Knah-Tsaeb/MyShaarli
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

code clean: cookie expiration

Browse source 
- unified code style (spaces around operators)
- prevented expiration time to be calculated twice
- replaced tabs with spaces
This commit is contained in:
Willi Eggeling 2017-08-26 12:20:38 +02:00
parent 94c035ff71
commit a544b113f2
1 changed files with 42 additions and 41 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

83
index.php
View file

@ -177,42 +177,42 @@ if (isset($_SERVER['HTTP_ACCEPT_LANGUAGE'])) {
*/ */
function setup_login_state($conf) function setup_login_state($conf)
{ {
if ($conf->get('security.open_shaarli')) { if ($conf->get('security.open_shaarli')) {
return true; return true;
} }
$userIsLoggedIn = false; // By default, we do not consider the user as logged in; $userIsLoggedIn = false; // By default, we do not consider the user as logged in;
$loginFailure = false; // If set to true, every attempt to authenticate the user will fail. This indicates that an important condition isn't met. $loginFailure = false; // If set to true, every attempt to authenticate the user will fail. This indicates that an important condition isn't met.
if (! $conf->exists('credentials.login')) { if (! $conf->exists('credentials.login')) {
$userIsLoggedIn = false; // Shaarli is not configured yet. $userIsLoggedIn = false; // Shaarli is not configured yet.
$loginFailure = true; $loginFailure = true;
} }
if (isset($_COOKIE['shaarli_staySignedIn']) && if (isset($_COOKIE['shaarli_staySignedIn']) &&
$_COOKIE['shaarli_staySignedIn']===STAY_SIGNED_IN_TOKEN && $_COOKIE['shaarli_staySignedIn']===STAY_SIGNED_IN_TOKEN &&
!$loginFailure) !$loginFailure)
{ {
fillSessionInfo($conf); fillSessionInfo($conf);
$userIsLoggedIn = true; $userIsLoggedIn = true;
} }
// If session does not exist on server side, or IP address has changed, or session has expired, logout. // If session does not exist on server side, or IP address has changed, or session has expired, logout.
if (empty($_SESSION['uid']) if (empty($_SESSION['uid'])
|| ($conf->get('security.session_protection_disabled') === false && $_SESSION['ip'] != allIPs()) || ($conf->get('security.session_protection_disabled') === false && $_SESSION['ip'] != allIPs())
|| time() >= $_SESSION['expires_on']) || time() >= $_SESSION['expires_on'])
{ {
logout(); logout();
$userIsLoggedIn = false; $userIsLoggedIn = false;
$loginFailure = true; $loginFailure = true;
} }
if (!empty($_SESSION['longlastingsession'])) { if (!empty($_SESSION['longlastingsession'])) {
$_SESSION['expires_on']=time()+$_SESSION['longlastingsession']; // In case of "Stay signed in" checked. $_SESSION['expires_on']=time()+$_SESSION['longlastingsession']; // In case of "Stay signed in" checked.
} }
else { else {
$_SESSION['expires_on']=time()+INACTIVITY_TIMEOUT; // Standard session expiration date. $_SESSION['expires_on']=time()+INACTIVITY_TIMEOUT; // Standard session expiration date.
} }
if (!$loginFailure) { if (!$loginFailure) {
$userIsLoggedIn = true; $userIsLoggedIn = true;
} }
return $userIsLoggedIn; return $userIsLoggedIn;
} }
$userIsLoggedIn = setup_login_state($conf); $userIsLoggedIn = setup_login_state($conf);
@ -236,10 +236,10 @@ function allIPs()
*/ */
function fillSessionInfo($conf) function fillSessionInfo($conf)
{ {
$_SESSION['uid'] = sha1(uniqid('',true).'_'.mt_rand()); // Generate unique random number (different than phpsessionid) $_SESSION['uid'] = sha1(uniqid('',true).'_'.mt_rand()); // Generate unique random number (different than phpsessionid)
$_SESSION['ip']=allIPs(); // We store IP address(es) of the client to make sure session is not hijacked. $_SESSION['ip']=allIPs(); // We store IP address(es) of the client to make sure session is not hijacked.
$_SESSION['username']= $conf->get('credentials.login'); $_SESSION['username']= $conf->get('credentials.login');
$_SESSION['expires_on']=time()+INACTIVITY_TIMEOUT; // Set session expiration. $_SESSION['expires_on']=time()+INACTIVITY_TIMEOUT; // Set session expiration.
} }
/** /**
@ -256,7 +256,7 @@ function check_auth($login, $password, $conf)
$hash = sha1($password . $login . $conf->get('credentials.salt')); $hash = sha1($password . $login . $conf->get('credentials.salt'));
if ($login == $conf->get('credentials.login') && $hash == $conf->get('credentials.hash')) if ($login == $conf->get('credentials.login') && $hash == $conf->get('credentials.hash'))
{ // Login/password is correct. { // Login/password is correct.
fillSessionInfo($conf); fillSessionInfo($conf);
logm($conf->get('resource.log'), $_SERVER['REMOTE_ADDR'], 'Login successful'); logm($conf->get('resource.log'), $_SERVER['REMOTE_ADDR'], 'Login successful');
return true; return true;
} }
@ -385,9 +385,10 @@ if (isset($_POST['login']))
// If user wants to keep the session cookie even after the browser closes: // If user wants to keep the session cookie even after the browser closes:
if (!empty($_POST['longlastingsession'])) if (!empty($_POST['longlastingsession']))
{ {
setcookie('shaarli_staySignedIn', STAY_SIGNED_IN_TOKEN, time()+31536000, WEB_PATH); $_SESSION['longlastingsession'] = 31536000; // (31536000 seconds = 1 year)
$_SESSION['longlastingsession']=31536000; // (31536000 seconds = 1 year) $expiration = time() + $_SESSION['longlastingsession']; // calculate relative cookie expiration (1 year from now)
$_SESSION['expires_on']=time()+$_SESSION['longlastingsession']; // Set session expiration on server-side. setcookie('shaarli_staySignedIn', STAY_SIGNED_IN_TOKEN, $expiration, WEB_PATH);
$_SESSION['expires_on'] = $expiration; // Set session expiration on server-side.
$cookiedir = ''; if(dirname($_SERVER['SCRIPT_NAME'])!='/') $cookiedir=dirname($_SERVER["SCRIPT_NAME"]).'/'; $cookiedir = ''; if(dirname($_SERVER['SCRIPT_NAME'])!='/') $cookiedir=dirname($_SERVER["SCRIPT_NAME"]).'/';
session_set_cookie_params($_SESSION['longlastingsession'],$cookiedir,$_SERVER['SERVER_NAME']); // Set session cookie expiration on client side session_set_cookie_params($_SESSION['longlastingsession'],$cookiedir,$_SERVER['SERVER_NAME']); // Set session cookie expiration on client side