diff --git a/html/ajax.php b/html/ajax.php
index 5bf62668d..4219a4cda 100644
--- a/html/ajax.php
+++ b/html/ajax.php
@@ -56,7 +56,7 @@ if (isset($_REQUEST['plugin_code']) )
if ( $ext->search($_REQUEST['plugin_code']) != -1)
{
/* security */
- if ( !isset ($_SESSION['g_user']) || $ext->can_request($_SESSION['g_user']) == 0 )
+ if ( !isset ($_SESSION[SESSION_KEY.'g_user']) || $ext->can_request($_SESSION[SESSION_KEY.'g_user']) == 0 )
{
exit();
}
diff --git a/html/do.php b/html/do.php
index 49a2dccea..9a8641286 100644
--- a/html/do.php
+++ b/html/do.php
@@ -42,7 +42,7 @@ if ( ! isset($_REQUEST['gDossier']))
redirect('user_login.php');
exit();
}
-if ( ! isset ($_SESSION['g_theme']))
+if ( ! isset ($_SESSION[SESSION_KEY.'g_theme']))
{
echo "
"._('Vous êtes déconnecté')."
";
$backurl=$_SERVER['REQUEST_URI'];
@@ -68,7 +68,7 @@ if ( ! $cn->exist_table('version')) {
return;
}
-$style_user=$http->post("style_user","string",$_SESSION['g_theme']);
+$style_user=$http->post("style_user","string",$_SESSION[SESSION_KEY.'g_theme']);
html_page_start($style_user);
if ( DEBUG ) {
diff --git a/html/extension.raw.php b/html/extension.raw.php
index d8f8abb72..99a5729dd 100644
--- a/html/extension.raw.php
+++ b/html/extension.raw.php
@@ -45,7 +45,7 @@ $ext=new Extension($cn);
if ( $ext->search($http->request("plugin_code")) != -1 )
{
/* security */
- if ( !isset ($_SESSION['g_user']) || $ext->can_request($_SESSION['g_user']) == 0 )
+ if ( !isset ($_SESSION[SESSION_KEY.'g_user']) || $ext->can_request($_SESSION[SESSION_KEY.'g_user']) == 0 )
{
exit();
}
diff --git a/html/fid.php b/html/fid.php
index 2b6c38964..471a08de9 100644
--- a/html/fid.php
+++ b/html/fid.php
@@ -56,7 +56,7 @@ $fTva_id=$hi->request("t","string","none");
$fPrice_sale=$hi->request("p","string","none");
$fPrice_purchase=$hi->request("b","string","none");
-if ( isset($_SESSION['isValid']) && $_SESSION['isValid'] == 1)
+if ( isset($_SESSION[SESSION_KEY.'isValid']) && $_SESSION[SESSION_KEY.'isValid'] == 1)
{
$jrn=$hi->get('j', "number",'-1');
$d=$hi->get('d',"string", '');
diff --git a/html/install.php b/html/install.php
index 821df7a8c..7e4ff5d8f 100644
--- a/html/install.php
+++ b/html/install.php
@@ -145,7 +145,7 @@ load_all_script();
echo '';
if ( $_GET['lang'] == "en_US.utf8" || $_GET['lang']=='fr_FR.utf8')
{
- $_SESSION['g_lang']=$_GET['lang'];
+ $_SESSION[SESSION_KEY.'g_lang']=$_GET['lang'];
set_language();
}
?>
diff --git a/html/login.php b/html/login.php
index 089040878..face7be1a 100644
--- a/html/login.php
+++ b/html/login.php
@@ -39,8 +39,8 @@ if ( isset ($_POST["p_user"] ) )
{
$g_user=strtolower(sql_string($_POST["p_user"]));
$g_pass=$_POST["p_pass"];
- $_SESSION['g_user']=$g_user;
- $_SESSION['g_pass']=$g_pass;
+ $_SESSION[SESSION_KEY.'g_user']=$g_user;
+ $_SESSION[SESSION_KEY.'g_pass']=$g_pass;
diff --git a/html/popup.php b/html/popup.php
index b985af528..44bfdf57d 100644
--- a/html/popup.php
+++ b/html/popup.php
@@ -32,7 +32,7 @@ $http=new HttpInput();
/*
* Check if the user is still connected
*/
-if ( ! isset ($_SESSION['g_user'] ) )
+if ( ! isset ($_SESSION[SESSION_KEY.'g_user'] ) )
{
echo ""._('Vous êtes déconnecté')."
