Changeset 1004 for trunk/admin


Ignore:
Timestamp:
Jan 15, 2006, 2:45:42 PM (18 years ago)
Author:
nikrou
Message:

Improve security of sessions:

  • use only cookies to store session id on client side
  • use default php session system with database handler to store sessions on server side
Location:
trunk/admin
Files:
19 edited

Legend:

Unmodified
Added
Removed

  • trunk/admin/cat_list.php

    r960 r1004  
    6666
    6767$base_url = PHPWG_ROOT_PATH.'admin.php?page=cat_list';
    68 $navigation = '<a class="" href="'.add_session_id($base_url).'">';
     68$navigation = '<a class="" href="'.$base_url.'">';
    6969$navigation.= $lang['home'];
    7070$navigation.= '</a>';
    … …  
    239239  'CATEGORIES_NAV'=>$navigation,
    240240  'NEXT_RANK'=>$next_rank,
    241   'F_ACTION'=>add_session_id($form_action),
     241  'F_ACTION'=>$form_action,
    242242 
    243243  'L_ADD_VIRTUAL'=>$lang['cat_add'],
    … …  
    319319      'RANK'=>$category['rank']*10,
    320320
    321       'U_JUMPTO'=>
    322       add_session_id(PHPWG_ROOT_PATH.'category.php?cat='.$category['id']),
    323      
    324       'U_CHILDREN'=>
    325       add_session_id($cat_list_url.'&amp;parent_id='.$category['id']),
    326      
    327       'U_EDIT'=>
    328       add_session_id($base_url.'cat_modify&amp;cat_id='.$category['id'])
     321      'U_JUMPTO'=>PHPWG_ROOT_PATH.'category.php?cat='.$category['id'],
     322      'U_CHILDREN'=>$cat_list_url.'&amp;parent_id='.$category['id'],     
     323      'U_EDIT'=>$base_url.'cat_modify&amp;cat_id='.$category['id']
    329324      )
    330325    );
    … …  
    335330      'category.delete',
    336331      array(
    337         'URL'=>add_session_id($self_url.'&amp;delete='.$category['id'])
     332        'URL'=>$self_url.'&amp;delete='.$category['id']
    338333        )
    339334      );
    … …  
    345340      'category.elements',
    346341      array(
    347         'URL'=>add_session_id($base_url.'element_set&amp;cat='.$category['id'])
     342        'URL'=>$base_url.'element_set&amp;cat='.$category['id']
    348343        )
    349344      );
    … …  
    355350      'category.permissions',
    356351      array(
    357         'URL'=>add_session_id($base_url.'cat_perm&amp;cat='.$category['id'])
     352        'URL'=>$base_url.'cat_perm&amp;cat='.$category['id']
    358353        )
    359354      );

  • trunk/admin/cat_modify.php

    r881 r1004  
    172172  'L_SET_RANDOM_REPRESENTANT'=>$lang['cat_representant'],
    173173
    174   'U_JUMPTO'=>
    175     add_session_id(PHPWG_ROOT_PATH.'category.php?cat='.$category['id']),
    176   'U_CHILDREN'=>
    177     add_session_id($cat_list_url.'&amp;parent_id='.$category['id']),
     174  'U_JUMPTO'=>PHPWG_ROOT_PATH.'category.php?cat='.$category['id'],
     175  'U_CHILDREN'=>$cat_list_url.'&amp;parent_id='.$category['id'],
    178176  'U_HELP' => PHPWG_ROOT_PATH.'/popuphelp.php?page=cat_modify',
    179177   
    180   'F_ACTION'=>add_session_id($form_action)
     178  'F_ACTION'=>$form_action
    181179  ));
    182180
    … …  
    187185    'permissions',
    188186    array(
    189       'URL'=>add_session_id($base_url.'cat_perm&amp;cat='.$category['id'])
     187      'URL'=>$base_url.'cat_perm&amp;cat='.$category['id']
    190188        )
    191189    );
    … …  
    198196    'elements',
    199197    array(
    200       'URL'=>add_session_id($base_url.'element_set&amp;cat='.$category['id'])
     198      'URL'=>$base_url.'element_set&amp;cat='.$category['id']
    201199      )
    202200    );
    … …  
    268266    'delete',
    269267    array(
    270       'URL'=>add_session_id($self_url.'&amp;delete='.$category['id'])
     268      'URL'=>$self_url.'&amp;delete='.$category['id']
    271269      )
    272270    );

