Dereku/snappymail
1
0
Fork 0
mirror of https://github.com/the-djmaze/snappymail.git synced 2026-09-07 16:37:02 +03:00
Code Issues Projects Releases Packages Wiki Activity Actions

Revamp admin login cookie

Browse source
This commit is contained in:
djmaze 2021-12-09 12:46:53 +01:00
parent 26b728cf93
commit a4dad79d3f
1 changed files with 14 additions and 24 deletions
Download patch file Download diff file Expand all files Collapse all files

38
snappymail/v/0.0.0/app/libraries/RainLoop/Actions/Admin.php
View file

@ -11,34 +11,29 @@ use RainLoop\Utils;
trait Admin trait Admin
{ {
private static $AUTH_ADMIN_TOKEN_KEY = 'rlaauth'; private static $AUTH_ADMIN_TOKEN_KEY = 'smadmin';
public function IsAdminLoggined(bool $bThrowExceptionOnFalse = true) : bool public function IsAdminLoggined(bool $bThrowExceptionOnFalse = true) : bool
{ {
$bResult = false; if ($this->Config()->Get('security', 'allow_admin_panel', true)) {
if ($this->Config()->Get('security', 'allow_admin_panel', true)) $sAdminKey = $this->getAdminAuthKey();
{ if ($sAdminKey && '' !== $this->Cacher(null, true)->Get(KeyPathHelper::SessionAdminKey($sAdminKey), '')) {
$aAdminHash = Utils::DecodeKeyValuesQ($this->getAdminAuthToken()); return true;
if (!empty($aAdminHash[0]) && !empty($aAdminHash[1]) && !empty($aAdminHash[2]) &&
'token' === $aAdminHash[0] && \md5(APP_SALT) === $aAdminHash[1] &&
'' !== $this->Cacher(null, true)->Get(KeyPathHelper::SessionAdminKey($aAdminHash[2]), '')
)
{
$bResult = true;
} }
} }
if (!$bResult && $bThrowExceptionOnFalse) if ($bThrowExceptionOnFalse)
{ {
throw new ClientException(Notifications::AuthError); throw new ClientException(Notifications::AuthError);
} }
return $bResult; return false;
} }
private function getAdminAuthToken() : string private function getAdminAuthKey() : string
{ {
return Utils::GetCookie(static::$AUTH_ADMIN_TOKEN_KEY, ''); $aAdminHash = Utils::DecodeKeyValuesQ(Utils::GetCookie(static::$AUTH_ADMIN_TOKEN_KEY, ''));
return (empty($aAdminHash[1]) || 'token' !== $aAdminHash[0]) ? '' : $aAdminHash[1];
} }
private function setAdminAuthToken(string $sToken) : void private function setAdminAuthToken(string $sToken) : void
@ -48,15 +43,10 @@ trait Admin
public function ClearAdminAuthToken() : void public function ClearAdminAuthToken() : void
{ {
$aAdminHash = Utils::DecodeKeyValuesQ($this->getAdminAuthToken()); $sAdminKey = $this->getAdminAuthKey();
if ( if ($sAdminKey) {
!empty($aAdminHash[0]) && !empty($aAdminHash[1]) && !empty($aAdminHash[2]) && $this->Cacher(null, true)->Delete(KeyPathHelper::SessionAdminKey($sAdminKey));
'token' === $aAdminHash[0] && \md5(APP_SALT) === $aAdminHash[1]
)
{
$this->Cacher(null, true)->Delete(KeyPathHelper::SessionAdminKey($aAdminHash[2]));
} }
Utils::ClearCookie(static::$AUTH_ADMIN_TOKEN_KEY); Utils::ClearCookie(static::$AUTH_ADMIN_TOKEN_KEY);
} }
@ -70,7 +60,7 @@ trait Admin
return ''; return '';
} }
return Utils::EncodeKeyValuesQ(array('token', \md5(APP_SALT), $sRand)); return Utils::EncodeKeyValuesQ(array('token', $sRand));
} }
private function setCapaFromParams(\RainLoop\Config\Application $oConfig, string $sParamName, string $sCapa) : void private function setCapaFromParams(\RainLoop\Config\Application $oConfig, string $sParamName, string $sCapa) : void