The Elearning Community

Code: Select all

	

	public static function generateSignature($addendum = false) {

		if($addendum == false) $addendum = time();
		if(!isset($_SESSION['mdsign'])) {
			$_SESSION['mdsign'] = md5(uniqid(rand(), true) ."|". mt_rand() ."|". $addendum);
			$_SESSION['mdsign_timestamp'] = time();
		}
	}

	/**
	 * Get the signature saved in session or generate a new signature if needed
	 * @return string
	 */
	public static function getSignature($for_link = false) {

		if(!isset($_SESSION['mdsign'])) Util::generateSignature();
		if($for_link) return 'authentic_request='.$_SESSION['mdsign'];
		return $_SESSION['mdsign'];
	}

	/**
	 * Check if the signature attached to the page request is valid, user in order to detect foreigns requests
	 */
	public static function checkSignature() {

		//signature from a post or get
		$authentic_request = Get::req('authentic_request', DOTY_STRING, '');
		// signature from a ajax request
		if(!$authentic_request && isset($_SERVER['HTTP_X_SIGNATURE'])) $authentic_request = $_SERVER['HTTP_X_SIGNATURE'];

		if(!isset($_SESSION['mdsign'])
			|| $authentic_request != $_SESSION['mdsign']
		) {
			// Invalid request
			if (!defined('IS_AJAX')) {
				Util::jump_to(Get::rel_path('lms').'/index.php?modname=login&op=logout&msg=101');
			}
			Util::fatal('Security issue, the request seem invalid ! Try a new login and retry.');
		}
	}

Code: Select all

<?php
session_start();
$_SESSION['mdsign'] = md5(uniqid(rand(), true) ."|". mt_rand() ."|". time());
$_SESSION['mdsign_timestamp'] = time();
?>
<form id="login_confirm" method="post" action="http://e.frareg.com/doceboLms/index.php?modname=login&op=confirm">
<input type="hidden" id="authentic_request_login_confirm" name="authentic_request" value="<?php echo $_SESSION['mdsign'];?>" />

<label for="login_userid">Username</label>
<input type="text" id="login_userid" name="login_userid" value="" maxlength="255" tabindex="1" />
<label for="login_pwd">Password</label>
<input type="password" id="login_pwd" name="login_pwd" maxlength="255" tabindex="2" autocomplete="off" />
<input type="submit" id="login" name="log_button" value="Login" tabindex="3" />
</form>

Code: Select all

public static function checkSignature() {
/*
		//signature from a post or get
		$authentic_request = Get::req('authentic_request', DOTY_STRING, '');
		// signature from a ajax request
		if(!$authentic_request && isset($_SERVER['HTTP_X_SIGNATURE'])) $authentic_request = $_SERVER['HTTP_X_SIGNATURE'];
//die(var_dump($_SESSION['mdsign']));
		if(!isset($_SESSION['mdsign'])
			|| $authentic_request != $_SESSION['mdsign']
		) {
			// Invalid request
			if (!defined('IS_AJAX')) {
				Util::jump_to(Get::rel_path('lms').'/index.php?modname=login&op=logout&msg=101');
			}
			Util::fatal('Security issue, the request seem invalid ! Try a new login and retry.');
		}*/
	}

Code: Select all

	public static function checkSignature() {

		//signature from a post or get
		$authentic_request = Get::req('authentic_request', DOTY_STRING, '');
		// signature from a ajax request
		if(!$authentic_request && isset($_SERVER['HTTP_X_SIGNATURE'])) $authentic_request = $_SERVER['HTTP_X_SIGNATURE'];

	/*	if(!isset($_SESSION['mdsign'])
			|| $authentic_request != $_SESSION['mdsign']
		) {
			// Invalid request
			if (!defined('IS_AJAX')) {
				Util::jump_to(Get::rel_path('lms').'/index.php?modname=login&op=logout&msg=101');
			}
			Util::fatal('Security issue, the request seem invalid ! Try a new login and retry.');
		}*/
	}

Code: Select all

/*	if(!isset($_SESSION['mdsign'])
			|| $authentic_request != $_SESSION['mdsign']
		) {
			// Invalid request
			if (!defined('IS_AJAX')) {
				Util::jump_to(Get::rel_path('lms').'/index.php?modname=login&op=logout&msg=101');
			}
			Util::fatal('Security issue, the request seem invalid ! Try a new login and retry.');
		}*/