\''.implode("','", $md5sums).'\')
+ WHERE md5sum IN (\''.implode("','", $md5sums).'\')
;';
$id_of_md5 = simple_hash_from_query($query, 'md5sum', 'id');
$result = array();
-
+
foreach ($md5sums as $md5sum)
{
$result[$md5sum] = null;
@@ -1431,7 +1423,7 @@ function ws_images_setInfo($params, &$service)
// file_sum
// thumbnail_content
// thumbnail_sum
-
+
$params['image_id'] = (int)$params['image_id'];
if ($params['image_id'] <= 0)
{
@@ -1485,7 +1477,7 @@ SELECT *
array($update)
);
}
-
+
if (isset($params['categories']))
{
ws_add_image_category_relations(