  • trunk/admin/cat_move.php

    r881 r1004  
    6969$template->assign_vars(
    7070  array(
    71     'F_ACTION' => add_session_id(PHPWG_ROOT_PATH.'admin.php?page=cat_move'),
     71    'F_ACTION' => PHPWG_ROOT_PATH.'admin.php?page=cat_move',
    7272    )
    7373  );

  • trunk/admin/cat_options.php

    r862 r1004  
    154154    'U_HELP' => PHPWG_ROOT_PATH.'/popuphelp.php?page=cat_options',
    155155   
    156     'F_ACTION'=>add_session_id($base_url.$page['section'])
     156    'F_ACTION'=>$base_url.$page['section']
    157157   )
    158158 );

  • trunk/admin/cat_perm.php

    r873 r1004  
    208208        ),
    209209    'U_HELP' => PHPWG_ROOT_PATH.'/popuphelp.php?page=cat_perm',
    210     'F_ACTION' =>
    211       add_session_id(
    212         PHPWG_ROOT_PATH.'admin.php?page=cat_perm&amp;cat='.$page['cat']
    213         )
     210    'F_ACTION' => PHPWG_ROOT_PATH.'admin.php?page=cat_perm&amp;cat='.$page['cat']
    214211    )
    215212  );

  • trunk/admin/comments.php

    r839 r1004  
    118118$template->assign_vars(
    119119  array(
    120     'F_ACTION' => add_session_id(PHPWG_ROOT_PATH.'admin.php?page=comments')
     120    'F_ACTION' => PHPWG_ROOT_PATH.'admin.php?page=comments'
    121121    )
    122122  );
    … …  
    142142    array(
    143143      'U_PICTURE' =>
    144         add_session_id(
    145144          PHPWG_ROOT_PATH.'admin.php?page=picture_modify'.
    146           '&amp;image_id='.$row['image_id']
    147           ),
     145          '&amp;image_id='.$row['image_id'],
    148146      'ID' => $row['id'],
    149147      'TN_SRC' => get_thumbnail_src($row['path'], @$row['tn_ext']),

  • trunk/admin/configuration.php

    r960 r1004  
    150150    'U_HELP' => PHPWG_ROOT_PATH.'/popuphelp.php?page=configuration',
    151151   
    152     'F_ACTION'=>add_session_id($action)
     152    'F_ACTION'=>$action
    153153    ));
    154154

  • trunk/admin/element_set_unit.php

    r875 r1004  
    223223            $row['name'] : get_name_from_file($row['file']),
    224224        'U_EDIT' =>
    225           add_session_id(
    226225            PHPWG_ROOT_PATH.'admin.php?page=picture_modify'.
    227             '&amp;image_id='.$row['id']
    228             ),
     226            '&amp;image_id='.$row['id'],
    229227        'ID' => $row['id'],
    230228        'FILENAME' => $row['path'],

  • trunk/admin/group_list.php

    r815 r1004  
    125125$template->assign_vars(
    126126  array(
    127     'F_ADD_ACTION' =>
    128       add_session_id(PHPWG_ROOT_PATH.'admin.php?page=group_list')
     127    'F_ADD_ACTION' => PHPWG_ROOT_PATH.'admin.php?page=group_list'
    129128    )
    130129  );

  • trunk/admin/group_perm.php

    r817 r1004  
    141141   
    142142    'F_ACTION' =>
    143       add_session_id(
    144143        PHPWG_ROOT_PATH.
    145144        'admin.php?page=group_perm&amp;group_id='.
    146145        $page['group']
    147         )
    148146    )
    149147  );

