Changeset 1004 for trunk/picture.php

Timestamp:

Jan 15, 2006, 2:45:42 PM (18 years ago)

Author:

nikrou

Message:

Improve security of sessions:

• use only cookies to store session id on client side
• use default php session system with database handler to store sessions on server side

File:

• trunk/picture.php (modified) (12 diffs)

trunk/picture.php

@@ -77 +77 @@
 {
   echo '<div style="text-align:center;">'.$lang['access_forbiden'].'<br />';
-  echo '<a href="'.add_session_id( PHPWG_ROOT_PATH.'category.php' ).'">';
+  echo '<a href="'.PHPWG_ROOT_PATH.'category.php'.'">';
   echo $lang['thumbnails'].'</a></div>';
   exit();
@@ -324 +324 @@
       // there is no favorite picture anymore we redirect the user to the
       // category page
-      $url = add_session_id($url_up);
-      redirect($url);
+      redirect($url_up);
     }
     else if (!$has_prev)
     {
       $url = str_replace( '&amp;', '&', $picture['next']['url'] );
-      $url = add_session_id( $url, true);
+      redirect( $url );
     }
     else
     {
       $url = str_replace('&amp;', '&', $picture['prev']['url'] );
-      $url = add_session_id( $url, true);
+      redirect( $url );
     }
     redirect( $url );
@@ -523 +522 @@
   'L_UP_ALT' => $lang['home'],
   
-  'U_HOME' => add_session_id(PHPWG_ROOT_PATH.'category.php'),
-  'U_UP' => add_session_id($url_up),
-  'U_METADATA' => add_session_id($url_metadata),
-  'U_ADMIN' => add_session_id($url_admin),
-  'U_SLIDESHOW'=> add_session_id($url_slide),
-  'U_ADD_COMMENT' => add_session_id(str_replace( '&', '&amp;', $_SERVER['REQUEST_URI'] ))
+  'U_HOME' => (PHPWG_ROOT_PATH.'category.php'),
+  'U_UP' => $url_up,
+  'U_METADATA' => $url_metadata,
+  'U_ADMIN' => $url_admin,
+  'U_SLIDESHOW'=> $url_slide,
+  'U_ADD_COMMENT' => str_replace( '&', '&amp;', $_SERVER['REQUEST_URI'] )
   )
 );
@@ -585 +584 @@
     array(
       'URL' =>
-      add_session_id(
         PHPWG_ROOT_PATH.'picture.php'
         .get_query_string_diff(array('caddie')).'&amp;caddie=1')
-      )
     );
 }
@@ -646 +643 @@
       'TITLE_IMG' => $picture['prev']['name'],
       'IMG' => $picture['prev']['thumbnail'],
-      'U_IMG' => add_session_id($picture['prev']['url'])
+      'U_IMG' => $picture['prev']['url']
       ));
 }
@@ -657 +654 @@
       'TITLE_IMG' => $picture['next']['name'],
       'IMG' => $picture['next']['thumbnail'],
-      'U_IMG' => add_session_id($picture['next']['url'])
+      'U_IMG' => $picture['next']['url']
       ));
 }
@@ -680 +677 @@
   $infos['INFO_AUTHOR'] =
     '<a href="'.
-    add_session_id(
       PHPWG_ROOT_PATH.'category.php?cat=search'.
       '&amp;search=author:'.$picture['current']['author']
-      ).
-    '">'.$picture['current']['author'].'</a>';
+      .'">'.$picture['current']['author'].'</a>';
 }
 else
@@ -696 +691 @@
   $infos['INFO_CREATION_DATE'] =
     '<a href="'.
-    add_session_id(
       PHPWG_ROOT_PATH.'category.php?cat=search'.
       '&amp;search=date_creation:'.$picture['current']['date_creation']
-      ).
-    '">'.format_date($picture['current']['date_creation']).'</a>';
+      .'">'.format_date($picture['current']['date_creation']).'</a>';
 }
 else
@@ -710 +703 @@
 $infos['INFO_AVAILABILITY_DATE'] =
   '<a href="'.
-  add_session_id(
     PHPWG_ROOT_PATH.'category.php?cat=search'.
     '&amp;search=date_available:'.
     substr($picture['current']['date_available'], 0, 10)
-    ).
-    '">'.
+    .'">'.
   format_date($picture['current']['date_available'], 'mysql_datetime').
   '</a>';
@@ -764 +755 @@
       '/([^,]+)/',
       '<a href="'.
-      add_session_id(
         PHPWG_ROOT_PATH.'category.php?cat=search&amp;search=keywords:$1'
-        ).
-      '">$1</a>',
+        .'">$1</a>',
       $picture['current']['keywords']
       );
@@ -891 +880 @@
         
   $template->assign_block_vars('stop_slideshow', array(
-  'U_SLIDESHOW'=>add_session_id( $picture['current']['url'] )
+  'U_SLIDESHOW'=>$picture['current']['url']
   ));
 }
@@ -1044 +1033 @@
       $template->assign_block_vars(
         'comments.comment.delete',
-        array('U_COMMENT_DELETE'=>add_session_id( $url.'&amp;del='.$row['id'])
+        array('U_COMMENT_DELETE'=> $url.'&amp;del='.$row['id']
           ));
     }