FIX_SESSION_REPLAY
This commit is contained in:
velz
parent
2c3707d86f
commit
3ec11b23fa
@ -11,6 +11,8 @@ use CodeIgniter\API\ResponseTrait;
|
||||
use App\Models\UserModel;
|
||||
use App\Models\AuthHistoryModel;
|
||||
|
||||
use App\Libraries\AuthLogout;
|
||||
|
||||
class LoginController extends BaseController
|
||||
{
|
||||
use ResponseTrait;
|
||||
@ -45,7 +47,7 @@ class LoginController extends BaseController
|
||||
|
||||
$user_team = $UserModel->getUserTeamsByUserID($user->id);
|
||||
// dd($user_team);
|
||||
|
||||
session()->regenerate(true);
|
||||
$session_data = [
|
||||
'isLoggedIn' => True ,
|
||||
'userid' => $user->id,
|
||||
@ -56,9 +58,14 @@ class LoginController extends BaseController
|
||||
$path = getenv('cookie.Path');
|
||||
$domain = getenv('cookie.Domain');
|
||||
$https = getenv('ccokie.secure');
|
||||
setcookie('session_data', json_encode($session_data), time() + 12 * 60 * 60, $path, $domain, $https, true);
|
||||
// setcookie('session_data', json_encode($session_data), time() + 12 * 60 * 60, $path, $domain, $https, true);
|
||||
set_session_data($session_data);
|
||||
|
||||
// Bind session to device
|
||||
set_session_data(['fingerprint' => hash('sha256',
|
||||
($this->request->getUserAgent()->getAgentString() . '|' . ($this->request->getIPAddress()
|
||||
)))]);
|
||||
|
||||
log_message('error', 'Set The UserId : `'. $user->id .'` in Session');
|
||||
log_message('error', 'User Login Sucessfully');
|
||||
|
||||
@ -91,14 +98,23 @@ class LoginController extends BaseController
|
||||
|
||||
public function logout()
|
||||
{
|
||||
$path = getenv('cookie.Path');
|
||||
session()->destroy();
|
||||
// setcookie('session_data', '', time() - 3600, $path);
|
||||
$path = getenv('cookie.Path');
|
||||
$domain = getenv('cookie.Domain');
|
||||
$https = getenv('cookie.secure');
|
||||
setcookie('session_data',null, time() -3600, $path, $domain, $https, true);
|
||||
return redirect()->to(base_url('login'));
|
||||
// $path = getenv('cookie.Path');
|
||||
// session()->regenerate(true);
|
||||
// session()->destroy();
|
||||
|
||||
// $path = getenv('cookie.Path');
|
||||
// $domain = getenv('cookie.Domain');
|
||||
// $https = getenv('cookie.secure');
|
||||
|
||||
// setcookie('session_data',null, time() - 42000, $path, $domain, $https, true);
|
||||
// // return redirect()->to(base_url('login'));
|
||||
// return redirect()->to(base_url('login'))
|
||||
// ->setHeader('Cache-Control', 'no-store, no-cache, must-revalidate, max-age=0')
|
||||
// ->setHeader('Pragma', 'no-cache')
|
||||
// ->setHeader('Expires', 'Sat, 26 Jul 1997 05:00:00 GMT');
|
||||
|
||||
|
||||
return AuthLogout::logout();
|
||||
}
|
||||
|
||||
public function getUserDeviceInfo($userId, $type_of_user)
|
||||
|
||||
@ -5,13 +5,30 @@ use CodeIgniter\Filters\FilterInterface;
|
||||
use CodeIgniter\HTTP\RequestInterface;
|
||||
use CodeIgniter\HTTP\ResponseInterface;
|
||||
|
||||
use App\Libraries\AuthLogout;
|
||||
|
||||
class AuthMVC implements FilterInterface
|
||||
{
|
||||
public function before(RequestInterface $request, $arguments = null)
|
||||
{
|
||||
if (!check_session() && !check_cookie()) {
|
||||
|
||||
return redirect()->to(base_url('/login'));
|
||||
|
||||
if (!check_session())
|
||||
{
|
||||
return AuthLogout::logout();
|
||||
}
|
||||
|
||||
// if (!check_cookie())
|
||||
// {
|
||||
// return AuthLogout::logout();
|
||||
// }
|
||||
|
||||
// Fingerprint validation
|
||||
$fp = hash('sha256',
|
||||
$request->getUserAgent()->getAgentString() . '|' . $request->getIPAddress()
|
||||
);
|
||||
|
||||
if (session()->get('fingerprint') !== $fp) {
|
||||
return AuthLogout::logout();