";
$backurl=$_SERVER['REQUEST_URI'];
@@ -42,7 +42,7 @@ if ( ! isset ($_SESSION['g_user'] ) )
}
-html_page_start($_SESSION['g_theme']);
+html_page_start($_SESSION[SESSION_KEY.'g_theme']);
echo '';
?>
';
@@ -203,7 +203,7 @@ class User
else
{
if ($from == 'LOGIN')
- $cn->exec_sql($sql, array($_SESSION['g_user'], $_SERVER["REMOTE_ADDR"], $from, $_SERVER['REQUEST_URI'], 'SUCCESS'));
+ $cn->exec_sql($sql, array($_SESSION[SESSION_KEY.'g_user'], $_SERVER["REMOTE_ADDR"], $from, $_SERVER['REQUEST_URI'], 'SUCCESS'));
$this->valid = 1;
}
@@ -597,7 +597,7 @@ class User
{
$cn = new Database();
$sql = "insert into audit_connect (ac_user,ac_ip,ac_module,ac_url,ac_state) values ($1,$2,$3,$4,$5)";
- $cn->exec_sql($sql, array($_SESSION['g_user'], $_SERVER["REMOTE_ADDR"], $p_action_id, $_SERVER['REQUEST_URI'], 'FAIL'));
+ $cn->exec_sql($sql, array($_SESSION[SESSION_KEY.'g_user'], $_SERVER["REMOTE_ADDR"], $p_action_id, $_SERVER['REQUEST_URI'], 'FAIL'));
}
return 0;
}
@@ -654,7 +654,7 @@ class User
$this->load_global_pref();
return;
}
- $_SESSION[$name] = $line[$parameter];
+ $_SESSION[SESSION_KEY.$name] = $line[$parameter];
}
}
@@ -1094,7 +1094,7 @@ class User
$sql = "insert into audit_connect (ac_user,ac_ip,ac_module,ac_url,ac_state) values ($1,$2,$3,$4,$5)";
$cn->exec_sql($sql, array(
- $_SESSION['g_user'],
+ $_SESSION[SESSION_KEY.'g_user'],
$_SERVER["REMOTE_ADDR"],
$p_module,
$_SERVER['REQUEST_URI'],
@@ -1115,7 +1115,7 @@ class User
$sql = "insert into audit_connect (ac_user,ac_ip,ac_module,ac_url,ac_state) values ($1,$2,$3,$4,$5)";
$cn->exec_sql($sql, array(
- $_SESSION['g_user'],
+ $_SESSION[SESSION_KEY.'g_user'],
$_SERVER["REMOTE_ADDR"],
$p_module,
$_SERVER['REQUEST_URI'],
@@ -1293,8 +1293,8 @@ class User
if ($p_pass1 == $p_pass2) {
$repo = new Database();
$l_pass = md5($_POST['pass_1']);
- $repo->exec_sql("update ac_users set use_pass=$1 where use_login=$2", array($l_pass, $_SESSION['g_user']));
- $_SESSION['g_pass'] = $_POST['pass_1'];
+ $repo->exec_sql("update ac_users set use_pass=$1 where use_login=$2", array($l_pass, $_SESSION[SESSION_KEY.'g_user']));
+ $_SESSION[SESSION_KEY.'g_pass'] = $_POST['pass_1'];
} else {
alert(_("Les mots de passe ne correspondent pas. Mot de passe inchangé"));
}
@@ -1306,7 +1306,7 @@ class User
function save_email($p_email)
{
$repo=new Database();
- $repo->exec_sql("update ac_users set use_email=$1 where use_login=$2", array($p_email, $_SESSION['g_user']));
+ $repo->exec_sql("update ac_users set use_email=$1 where use_login=$2", array($p_email, $_SESSION[SESSION_KEY.'g_user']));
}
/**
* Remove a user and all his privileges
diff --git a/include/config.inc.example b/include/config.inc.example
index 65650be22..e1be7d1be 100644
--- a/include/config.inc.example
+++ b/include/config.inc.example
@@ -69,4 +69,6 @@ define ("dbname","");
// In recent distribution linux, pdftk is a snap, you should set the path
// for exporting document in PDF
// $pdftk = /usr/bin/pdftk
-// $pdftk = /snap/bin/pdftk
+// $pdftk = /snap/bin/pdftk
+// Define a random session key if you work with different version of NOALYSS
+// define ('SESSION_KEY','abcde');
diff --git a/include/constant.php b/include/constant.php
index 5aa3a4da6..feaf0812c 100644
--- a/include/constant.php
+++ b/include/constant.php
@@ -51,7 +51,9 @@ if ( !defined("FIX_BROKEN_PDF")) define ("FIX_BROKEN_PDF",'NO');
if ( !defined('NOALYSS_ADMINISTRATOR')) {
define ('NOALYSS_ADMINISTRATOR','phpcompta');
}
-
+if (!defined ("SESSION_KEY")) {
+ define ("SESSION_KEY","RtYu0uu");
+}
require_once NOALYSS_INCLUDE.'/constant.security.php';
if ( strpos($inc_path,";") != 0 ) {
diff --git a/include/extension_choice.inc.php b/include/extension_choice.inc.php
index afca41139..ba5a2484e 100644
--- a/include/extension_choice.inc.php
+++ b/include/extension_choice.inc.php
@@ -14,7 +14,7 @@ require_once NOALYSS_INCLUDE.'/lib/iselect.class.php';
require_once NOALYSS_INCLUDE.'/constant.security.php';
require_once NOALYSS_INCLUDE.'/class/user.class.php';
echo '