fernando/luos
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

PMCORE-651 Web entry data is insecure because the Guest user's session overwrites the one of the user currently logged

Browse Source
This commit is contained in:
Roly Rudy Gutierrez Pinto
2021-03-10 16:05:52 -04:00
parent e35e457774
commit 1faa4d32bc
2 changed files with 11 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
workflow/engine/methods/login/checkContinueOrCloseSession.php
View File

@@ -3,6 +3,9 @@
if (!empty($_POST['form'])) {
if (!empty($_POST['form']['buttonContinue'])) {
$_SESSION['__WEBENTRYCONTINUE__'] = true;
if (!empty($_SESSION['USER_LOGGED'])) {
$_SESSION['__WEBENTRYCONTINUE_USER_LOGGED__'] = $_SESSION['USER_LOGGED'];
}
}
if (!empty($_POST['form']['buttonLogout'])) {
$_SESSION = [];

7
workflow/engine/methods/services/webentry/anonymousLogin.php
View File

@@ -1,4 +1,5 @@
<?php
/**
* This service is to start PM with the anonymous user.
*/
@@ -19,6 +20,12 @@ try {
}
$userUid = $webEntry->getUsrUid();
if (!empty($_SESSION['__WEBENTRYCONTINUE_USER_LOGGED__'])) {
$userUid = $_SESSION['__WEBENTRYCONTINUE_USER_LOGGED__'];
unset($_SESSION['__WEBENTRYCONTINUE_USER_LOGGED__']);
}
$userInfo = UsersPeer::retrieveByPK($userUid);
if (empty($userInfo)) {
throw new Exception('WebEntry User not found');