fernando/luos
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

PMCORE-651 Web entry data is insecure because the Guest user's session overwrites the one of the user currently logged

Browse Source
This commit is contained in:
Roly Rudy Gutierrez Pinto
2021-03-10 16:05:52 -04:00
parent e35e457774
commit 1faa4d32bc
2 changed files with 11 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
workflow/engine/methods/login/checkContinueOrCloseSession.php
View File

@@ -3,6 +3,9 @@
if (!empty($_POST['form'])) { if (!empty($_POST['form'])) {
if (!empty($_POST['form']['buttonContinue'])) { if (!empty($_POST['form']['buttonContinue'])) {
$_SESSION['__WEBENTRYCONTINUE__'] = true; $_SESSION['__WEBENTRYCONTINUE__'] = true;
if (!empty($_SESSION['USER_LOGGED'])) {
$_SESSION['__WEBENTRYCONTINUE_USER_LOGGED__'] = $_SESSION['USER_LOGGED'];
}
} }
if (!empty($_POST['form']['buttonLogout'])) { if (!empty($_POST['form']['buttonLogout'])) {
$_SESSION = []; $_SESSION = [];

9
workflow/engine/methods/services/webentry/anonymousLogin.php
View File

@@ -1,4 +1,5 @@
<?php <?php
/** /**
* This service is to start PM with the anonymous user. * This service is to start PM with the anonymous user.
*/ */
@@ -19,6 +20,12 @@ try {
} }
$userUid = $webEntry->getUsrUid(); $userUid = $webEntry->getUsrUid();
if (!empty($_SESSION['__WEBENTRYCONTINUE_USER_LOGGED__'])) {
$userUid = $_SESSION['__WEBENTRYCONTINUE_USER_LOGGED__'];
unset($_SESSION['__WEBENTRYCONTINUE_USER_LOGGED__']);
}
$userInfo = UsersPeer::retrieveByPK($userUid); $userInfo = UsersPeer::retrieveByPK($userUid);
if (empty($userInfo)) { if (empty($userInfo)) {
throw new Exception('WebEntry User not found'); throw new Exception('WebEntry User not found');
@@ -33,7 +40,7 @@ try {
'firstName' => $userInfo->getUsrFirstName(), 'firstName' => $userInfo->getUsrFirstName(),
'lastName' => $userInfo->getUsrLastName(), 'lastName' => $userInfo->getUsrLastName(),
'mail' => $userInfo->getUsrEmail(), 'mail' => $userInfo->getUsrEmail(),
'image' => '../users/users_ViewPhoto?t='.microtime(true), 'image' => '../users/users_ViewPhoto?t=' . microtime(true),
]; ];
} catch (Exception $e) { } catch (Exception $e) {
$result = [ $result = [