fernando/luos
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

PMCORE-651 Web entry data is insecure because the Guest user's session overwrites the one of the user currently logged

Browse Source
This commit is contained in:
Roly Rudy Gutierrez Pinto
2021-03-10 14:47:27 -04:00
parent 00c7db1289
commit 789c3c57e0
2 changed files with 11 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
workflow/engine/methods/login/checkContinueOrCloseSession.php
View File

@@ -3,6 +3,9 @@
if (!empty($_POST['form'])) {
if (!empty($_POST['form']['buttonContinue'])) {
$_SESSION['__WEBENTRYCONTINUE__'] = true;
if (!empty($_SESSION['USER_LOGGED'])) {
$_SESSION['__WEBENTRYCONTINUE_USER_LOGGED__'] = $_SESSION['USER_LOGGED'];
}
}
if (!empty($_POST['form']['buttonLogout'])) {
$_SESSION = [];

9
workflow/engine/methods/services/webentry/anonymousLogin.php
View File

@@ -1,4 +1,5 @@
<?php
/**
* This service is to start PM with the anonymous user.
*/
@@ -19,6 +20,12 @@ try {
}
$userUid = $webEntry->getUsrUid();
if (!empty($_SESSION['__WEBENTRYCONTINUE_USER_LOGGED__'])) {
$userUid = $_SESSION['__WEBENTRYCONTINUE_USER_LOGGED__'];
unset($_SESSION['__WEBENTRYCONTINUE_USER_LOGGED__']);
}
$userInfo = UsersPeer::retrieveByPK($userUid);
if (empty($userInfo)) {
throw new Exception('WebEntry User not found');
@@ -33,7 +40,7 @@ try {
'firstName' => $userInfo->getUsrFirstName(),
'lastName' => $userInfo->getUsrLastName(),
'mail' => $userInfo->getUsrEmail(),
'image' => '../users/users_ViewPhoto?t='.microtime(true),
'image' => '../users/users_ViewPhoto?t=' . microtime(true),
];
} catch (Exception $e) {
$result = [