alxarafe /
alixar
| 1 | <?php |
||
| 111 | if ($newurl) { |
||
| 112 | DolUtils::dol_syslog("main.inc: dolibarr_main_force_https is on, we make a redirect to " . $newurl); |
||
| 113 | echo $newurl; |
||
| 114 | throw Exception('x'); |
||
|
Bug
introduced
by
|
|||
| 115 | header("Location: " . $newurl); |
||
| 116 | exit; |
||
| 117 | } else { |
||
| 118 | DolUtils::dol_syslog("main.inc: dolibarr_main_force_https is on but we failed to forge new https url so no redirect is done", LOG_WARNING); |
||
| 119 | } |
||
| 120 | } |
||
| 121 | |||
| 122 | if (!defined('NOLOGIN') && !defined('NOIPCHECK') && !empty($dolibarr_main_restrict_ip)) { |
||
| 123 | $listofip = explode(',', $dolibarr_main_restrict_ip); |
||
| 124 | $found = false; |
||
| 125 | foreach ($listofip as $ip) { |
||
| 131 | } |
||
| 132 | if (!$found) { |
||
| 133 | print 'Access refused by IP protection'; |
||
| 134 | exit; |
||
| 135 | } |
||
| 136 | } |
||
| 137 | |||
| 175 | $token = Security::dol_hash(uniqid(mt_rand(), true)); // Generates a hash of a random number |
||
| 176 | $_SESSION['newtoken'] = $token; |
||
| 177 | } |
||
| 178 | if ((!defined('NOCSRFCHECK') && empty($dolibarr_nocsrfcheck) && !empty(Globals::$conf->global->MAIN_SECURITY_CSRF_WITH_TOKEN)) || defined('CSRFCHECK_WITH_TOKEN')) { // Check validity of token, only if option MAIN_SECURITY_CSRF_WITH_TOKEN enabled or if constant CSRFCHECK_WITH_TOKEN is set |
||
| 179 | if ($_SERVER['REQUEST_METHOD'] == 'POST' && !DolUtils::GETPOST('token', 'alpha')) { // Note, offender can still send request by GET |
||
| 180 | print "Access refused by CSRF protection in main.inc.php. Token not provided.\n"; |
||
| 181 | print "If you access your server behind a proxy using url rewriting, you might check that all HTTP header is propagated (or add the line \$dolibarr_nocsrfcheck=1 into your conf.php file).\n"; |
||
| 182 | die; |
||
| 183 | } |
||
| 184 | if ($_SERVER['REQUEST_METHOD'] === 'POST') { // This test must be after loading $_SESSION['token']. |
||
| 185 | if (DolUtils::GETPOST('token', 'alpha') != $_SESSION['token']) { |
||
| 199 | foreach ($disabled_modules as $module) { |
||
| 200 | if ($module) { |
||
| 201 | if (empty(Globals::$conf->$module)) { |
||
| 202 | Globals::$conf->$module = new stdClass(); |
||
| 203 | } |
||
| 204 | Globals::$conf->$module->enabled = false; |
||
| 205 | if ($module == 'fournisseur') { // Special case |
||
| 222 | $dolibarr_main_authentication = constant('MAIN_AUTHENTICATION_MODE'); |
||
| 223 | } else { |
||
| 224 | // Authentication mode |
||
| 225 | if (empty($dolibarr_main_authentication)) { |
||
| 226 | $dolibarr_main_authentication = 'http,dolibarr'; |
||
| 227 | } |
||
| 228 | // Authentication mode: forceuser |
||
| 229 | if ($dolibarr_main_authentication == 'forceuser' && empty($dolibarr_auto_user)) { |
||
| 230 | $dolibarr_auto_user = 'auto'; |
||
| 231 | } |
||
| 232 | } |
||
| 237 | if (!count($this->authmode)) { |
||
| 238 | Globals::$langs->load('main'); |
||
| 239 | dol_print_error('', Globals::$langs->trans("ErrorConfigParameterNotDefined", 'dolibarr_main_authentication')); |
||
| 240 | exit; |
||
| 241 | } |
||
| 242 | |||
| 243 | // If login request was already post, we retrieve login from the session |
||
| 261 | $dol_use_jmobile = DolUtils::GETPOST('dol_use_jmobile', 'int', 3); |
||
| 262 | //dol_syslog("POST key=".join(array_keys($_POST),',').' value='.join($_POST,',')); |
||
| 263 | // If in demo mode, we check we go to home page through the public/demo/index.php page |
||
| 264 | if (!empty($dolibarr_main_demo) && $_SERVER['PHP_SELF'] == DOL_BASE_URI . '/index.php') { // We ask index page |