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
@ -143,7 +143,7 @@ class Cors implements FilterInterface
|
||||
|
||||
// If wildcard present in configuration, allow any origin
|
||||
if (in_array('*', $this->allowedOrigins, true)) {
|
||||
$this->log('Origin allowed: wildcard match', ['origin' => $origin]);
|
||||
// $this->log('Origin allowed: wildcard match', ['origin' => $origin]);
|
||||
return true;
|
||||
}
|
||||
|
||||
@ -159,10 +159,10 @@ class Cors implements FilterInterface
|
||||
// 1. Exact match (including scheme and port)
|
||||
// Example: https://example.com matches https://example.com
|
||||
if (strcasecmp($allowed, $origin) === 0) {
|
||||
$this->log('Origin allowed: exact match', [
|
||||
'origin' => $origin,
|
||||
'matched_rule' => $allowed
|
||||
]);
|
||||
// $this->log('Origin allowed: exact match', [
|
||||
// 'origin' => $origin,
|
||||
// 'matched_rule' => $allowed
|
||||
// ]);
|
||||
return true;
|
||||
}
|
||||
|
||||
@ -178,11 +178,11 @@ class Cors implements FilterInterface
|
||||
|
||||
// Check if origin host ends with the allowed root domain
|
||||
if ($originHost === $allowedRoot || str_ends_with($originHost, '.' . $allowedRoot)) {
|
||||
$this->log('Origin allowed: wildcard subdomain match', [
|
||||
'origin' => $origin,
|
||||
'matched_rule' => $allowed,
|
||||
'origin_host' => $originHost
|
||||
]);
|
||||
// $this->log('Origin allowed: wildcard subdomain match', [
|
||||
// 'origin' => $origin,
|
||||
// 'matched_rule' => $allowed,
|
||||
// 'origin_host' => $originHost
|
||||
// ]);
|
||||
return true;
|
||||
}
|
||||
}
|
||||
@ -191,11 +191,11 @@ class Cors implements FilterInterface
|
||||
// Example: example.com matches both http://example.com and https://example.com
|
||||
else {
|
||||
if (strcasecmp($allowed, $originHost) === 0) {
|
||||
$this->log('Origin allowed: host match (scheme-less)', [
|
||||
'origin' => $origin,
|
||||
'matched_rule' => $allowed,
|
||||
'origin_host' => $originHost
|
||||
]);
|
||||
// $this->log('Origin allowed: host match (scheme-less)', [
|
||||
// 'origin' => $origin,
|
||||
// 'matched_rule' => $allowed,
|
||||
// 'origin_host' => $originHost
|
||||
// ]);
|
||||
return true;
|
||||
}
|
||||
}
|
||||
@ -320,11 +320,11 @@ class Cors implements FilterInterface
|
||||
// Preflight is sent by browsers before actual cross-origin requests
|
||||
// to check if the actual request is safe to send
|
||||
if ($method === 'OPTIONS') {
|
||||
$this->log('Preflight request received', [
|
||||
'origin' => $origin,
|
||||
'method' => $method,
|
||||
'uri' => (string) $request->getUri()
|
||||
]);
|
||||
// $this->log('Preflight request received', [
|
||||
// 'origin' => $origin,
|
||||
// 'method' => $method,
|
||||
// 'uri' => (string) $request->getUri()
|
||||
// ]);
|
||||
|
||||
// Validate origin - reject if not allowed
|
||||
if (empty($origin) || !$this->isOriginAllowed($origin)) {
|
||||
@ -346,10 +346,10 @@ class Cors implements FilterInterface
|
||||
$response->setStatusCode(204);
|
||||
$response->setBody('');
|
||||
|
||||
$this->log('Preflight approved', [
|
||||
'origin' => $origin,
|
||||
'allowed_methods' => $this->allowedMethods
|
||||
]);
|
||||
// $this->log('Preflight approved', [
|
||||
// 'origin' => $origin,
|
||||
// 'allowed_methods' => $this->allowedMethods
|
||||
// ]);
|
||||
|
||||
return $response;
|
||||
}
|
||||
@ -392,10 +392,10 @@ class Cors implements FilterInterface
|
||||
// Add CORS headers to the response
|
||||
$this->addCorsHeaders($response, $request, $origin, false);
|
||||
|
||||
$this->log('CORS headers added to response', [
|
||||
'origin' => $origin,
|
||||
