[Noalyss-commit] [noalyss] 06/13: Bug : fix security , clean completely the session and prevent to set the menu public to an user

[Dany De Bontridder]

sparkyx pushed a commit to branch master
in repository noalyss.

commit e6e1bf24b45ebf753efc8c3459d25d5fe912c459
Author: sparkyx <danydb@noalyss.eu>
AuthorDate: Wed Aug 25 14:51:04 2021 +0200

    Bug : fix security , clean completely the session and prevent to set the 
menu
    public to an user
---
 html/login.php                      |  5 ++++-
 html/logout.php                     | 17 ++++++++++++-----
 include/ajax/ajax_user_security.php |  4 +++-
 include/class/user.class.php        | 15 +++++++++++++++
 include/param_sec.inc.php           |  4 ++--
 5 files changed, 36 insertions(+), 9 deletions(-)

diff --git a/html/login.php b/html/login.php
index 70ce7dd..e25e48d 100644
--- a/html/login.php
+++ b/html/login.php
@@ -37,7 +37,10 @@ if (defined('MULTI') && MULTI == 0)
 
 if (  isset ($_POST["p_user"] ) )
 {
-
+    $http=new HttpInput();
+    
+    // clean OLD session 
+    User::clean_session($http->post("p_user"));
     $User=new User($rep);
     $User->Check(false,'LOGIN');
 
diff --git a/html/logout.php b/html/logout.php
index 19db731..79466cb 100644
--- a/html/logout.php
+++ b/html/logout.php
@@ -23,14 +23,15 @@
 require_once '../include/constant.php';
 require_once ("lib/ac_common.php");
 require_once('class/database.class.php');
-session_unset();
 
 html_page_start("classic");
 
 /* clean Global variable */
-
-if ( isset ($g_user) ) unset ($GLOBAL['g_user']);
-if ( isset ($g_pass) ) unset ($GLOBAL['g_pass']);
+if(DEBUGNOALYSS>1) { 
+    echo h1(_("try to clean session"));
+    var_dump($_SESSION);
+}
+User::clean_session();
 //
 // Clean the possible cookies
 //
@@ -44,7 +45,13 @@ if (isset($_SERVER['HTTP_COOKIE'])) {
     }
 }
 echo '<h2 class="info">'._('Vous êtes déconnecté').'</h2>';
-echo '<META HTTP-EQUIV="REFRESH" content="0;url=index.html">';
 
+if(DEBUGNOALYSS>1) { 
+    echo h1(_("Session after cleansing"));
+    var_dump($_SESSION);
+     
+} else {
+    echo '<META HTTP-EQUIV="REFRESH" content="0;url=index.html">';
+}
 html_page_stop();
 ?>
diff --git a/include/ajax/ajax_user_security.php 
b/include/ajax/ajax_user_security.php
index d7d4985..1be3da7 100644
--- a/include/ajax/ajax_user_security.php
+++ b/include/ajax/ajax_user_security.php
@@ -118,7 +118,9 @@ if ($op=="profile")
         $value=$http->post("value");
         // save profile
         $sec_User=new User($cn, $user_id);
-        $sec_User->save_profile($value);
+        if ( $value > 0) {
+            $sec_User->save_profile($value);
+        }
         $ie_input=Inplace_Edit::build($input);
         $ie_input->set_callback("ajax_misc.php");
         $ie_input->add_json_param("op", "profile");
diff --git a/include/class/user.class.php b/include/class/user.class.php
index 2b8f028..130501a 100644
--- a/include/class/user.class.php
+++ b/include/class/user.class.php
@@ -1782,7 +1782,22 @@ class User
         }
         return $result;
     }
+    /**
+     * @brief clean the sessions 
+     */
+    static function clean_session()
+    {
 
+        $aSession=$_SESSION;
+        foreach($aSession as $key => $value) {
+            if(DEBUGNOALYSS>1) { echo "[$key]=>[$value]";}
+            
+            if ( strpos($key,SESSION_KEY) === 0) {
+                unset($_SESSION[$key]);
+               if(DEBUGNOALYSS>1) { echo "=> [$key] cleaned";}
+            }
+        }
+    }
 }
 
 ?>
\ No newline at end of file
diff --git a/include/param_sec.inc.php b/include/param_sec.inc.php
index 634458a..f1401fe 100644
--- a/include/param_sec.inc.php
+++ b/include/param_sec.inc.php
@@ -136,7 +136,7 @@ if ( isset ($_GET["action"] ))
 if ( $action == "view" )
 {
     $l_Db=sprintf("dossier%d",$gDossier);
-    $return= HtmlInput::button_anchor(_('Retour à la 
liste'),'?&ac='.$http->request('ac').'&'.dossier::get(),_('retour'),"",'smallbutton');
+    $return= HtmlInput::button_anchor(_('Retour à la 
liste'),'?&ac='.$http->request('ac').'&'.dossier::get(),_('retour'),"",'button');
 
     $repo=new Database();
     $user_id=$http->get('user_id',"number");
@@ -203,7 +203,7 @@ if ( $action == "view" )
     echo HtmlInput::hidden('user_id',$user_id);
     $i_profile=new ISelect ('profile');
     $i_profile->id=uniqid("profile");
-    $i_profile->value=$cn->make_array("select p_id,p_name from profile
+    $i_profile->value=$cn->make_array("select p_id,p_name from profile where 
p_id > 0
                     order by p_name");
     
     $i_profile->selected=$sec_User->get_profile();