maketank/Froxlor
2
0
Fork 0
Code Pull Requests Releases Activity

regenerate session-id after login / su-action

Browse Source 
Signed-off-by: Michael Kaufmann <d00p@froxlor.org>
This commit is contained in:
Michael Kaufmann
2023-06-11 12:05:33 +02:00
parent f9f1048477
commit 94d9c3eedf
3 changed files with 3 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
admin_customers.php
View File

@@ -94,6 +94,7 @@ if (($page == 'customers' || $page == 'overview') && $userinfo['customers'] != '
$result['switched_user'] = CurrentUser::getData(); $result['switched_user'] = CurrentUser::getData();
$result['adminsession'] = 0; $result['adminsession'] = 0;
$result['userid'] = $result['customerid']; $result['userid'] = $result['customerid'];
session_regenerate_id();
CurrentUser::setData($result); CurrentUser::setData($result);
$log->logAction(FroxlorLogger::ADM_ACTION, LOG_INFO, "switched user and is now '" . $destination_user . "'"); $log->logAction(FroxlorLogger::ADM_ACTION, LOG_INFO, "switched user and is now '" . $destination_user . "'");

1
admin_index.php
View File

@@ -53,6 +53,7 @@ if ($action == 'logout') {
if (is_array(CurrentUser::getField('switched_user'))) { if (is_array(CurrentUser::getField('switched_user'))) {
$result = CurrentUser::getData(); $result = CurrentUser::getData();
$result = $result['switched_user']; $result = $result['switched_user'];
session_regenerate_id();
CurrentUser::setData($result); CurrentUser::setData($result);
$target = (isset($_GET['target']) ? $_GET['target'] : 'index'); $target = (isset($_GET['target']) ? $_GET['target'] : 'index');
$redirect = "admin_" . $target . ".php"; $redirect = "admin_" . $target . ".php";

1
index.php
View File

@@ -786,6 +786,7 @@ if ($action == 'll') {
function finishLogin($userinfo) function finishLogin($userinfo)
{ {
if (isset($userinfo['userid']) && $userinfo['userid'] != '') { if (isset($userinfo['userid']) && $userinfo['userid'] != '') {
session_regenerate_id();
CurrentUser::setData($userinfo); CurrentUser::setData($userinfo);
$language = $userinfo['def_language'] ?? Settings::Get('panel.standardlanguage'); $language = $userinfo['def_language'] ?? Settings::Get('panel.standardlanguage');