FIX_SESSION_FP&HTACCESS

.htaccess

@@ -5,28 +5,6 @@ Options -Indexes
 # Rewrite engine
 # ----------------------------------------------------------------------
 
-
-## ADDED for  - block any script execution inside folder of public 
-<If "%{REQUEST_URI} =~ m#/(logo|add_image_upload|e_card_imgs|claim_sample_forms|sample_import_excel|writable)/#">
-     Deny from all
-    # Disable PHP engine
-    <IfModule mod_php.c>
-        php_flag engine off
-    </IfModule>
-
-    # Disable CGI and other executable handlers
-    Options -ExecCGI
-    AddHandler cgi-script .php .pl .py .jsp .asp .sh .cgi
-
-    # Block access to any script-like files entirely
-    <FilesMatch "\.(php|php5|php7|phtml|pl|py|cgi|asp|aspx|sh|rb)$">
-        ForceType text/plain
-        #Order allow,deny
-        Deny from all
-    </FilesMatch>
-</If>
-
-
 # Turning on the rewrite engine is necessary for the following rules and features.
 # FollowSymLinks must be enabled for this to work.
 <IfModule mod_rewrite.c>

app/Controllers/LoginController.php

@@ -61,9 +61,7 @@ class LoginController extends BaseController
                         set_session_data($session_data);
 
                          // Bind session to device
-                        set_session_data(['fingerprint' =>  hash('sha256',
+                        set_session_data(['fingerprint' => generateFingerprint()]);
-                            ($this->request->getUserAgent()->getAgentString() . '|' . ($this->request->getIPAddress()
-                        )))]);
                         log_message('error', 'Set The UserId : `'. $user->id .'` in Session');
                         log_message('error', 'User Login Sucessfully');
 

app/Filters/AuthMVC.php

@@ -22,9 +22,7 @@ class AuthMVC implements FilterInterface
         // }
 
         // Fingerprint validation
-        $fp = hash('sha256', 
+        $fp = generateFingerprint();
-            $request->getUserAgent()->getAgentString() . '|' . $request->getIPAddress()
-        );
 
         if (session()->get('fingerprint') !== $fp) {
             return AuthLogout::logout();

app/Helpers/utility_helper.php

@@ -756,3 +756,34 @@ if (!function_exists('validateExcelFile')) {
         return true;
     }
 }
+function getRealClientIP()
+{
+    $request = service('request');
+
+    if (!empty($_SERVER['HTTP_CF_CONNECTING_IP'])) {
+        return $_SERVER['HTTP_CF_CONNECTING_IP'];
+    }
+
+    if (!empty($_SERVER['HTTP_X_FORWARDED_FOR'])) {
+        return explode(',', $_SERVER['HTTP_X_FORWARDED_FOR'])[0];
+    }
+
+    return $request->getIPAddress();
+}
+
+function generateFingerprint()
+{
+    $request = service('request');
+
+    $ua = $request->getUserAgent()->getAgentString();
+    $ip = getRealClientIP();
+    // echo $ip;die();
+    // Use only subnet (first 3 blocks) to tolerate IP change
+    $ipParts = explode('.', $ip);
+    $ipSubnet = $ipParts[0] . '.' . $ipParts[1] . '.' . $ipParts[2];
+
+    // $secret = env('app.sessionFingerprintSalt');
+
+    // return hash('sha256', $ua . '|' . $ipSubnet . '|' . $secret);
+    return hash('sha256', $ua . '|' . $ipSubnet );
+}

public/assets/.htaccess

@@ -0,0 +1,25 @@
+# ===============================
+# ABSOLUTE SCRIPT EXECUTION BLOCK
+# ===============================
+
+# Disable CGI
+Options -ExecCGI
+
+# Disable PHP for mod_php / LiteSpeed
+<IfModule mod_php.c>
+    php_flag engine off
+</IfModule>
+
+<IfModule lsapi_module>
+    php_flag engine off
+</IfModule>
+
+# Block any script file access
+<FilesMatch "\.(php|php5|php7|php8|phtml|phar|pl|py|cgi|asp|aspx|jsp|sh|rb)$">
+    Require all denied
+</FilesMatch>
+
+# Block double extensions
+<FilesMatch "\.(php|php5|php7|php8|phtml|phar)\.">
+    Require all denied
+</FilesMatch>

public/e_card_imgs/.htaccess

@@ -0,0 +1,25 @@
+# ===============================
+# ABSOLUTE SCRIPT EXECUTION BLOCK
+# ===============================
+
+# Disable CGI
+Options -ExecCGI
+
+# Disable PHP for mod_php / LiteSpeed
+<IfModule mod_php.c>
+    php_flag engine off
+</IfModule>
+
+<IfModule lsapi_module>
+    php_flag engine off
+</IfModule>
+
+# Block any script file access
+<FilesMatch "\.(php|php5|php7|php8|phtml|phar|pl|py|cgi|asp|aspx|jsp|sh|rb)$">
+    Require all denied
+</FilesMatch>
+
+# Block double extensions
+<FilesMatch "\.(php|php5|php7|php8|phtml|phar)\.">
+    Require all denied
+</FilesMatch>

public/sample_excel/.htaccess

@@ -0,0 +1,25 @@
+# ===============================
+# ABSOLUTE SCRIPT EXECUTION BLOCK
+# ===============================
+
+# Disable CGI
+Options -ExecCGI
+
+# Disable PHP for mod_php / LiteSpeed
+<IfModule mod_php.c>
+    php_flag engine off
+</IfModule>
+
+<IfModule lsapi_module>
+    php_flag engine off
+</IfModule>
+
+# Block any script file access
+<FilesMatch "\.(php|php5|php7|php8|phtml|phar|pl|py|cgi|asp|aspx|jsp|sh|rb)$">
+    Require all denied
+</FilesMatch>
+
+# Block double extensions
+<FilesMatch "\.(php|php5|php7|php8|phtml|phar)\.">
+    Require all denied
+</FilesMatch>

public/sample_import_excel/.htaccess

@@ -0,0 +1,25 @@
+# ===============================
+# ABSOLUTE SCRIPT EXECUTION BLOCK
+# ===============================
+
+# Disable CGI
+Options -ExecCGI
+
+# Disable PHP for mod_php / LiteSpeed
+<IfModule mod_php.c>
+    php_flag engine off
+</IfModule>
+
+<IfModule lsapi_module>
+    php_flag engine off
+</IfModule>
+
+# Block any script file access
+<FilesMatch "\.(php|php5|php7|php8|phtml|phar|pl|py|cgi|asp|aspx|jsp|sh|rb)$">
+    Require all denied
+</FilesMatch>
+
+# Block double extensions
+<FilesMatch "\.(php|php5|php7|php8|phtml|phar)\.">
+    Require all denied
+</FilesMatch>

public/writable/.htaccess

@@ -0,0 +1,25 @@
+# ===============================
+# ABSOLUTE SCRIPT EXECUTION BLOCK
+# ===============================
+
+# Disable CGI
+Options -ExecCGI
+
+# Disable PHP for mod_php / LiteSpeed
+<IfModule mod_php.c>
+    php_flag engine off
+</IfModule>
+
+<IfModule lsapi_module>
+    php_flag engine off
+</IfModule>
+
+# Block any script file access
+<FilesMatch "\.(php|php5|php7|php8|phtml|phar|pl|py|cgi|asp|aspx|jsp|sh|rb)$">
+    Require all denied
+</FilesMatch>
+
+# Block double extensions
+<FilesMatch "\.(php|php5|php7|php8|phtml|phar)\.">
+    Require all denied
+</FilesMatch>