dbxe/fusionpbx
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

regenerate the session after cidr check is complete and then log (#7117)

Browse Source 
Logging after all checks are complete ensures the session ID is correct when logging it in the user_logs table

Co-authored-by: Tim Fry <tim@fusionpbx.com>
This commit is contained in:
frytimo
2024-09-04 12:06:09 -06:00
committed by GitHub
co-authored by Tim Fry
parent 369b8dd049
commit b529d2a535
1 changed files with 19 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
core/authentication/resources/classes/authentication.php
+19 -15
View File
@@ -46,7 +46,7 @@ class authentication {
* Called when the object is created * Called when the object is created
*/ */
public function __construct() { public function __construct() {
$this->database = new database(); $this->database = database::new();
} }
/** /**
@@ -177,21 +177,9 @@ class authentication {
// } // }
// $result["authorized"] = $authorized; // $result["authorized"] = $authorized;
//add the result to the user logs
user_logs::add($result);
//user is authorized - get user settings, check user cidr //user is authorized - get user settings, check user cidr
if ($authorized) { if ($authorized) {
//regenerate the session on login
session_regenerate_id(true);
//set a session variable to indicate authorized is set to true
$_SESSION['authorized'] = true;
//add the username to the session //username seesion could be set soone when check_auth uses an authorized session variable instead
$_SESSION['username'] = $result["username"];
//get the user settings //get the user settings
$sql = "select * from v_user_settings "; $sql = "select * from v_user_settings ";
$sql .= "where domain_uuid = :domain_uuid "; $sql .= "where domain_uuid = :domain_uuid ";
@@ -221,6 +209,11 @@ class authentication {
} }
} }
if (!$found) { if (!$found) {
//log the failed attempt
$login_result = $_SESSION['authentication']['plugin'];
user_logs::add($_SESSION['authentication']['plugin'][$plugin_classname]);
//destroy session //destroy session
session_unset(); session_unset();
session_destroy(); session_destroy();
@@ -263,8 +256,6 @@ class authentication {
//get the groups assigned to the user //get the groups assigned to the user
$group = new groups($this->database, $result["domain_uuid"], $result["user_uuid"]); $group = new groups($this->database, $result["domain_uuid"], $result["user_uuid"]);
$groups = $group->get_groups();
$group_level = $group->group_level;
$group->session(); $group->session();
//get the permissions assigned to the user through the assigned groups //get the permissions assigned to the user through the assigned groups
@@ -370,8 +361,21 @@ class authentication {
date_default_timezone_set($_SESSION["time_zone"]["user"]); date_default_timezone_set($_SESSION["time_zone"]["user"]);
} }
//regenerate the session on login
session_regenerate_id(true);
//set a session variable to indicate authorized is set to true
$_SESSION['authorized'] = true;
//add the username to the session - username session could be set so check_auth uses an authorized session variable instead
$_SESSION['username'] = $result["username"];
} //authorized true } //authorized true
//log the attempt
$plugin_classname = substr($class_name, 7);
user_logs::add($_SESSION['authentication']['plugin'][$plugin_classname]);
//return the result //return the result
return $result ?? false; return $result ?? false;
} }