||
| 265 | if (empty($_SERVER['HTTP_REFERER']) || !preg_match('/public/', $_SERVER['HTTP_REFERER'])) { |
||
| 266 | DolUtils::dol_syslog("Call index page from another url than demo page (call is done from page " . $_SERVER['HTTP_REFERER'] . ")"); |
||
| 267 | $url = ''; |
||
| 296 | Globals::$user->trigger_mesg = 'ErrorBadValueForCode - login=' . DolUtils::GETPOST("username", "alpha", 2); |
||
| 297 | // Call of triggers |
||
| 298 | //include_once DOL_BASE_PATH . '/core/class/interfaces.class.php'; |
||
| 299 | $interface = new Interfaces($db); |
||
| 300 | $result = $interface->run_triggers('USER_LOGIN_FAILED', Globals::$user, Globals::$user, Globals::$langs, Globals::$conf); |
||
| 301 | if ($result < 0) { |
||
| 302 | $error++; |
||
| 303 | } |
||
| 304 | // End Call of triggers |
||
| 305 | // Hooks on failed login |
||
| 336 | |||
| 337 | if (!is_object(Globals::$langs)) { // This can occurs when calling page with NOREQUIRETRAN defined, however we need langs for error messages. |
||
| 338 | // include_once DOL_BASE_PATH . '/core/class/translate.class.php'; |
||
| 339 | Globals::$langs = new Translate("", Globals::$conf); |
||
| 340 | $langcode = (DolUtils::GETPOST('lang', 'aZ09', 1) ? DolUtils::GETPOST('lang', 'aZ09', 1) : (empty(Globals::$conf->global->MAIN_LANG_DEFAULT) ? 'auto' : Globals::$conf->global->MAIN_LANG_DEFAULT)); |
||
| 341 | if (defined('MAIN_LANG_DEFAULT')) { |
||
| 342 | $langcode = constant('MAIN_LANG_DEFAULT'); |
||
| 413 | } else { |
||
| 414 | Security2::dol_loginfunction($this); |
||
| 415 | } |
||
| 416 | exit; |
||
| 417 | } |
||
| 418 | |||
| 419 | $resultFetchUser = Globals::$user->fetch('', $login, '', 1, ($entitytotest > 0 ? $entitytotest : -1)); |
||
| 420 | var_dump($resultFetchUser); |
||
| 421 | if ($resultFetchUser <= 0) { |
||
| 422 | DolUtils::dol_syslog('User not found, connexion refused'); |
||
| 423 | session_destroy(); |
||
| 640 | $db->rollback(); |
||
| 641 | session_destroy(); |
||
| 642 | dol_print_error($db, 'Error in some triggers USER_LOGIN or in some hooks afterLogin'); |
||
| 643 | exit; |
||
| 644 | } else { |
||
| 645 | $db->commit(); |
||
| 646 | } |
||
| 699 | // Set javascript option |
||
| 700 | if (!DolUtils::GETPOST('nojs', 'int')) { // If javascript was not disabled on URL |
||
| 701 | if (!empty(Globals::$user->conf->MAIN_DISABLE_JAVASCRIPT)) { |
||
| 702 | Globals::$conf->use_javascript_ajax = !$user->conf->MAIN_DISABLE_JAVASCRIPT; |
||
| 703 | } |
||
| 704 | } else { |
||
| 705 | Globals::$conf->use_javascript_ajax = 0; |
||
| 771 | Globals::$langs->load("other"); |
||
| 772 | DolUtils::dol_syslog("Authentification ko as login is disabled"); |
||
| 773 | accessforbidden(Globals::$langs->trans("ErrorLoginDisabled")); |
||
| 774 | exit; |
||
| 775 | } |
||
| 776 | |||
| 777 | // Load permissions |
||
| 873 | // Check consistency of NOREQUIREXXX DEFINES |
||
| 874 | if ((defined('NOREQUIREDB') || defined('NOREQUIRETRAN')) && !defined('NOREQUIREMENU')) { |
||
| 875 | print 'If define NOREQUIREDB or NOREQUIRETRAN are set, you must also set NOREQUIREMENU or not set them'; |
||
| 876 | exit; |
||
| 877 | } |
||
| 878 | |||
| 879 | // Sanity check on URL |
||
| 1031 | //$var[$key] = $value; // This is useless |
||
| 1032 | } else { |
||
| 1033 | print 'Access refused by SQL/Script injection protection in main.inc.php (type=' . htmlentities($type) . ' key=' . htmlentities($key) . ' value=' . htmlentities($value) . ' page=' . htmlentities($_SERVER["REQUEST_URI"]) . ')'; |
||
| 1034 | exit; |
||
| 1035 | } |
||
| 1036 | } |
||
| 1037 | return true; |
||
| 1043 |
Loading history...