0aa9c4ed28
set double authentication : create, send link, usable with FreeOTP (opensource) AEgis (opensource) and Google Authenticator 1. OTP : prevent direct access without going throught the 2FA mechanism 2. Go back to the url where you were disconnected 3. Cosmetic
90 lines
No EOL
2.9 KiB
PHP
90 lines
No EOL
2.9 KiB
PHP
<?php
|
|
/*
|
|
* This file is part of NOALYSS under GPL
|
|
*
|
|
*/
|
|
/**
|
|
* @file
|
|
* @brief this file is used for the ajax from the extension, it will the ajax.php file from the plugin directory
|
|
* all the variable are in $_REQUEST
|
|
* The code (of the plugin) is required
|
|
* Required variable in $_REQUEST
|
|
* - gDossier
|
|
* - plugin_code
|
|
*/
|
|
if ( ! defined ('ALLOWED') ) define ('ALLOWED',1);
|
|
require_once '../include/constant.php';
|
|
require_once NOALYSS_INCLUDE.'/lib/ac_common.php';
|
|
require_once NOALYSS_INCLUDE.'/class/database.class.php';
|
|
require_once NOALYSS_INCLUDE.'/lib/icon_action.class.php';
|
|
require_once NOALYSS_INCLUDE . '/class/noalyss_user.class.php';
|
|
require_once NOALYSS_INCLUDE.'/class/extension.class.php';
|
|
if ( !isset ($_REQUEST['gDossier'])) exit();
|
|
MaintenanceMode("block.html");
|
|
require_once NOALYSS_INCLUDE.'/class/noalyss_parameter_folder.class.php';
|
|
mb_internal_encoding("UTF-8");
|
|
/**
|
|
* if not connected, session is expired then exit with a message NOCONX
|
|
*/
|
|
if ( ! isset($_SESSION[SESSION_KEY."g_user"])) {
|
|
echo "NOCONX";
|
|
die();
|
|
}
|
|
|
|
global $g_user,$cn,$g_parameter;
|
|
$cn=Dossier::connect();
|
|
$g_parameter=new Noalyss_Parameter_Folder($cn);
|
|
$g_user=new Noalyss_user($cn);
|
|
$g_user->check(true);
|
|
/**
|
|
* check if 2FA is completed
|
|
*/
|
|
if ( ! $g_user->is_double_identified()) {
|
|
exit();
|
|
}
|
|
IDate::set_firstDate($g_user->get_first_week_day());
|
|
ITva_Popup::set_vat_code($g_user->get_vat_code_preference());
|
|
|
|
set_language();
|
|
/* if a code has been asked */
|
|
if (isset($_REQUEST['plugin_code']) )
|
|
{
|
|
if ( LOGINPUT)
|
|
{
|
|
$file_loginput=fopen($_ENV['TMP'].'/scenario-'.$_SERVER['REQUEST_TIME'].'.php','a+');
|
|
fwrite ($file_loginput,"<?php \n");
|
|
fwrite ($file_loginput,'//@description:'.$_REQUEST['plugin_code']."\n");
|
|
fwrite($file_loginput, '$_GET='.var_export($_GET,true));
|
|
fwrite($file_loginput,";\n");
|
|
fwrite($file_loginput, '$_POST='.var_export($_POST,true));
|
|
fwrite($file_loginput,";\n");
|
|
fwrite($file_loginput, '$_POST[\'gDossier\']=$gDossierLogInput;');
|
|
fwrite($file_loginput,"\n");
|
|
fwrite($file_loginput, '$_GET[\'gDossier\']=$gDossierLogInput;');
|
|
fwrite($file_loginput,"\n");
|
|
fwrite($file_loginput,' $_REQUEST=array_merge($_GET,$_POST);');
|
|
fwrite($file_loginput,"\n");
|
|
fwrite($file_loginput,"include '".basename(__FILE__)."';\n");
|
|
fclose($file_loginput);
|
|
}
|
|
|
|
$ext=new Extension($cn);
|
|
|
|
if ( $ext->search($_REQUEST['plugin_code']) != -1)
|
|
{
|
|
/* security */
|
|
if ( !isset ($_SESSION[SESSION_KEY.'g_user']) || $ext->can_request($_SESSION[SESSION_KEY.'g_user']) == 0 )
|
|
{
|
|
exit();
|
|
}
|
|
/* call the ajax script */
|
|
require_once(NOALYSS_PLUGIN.DIRECTORY_SEPARATOR.dirname(trim($ext->getp('me_file'))).DIRECTORY_SEPARATOR.'ajax.php');
|
|
}
|
|
else
|
|
{
|
|
alert(j(_("Cette extension n'existe pas ")));
|
|
exit();
|
|
}
|
|
|
|
}
|
|
?>
|