'status' => $response->getStatusCode()
|
||||
]);
|
||||
// $this->log('CORS headers added to response', [
|
||||
// 'origin' => $origin,
|
||||
// 'status' => $response->getStatusCode()
|
||||
// ]);
|
||||
}
|
||||
|
||||
/**
|
||||
|
||||
@ -32,6 +32,7 @@ class SecurityInputFilter implements FilterInterface
|
||||
'/<\s*object\b/i',
|
||||
'/<\s*embed\b/i',
|
||||
'/<\s*applet\b/i',
|
||||
'/<\s*img\b/i',
|
||||
|
||||
// Image-based execution
|
||||
'/<\s*img\b[^>]*on\w+/i',
|
||||
|
||||
@ -21,7 +21,7 @@ if(!function_exists('check_cookie')){
|
||||
'userProfile' => $value['userProfile'],
|
||||
'user_team' => $user_team,
|
||||
];
|
||||
set_session_data($session_data);
|
||||
// set_session_data($session_data);
|
||||
// $this->getUserDeviceInfo($user->id, 'NhanceUser');
|
||||
// return redirect()->to(base_url('/dashboard/view'));
|
||||
return true;
|
||||
@ -33,6 +33,7 @@ if(!function_exists('check_cookie')){
|
||||
}else{
|
||||
return false;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
if (!function_exists('check_session')) {
|
||||
@ -40,7 +41,7 @@ if (!function_exists('check_session')) {
|
||||
{
|
||||
// $ci =& get_instance();
|
||||
$session = \Config\Services::session();
|
||||
return $session->get('isLoggedIn');
|
||||
return $session->get('isLoggedIn') === true;
|
||||
}
|
||||
}
|
||||
|
||||
@ -201,7 +202,6 @@ if (!function_exists('get_chatbot_session_info')) {
|
||||
}
|
||||
|
||||
|
||||
}
|
||||
|
||||
|
||||
|
||||
|
||||
42
app/Libraries/AuthLogout.php
Normal file
42
app/Libraries/AuthLogout.php
Normal file
@ -0,0 +1,42 @@
|
||||
<?php
|
||||
|
||||
namespace App\Libraries;
|
||||
|
||||
use CodeIgniter\HTTP\RedirectResponse;
|
||||
|
||||
class AuthLogout
|
||||
{
|
||||
public static function logout(): RedirectResponse
|
||||
{
|
||||
$session = session();
|
||||
|
||||
// Regenerate session ID (kills fixation)
|
||||
$session->regenerate(true);
|
||||
|
||||
// Destroy CI session
|
||||
$session->destroy();
|
||||
|
||||
// Kill PHP session cookie safely
|
||||
if (ini_get('session.use_cookies')) {
|
||||
$params = session_get_cookie_params();
|
||||
|
||||
setcookie(
|
||||
session_name(), // DO NOT hardcode cookie name
|
||||
'',
|
||||
time() - 42000,
|
||||
$params['path'],
|
||||
$params['domain'],
|
||||
$params['secure'],
|
||||
$params['httponly']
|
||||
);
|
||||
}
|
||||
|
||||
session_write_close();
|
||||
|
||||
// Redirect with anti-cache headers
|
||||
return redirect()->to(base_url('login'))
|
||||
->setHeader('Cache-Control', 'no-store, no-cache, must-revalidate, max-age=0')
|
||||
->setHeader('Pragma', 'no-cache')
|
||||
->setHeader('Expires', 'Sat, 26 Jul 1997 05:00:00 GMT');
|
||||
}
|
||||
}
|
||||
@ -6,7 +6,7 @@ Options -Indexes
|
||||
# ----------------------------------------------------------------------
|
||||
|
||||
## ADDED for - block any script execution inside folder of public
|
||||
<If "%{REQUEST_URI} =~ m#/(logo|add_image_upload|e_card_imgs|assets|claim_sample_forms|sample_import_excel|writable)/#">
|
||||
<If "%{REQUEST_URI} =~ m#/(logo|add_image_upload|e_card_imgs|claim_sample_forms|sample_import_excel|writable)/#">
|
||||
Deny from all
|
||||
# Disable PHP engine
|
||||
<IfModule mod_php.c>
|
||||
@ -18,7 +18,7 @@ Options -Indexes
|
||||
AddHandler cgi-script .php .pl .py .jsp .asp .sh .cgi
|
||||
|
||||
# Block access to any script-like files entirely
|
||||
<FilesMatch "\.(php|php5|php7|phtml|pl|py|cgi|asp|aspx|sh|rb)$">
|
||||
<FilesMatch "\.(php|php5|php7|phtml|pl|py|cgi|ap|aspx|sh|rb)$">
|
||||
ForceType text/plain
|
||||
#Order allow,deny
|
||||
Deny from all
|
||||
|
||||
Loading…
Reference in New Issue
Block a user