  • trunk/admin/intro.php

    r861 r1004  
    176176    'DB_GROUPS' => sprintf(l10n('%d groups'), $nb_groups),
    177177    'DB_COMMENTS' => sprintf(l10n('%d comments'), $nb_comments),
    178     'U_CHECK_UPGRADE' =>
    179       add_session_id(PHPWG_ROOT_PATH.'admin.php?action=check_upgrade'),
    180     'U_PHPINFO' =>
    181       add_session_id(PHPWG_ROOT_PATH.'admin.php?action=phpinfo')
     178    'U_CHECK_UPGRADE' => PHPWG_ROOT_PATH.'admin.php?action=check_upgrade',
     179    'U_PHPINFO' => PHPWG_ROOT_PATH.'admin.php?action=phpinfo'
    182180    )
    183181  );
    … …  
    216214    'waiting',
    217215    array(
    218       'URL' => add_session_id(PHPWG_ROOT_PATH.'admin.php?page=waiting'),
     216      'URL' => PHPWG_ROOT_PATH.'admin.php?page=waiting',
    219217      'INFO' => sprintf(l10n('%d waiting for validation'), $nb_waiting)
    220218      )
    … …  
    235233    'unvalidated',
    236234    array(
    237       'URL' => add_session_id(PHPWG_ROOT_PATH.'admin.php?page=comments'),
     235      'URL' => PHPWG_ROOT_PATH.'admin.php?page=comments',
    238236      'INFO' => sprintf(l10n('%d waiting for validation'), $nb_comments)
    239237      )

  • trunk/admin/maintenance.php

    r858 r1004  
    9999$template->assign_vars(
    100100  array(
    101     'U_MAINT_CATEGORIES' => add_session_id($start_url.'categories'),
    102     'U_MAINT_IMAGES' => add_session_id($start_url.'images'),
    103     'U_MAINT_HISTORY' => add_session_id($start_url.'history'),
    104     'U_MAINT_SESSIONS' => add_session_id($start_url.'sessions'),
    105     'U_MAINT_FEEDS' => add_session_id($start_url.'feeds'),
     101    'U_MAINT_CATEGORIES' => $start_url.'categories',
     102    'U_MAINT_IMAGES' => $start_url.'images',
     103    'U_MAINT_HISTORY' => $start_url.'history',
     104    'U_MAINT_SESSIONS' => $start_url.'sessions',
     105    'U_MAINT_FEEDS' => $start_url.'feeds',
    106106    'U_HELP' => PHPWG_ROOT_PATH.'/popuphelp.php?page=maintenance',
    107107    )

  • trunk/admin/picture_modify.php

    r825 r1004  
    196196  array(
    197197    'U_SYNC' =>
    198       add_session_id(
    199198        PHPWG_ROOT_PATH.'admin.php?page=picture_modify'.
    200199        '&amp;image_id='.$_GET['image_id'].
    201200        (isset($_GET['cat_id']) ? '&amp;cat_id='.$_GET['cat_id'] : '').
    202         '&amp;sync_metadata=1'
    203         ),
     201        '&amp;sync_metadata=1',
    204202   
    205203    'PATH'=>$row['path'],
    … …  
    231229 
    232230    'F_ACTION' =>
    233       add_session_id(
    234231        PHPWG_ROOT_PATH.'admin.php'
    235232        .get_query_string_diff(array('sync_metadata'))
    236         )
    237233    )
    238234  );

  • trunk/admin/remote_site.php

    r927 r1004  
    516516    'U_HELP' => PHPWG_ROOT_PATH.'/popuphelp.php?page=remote_site',
    517517   
    518     'F_ACTION'=>add_session_id(PHPWG_ROOT_PATH.'admin.php?page=remote_site')
     518    'F_ACTION'=>PHPWG_ROOT_PATH.'admin.php?page=remote_site'
    519519   )
    520520 );
    … …  
    687687      array(
    688688        'URL' => $url,
    689         'U_UPDATE' => add_session_id($base_url.'local_update')
     689        'U_UPDATE' => $base_url.'local_update'
    690690        )
    691691      );
    … …  
    732732    array(
    733733      'NAME' => $row['galleries_url'],
    734       'U_GENERATE' => add_session_id($base_url.'generate'),
    735       'U_UPDATE' => add_session_id($base_url.'update'),
    736       'U_CLEAN' => add_session_id($base_url.'clean'),
    737       'U_DELETE' => add_session_id($base_url.'delete')
     734      'U_GENERATE' => $base_url.'generate',
     735      'U_UPDATE' => $base_url.'update',
     736      'U_CLEAN' => $base_url.'clean',
     737      'U_DELETE' => $base_url.'delete'
    738738     )
    739739   );

