From 1d74c870337ca8069703a216fa47d937a941e1e5 Mon Sep 17 00:00:00 2001 From: velz Date: Tue, 27 Jan 2026 12:24:42 +0530 Subject: [PATCH] FIX_SESSION_FP&HTACCESS --- .htaccess | 22 -------------------- app/Controllers/LoginController.php | 4 +--- app/Filters/AuthMVC.php | 4 +--- app/Helpers/utility_helper.php | 31 ++++++++++++++++++++++++++++ public/assets/.htaccess | 25 ++++++++++++++++++++++ public/e_card_imgs/.htaccess | 25 ++++++++++++++++++++++ public/sample_excel/.htaccess | 25 ++++++++++++++++++++++ public/sample_import_excel/.htaccess | 25 ++++++++++++++++++++++ public/writable/.htaccess | 25 ++++++++++++++++++++++ 9 files changed, 158 insertions(+), 28 deletions(-) create mode 100644 public/assets/.htaccess create mode 100644 public/e_card_imgs/.htaccess create mode 100644 public/sample_excel/.htaccess create mode 100644 public/sample_import_excel/.htaccess create mode 100644 public/writable/.htaccess diff --git a/.htaccess b/.htaccess index c9db48e..cf3c184 100755 --- a/.htaccess +++ b/.htaccess @@ -5,28 +5,6 @@ Options -Indexes # Rewrite engine # ---------------------------------------------------------------------- - -## ADDED for - block any script execution inside folder of public - - Deny from all - # Disable PHP engine - - php_flag engine off - - - # Disable CGI and other executable handlers - Options -ExecCGI - AddHandler cgi-script .php .pl .py .jsp .asp .sh .cgi - - # Block access to any script-like files entirely - - ForceType text/plain - #Order allow,deny - Deny from all - - - - # Turning on the rewrite engine is necessary for the following rules and features. # FollowSymLinks must be enabled for this to work. diff --git a/app/Controllers/LoginController.php b/app/Controllers/LoginController.php index aa5d9a8..73f7bb0 100755 --- a/app/Controllers/LoginController.php +++ b/app/Controllers/LoginController.php @@ -61,9 +61,7 @@ class LoginController extends BaseController set_session_data($session_data); // Bind session to device - set_session_data(['fingerprint' => hash('sha256', - ($this->request->getUserAgent()->getAgentString() . '|' . ($this->request->getIPAddress() - )))]); + set_session_data(['fingerprint' => generateFingerprint()]); log_message('error', 'Set The UserId : `'. $user->id .'` in Session'); log_message('error', 'User Login Sucessfully'); diff --git a/app/Filters/AuthMVC.php b/app/Filters/AuthMVC.php index e6c6948..285f586 100755 --- a/app/Filters/AuthMVC.php +++ b/app/Filters/AuthMVC.php @@ -22,9 +22,7 @@ class AuthMVC implements FilterInterface // } // Fingerprint validation - $fp = hash('sha256', - $request->getUserAgent()->getAgentString() . '|' . $request->getIPAddress() - ); + $fp = generateFingerprint(); if (session()->get('fingerprint') !== $fp) { return AuthLogout::logout(); diff --git a/app/Helpers/utility_helper.php b/app/Helpers/utility_helper.php index e1b8a9b..8570a19 100755 --- a/app/Helpers/utility_helper.php +++ b/app/Helpers/utility_helper.php @@ -756,3 +756,34 @@ if (!function_exists('validateExcelFile')) { return true; } } +function getRealClientIP() +{ + $request = service('request'); + + if (!empty($_SERVER['HTTP_CF_CONNECTING_IP'])) { + return $_SERVER['HTTP_CF_CONNECTING_IP']; + } + + if (!empty($_SERVER['HTTP_X_FORWARDED_FOR'])) { + return explode(',', $_SERVER['HTTP_X_FORWARDED_FOR'])[0]; + } + + return $request->getIPAddress(); +} + +function generateFingerprint() +{ + $request = service('request'); + + $ua = $request->getUserAgent()->getAgentString(); + $ip = getRealClientIP(); + // echo $ip;die(); + // Use only subnet (first 3 blocks) to tolerate IP change + $ipParts = explode('.', $ip); + $ipSubnet = $ipParts[0] . '.' . $ipParts[1] . '.' . $ipParts[2]; + + // $secret = env('app.sessionFingerprintSalt'); + + // return hash('sha256', $ua . '|' . $ipSubnet . '|' . $secret); + return hash('sha256', $ua . '|' . $ipSubnet ); +} \ No newline at end of file diff --git a/public/assets/.htaccess b/public/assets/.htaccess new file mode 100644 index 0000000..13e218d --- /dev/null +++ b/public/assets/.htaccess @@ -0,0 +1,25 @@ +# =============================== +# ABSOLUTE SCRIPT EXECUTION BLOCK +# =============================== + +# Disable CGI +Options -ExecCGI + +# Disable PHP for mod_php / LiteSpeed + + php_flag engine off + + + + php_flag engine off + + +# Block any script file access + + Require all denied + + +# Block double extensions + + Require all denied + diff --git a/public/e_card_imgs/.htaccess b/public/e_card_imgs/.htaccess new file mode 100644 index 0000000..13e218d --- /dev/null +++ b/public/e_card_imgs/.htaccess @@ -0,0 +1,25 @@ +# =============================== +# ABSOLUTE SCRIPT EXECUTION BLOCK +# =============================== + +# Disable CGI +Options -ExecCGI + +# Disable PHP for mod_php / LiteSpeed + + php_flag engine off + + + + php_flag engine off + + +# Block any script file access + + Require all denied + + +# Block double extensions + + Require all denied + diff --git a/public/sample_excel/.htaccess b/public/sample_excel/.htaccess new file mode 100644 index 0000000..13e218d --- /dev/null +++ b/public/sample_excel/.htaccess @@ -0,0 +1,25 @@ +# =============================== +# ABSOLUTE SCRIPT EXECUTION BLOCK +# =============================== + +# Disable CGI +Options -ExecCGI + +# Disable PHP for mod_php / LiteSpeed + + php_flag engine off + + + + php_flag engine off + + +# Block any script file access + + Require all denied + + +# Block double extensions + + Require all denied + diff --git a/public/sample_import_excel/.htaccess b/public/sample_import_excel/.htaccess new file mode 100644 index 0000000..13e218d --- /dev/null +++ b/public/sample_import_excel/.htaccess @@ -0,0 +1,25 @@ +# =============================== +# ABSOLUTE SCRIPT EXECUTION BLOCK +# =============================== + +# Disable CGI +Options -ExecCGI + +# Disable PHP for mod_php / LiteSpeed + + php_flag engine off + + + + php_flag engine off + + +# Block any script file access + + Require all denied + + +# Block double extensions + + Require all denied + diff --git a/public/writable/.htaccess b/public/writable/.htaccess new file mode 100644 index 0000000..13e218d --- /dev/null +++ b/public/writable/.htaccess @@ -0,0 +1,25 @@ +# =============================== +# ABSOLUTE SCRIPT EXECUTION BLOCK +# =============================== + +# Disable CGI +Options -ExecCGI + +# Disable PHP for mod_php / LiteSpeed + + php_flag engine off + + + + php_flag engine off + + +# Block any script file access + + Require all denied + + +# Block double extensions + + Require all denied +