admingit/altocompta
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Security : add redirect in javascript and with header

Browse source
This commit is contained in:
sparkyx 2025-07-06 10:51:27 +02:00
parent 22f33636a5
commit a6c0e9650b
6 changed files with 32 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

2
html/do.php
View file

@ -41,7 +41,7 @@ mb_internal_encoding("UTF-8");
// if gDossier is not set redirect to form to choose a folder
if ( ! isset($_REQUEST['gDossier']))
{
redirect('user_login.php');
redirect_header('user_login.php');
exit();
}
if ( ! isset ($_SESSION[SESSION_KEY.'g_user']))

2
html/export.php
View file

@ -55,7 +55,7 @@ $action=$hi->get("act");
if ( $action=='X' || $g_user->check_print($action)==0 )
{
echo alert(_('Accès interdit'));
echo alert(_('Accès interdit'));
redirect("do.php?".dossier::get());
exit();
}

4
html/index.php
View file

@ -135,7 +135,7 @@
*/
if (!file_exists('..'.DIRECTORY_SEPARATOR.'include'.DIRECTORY_SEPARATOR.'config.inc.php') )
if (! file_exists('..'.DIRECTORY_SEPARATOR.'include'.DIRECTORY_SEPARATOR.'config.inc.php') )
{
echo <<<EOF
@ -144,7 +144,7 @@ window.location="install.php";
</script>
EOF;
header("Location: install.php", true, 307);
header("Location: install.php");
exit(0);
}

14
html/login.php
View file

@ -21,7 +21,6 @@ require_once '../include/constant.php';
require_once NOALYSS_INCLUDE.'/lib/ac_common.php';
MaintenanceMode("block.html");
/*! \file
* \brief Login page
*/
@ -47,7 +46,6 @@ if ( isset ($_POST["p_user"] ) )
$User=new Noalyss_user($rep);
$User->Check(false,'LOGIN');
/*
* Check repository version
*/
@ -69,21 +67,25 @@ if ( isset ($_POST["p_user"] ) )
if ( $valid == false )
{
echo alert(_('Code invalide'));
echo "<META HTTP-EQUIV=\"REFRESH\" content=\"0;url=index.php\">";
header("Location: ".NOALYSS_URL."/index.php");
exit();
}
}
if ($User->get_access_mode()=='PC')
{
// force the nocache
$backurl='user_login.php?v='.microtime(true);
$backurl=NOALYSS_URL.'/user_login.php?v='.microtime(true);
if ( isset ($_POST['backurl'])) {
$backurl=urldecode($_POST['backurl']);
// check that backurl is valid
$backurl=preg_replace('/^.*\?/','',$backurl);
$backurl=NOALYSS_URL."?$backurl";
}
echo "<META HTTP-EQUIV=\"REFRESH\" content=\"0;url={$backurl}\">";
header("Location: $backurl");
exit();
} else {
echo "<META HTTP-EQUIV=\"REFRESH\" content=\"0;url=mobile.php\">";
header("Location: ".NOALYSS_URL."/mobile.php");
exit();
}
}

1
html/user_login.php
View file

@ -28,7 +28,6 @@ require_once NOALYSS_INCLUDE.'/lib/itext.class.php';
require_once NOALYSS_INCLUDE.'/lib/http_input.class.php';
require_once NOALYSS_INCLUDE.'/lib/function_javascript.php';
require_once NOALYSS_INCLUDE.'/lib/icon_action.class.php';
@html_page_start($_SESSION[SESSION_KEY.'g_theme']);
MaintenanceMode("block.html");

22
include/lib/user_common.php
View file

@ -178,12 +178,30 @@ function CleanUrl()
$url=http_build_query($_GET);
return $url;
}
function redirect($p_string,$p_time=0)
/**
* @brief redirect with javascript
* @param $p_string (string) URL
* @param $p_time (type ) time before redirecting
*/
function redirect( $p_string,$p_time=0)
{
if (strpos( $p_string,'?') == 0 ) {
$p_string = $p_string.'?v='.microtime(true);
}
echo '<HTML><head><META HTTP-EQUIV="REFRESH" content="'.$p_time.'; url='.$p_string.'"></head><body> Connecting... </body></html>';
}
/**
* @brief redirect with header,
* @note if something has been already send to the browser,
* the redirection will fails
* @param string $p_string
*/
function redirect_header($p_string)
{
if (strpos( $p_string,'?') == 0 ) {
$p_string = $p_string.'?v='.microtime(true);
}
echo '<HTML><head><META HTTP-EQUIV="REFRESH" content="'.$p_time.'; url='.$p_string.'"></head><body> Connecting... </body></html>';
header("Location: $p_string");
}
/*!
* \brief remove the useless space, change comma by period and try to return