  • trunk/admin/stats.php

    r918 r1004  
    6363  $title_page=$lang['stats_day_title'].' du '.$date_of_day;
    6464  $url_back = PHPWG_ROOT_PATH."admin.php?page=stats";
    65   $url_back = add_session_id($url_back);
     65  $url_back = $url_back;
    6666  $title_details='<a href='.$url_back.'>'.$lang['stats_day_title'].'</a>';
    6767  $title_day = $date_of_day;
    … …  
    7272  $title_page=$lang['stats_month_title'].' : '.$date_of_day;
    7373  $url_back = PHPWG_ROOT_PATH."admin.php?page=stats";
    74   $url_back = add_session_id($url_back);
     74  $url_back = $url_back;
    7575  $title_details='<a href='.$url_back.'>'.$lang['stats_day_title'].'</a>';
    7676  $title_day=$lang['today'];
    … …  
    106106  'L_STAT_PICTURE'=>$lang['stats_picture'],
    107107 
    108   'IMG_REPORT'=>add_session_id($url_img)
     108  'IMG_REPORT'=>$url_img
    109109  ));
    110110
    … …  
    142142      ;
    143143
    144     $value = '<a href="'.add_session_id($url).'">';
     144    $value = '<a href="'.$url.'">';
    145145    $value.= $row['d'].' ('.$week_day.')';
    146146    $value.= "</a>";
    … …  
    161161      ;
    162162   
    163     $value = '<a href="'.add_session_id($url).'">';
     163    $value = '<a href="'.$url.'">';
    164164    $value.= $lang['month'][$row['m']].' '.$row['y'];
    165165    $value.= "</a>";

  • trunk/admin/thumbnail.php

    r862 r1004  
    359359    'params',
    360360    array(
    361       'F_ACTION'=>add_session_id($form_url),
     361      'F_ACTION'=>$form_url,
    362362      $gdlabel=>'checked="checked"',
    363363      $nlabel=>'checked="checked"',

  • trunk/admin/user_list.php

    r998 r1004  
    425425$template->set_filenames(array('user_list'=>'admin/user_list.tpl'));
    426426
    427 $base_url = add_session_id(PHPWG_ROOT_PATH.'admin.php?page=user_list');
     427$base_url = PHPWG_ROOT_PATH.'admin.php?page=user_list';
    428428
    429429if (isset($_GET['start']) and is_numeric($_GET['start']))
    … …  
    791791      'ID' => $local_user['id'],
    792792      'CHECKED' => $checked,
    793       'U_MOD' => add_session_id($profile_url.$local_user['id']),
    794       'U_PERM' => add_session_id($perm_url.$local_user['id']),
     793      'U_MOD' => $profile_url.$local_user['id'],
     794      'U_PERM' => $perm_url.$local_user['id'],
    795795      'USERNAME' => $local_user['username'],
    796796      'STATUS' => $lang['user_status_'.$local_user['status']],

  • trunk/admin/user_perm.php

    r818 r1004  
    134134   
    135135    'F_ACTION' =>
    136       add_session_id(
    137136        PHPWG_ROOT_PATH.
    138137        'admin.php?page=user_perm'.
    139138        '&amp;user_id='.$page['user']
    140         )
    141139    )
    142140  );

  • trunk/admin/waiting.php

    r849 r1004  
    149149  'L_DELETE'=>$lang['delete'],
    150150 
    151   'F_ACTION'=>add_session_id(str_replace( '&', '&amp;', $_SERVER['REQUEST_URI'] ))
     151  'F_ACTION'=>str_replace( '&', '&amp;', $_SERVER['REQUEST_URI'])
    152152  ));
    153153 
Note: See TracChangeset for help on using the changeset viewer.