PMCORE-651 Web entry data is insecure because the Guest user's session overwrites the one of the user currently logged

2021-03-02 13:17:37 -04:00
parent d1f61a99fe
commit 838c2b3a32
6 changed files with 86 additions and 0 deletions
--- a/workflow/engine/methods/login/checkContinueOrCloseSession.php
+++ b/workflow/engine/methods/login/checkContinueOrCloseSession.php
@@ -0,0 +1,11 @@
+<?php
+
+if (!empty($_POST['form'])) {
+    if (!empty($_POST['form']['buttonContinue'])) {
+        $_SESSION['__WEBENTRYCONTINUE__'] = true;
+    }
+    if (!empty($_POST['form']['buttonLogout'])) {
+        $_SESSION = [];
+    }
+    G::header('Location: ' . $_SERVER['HTTP_REFERER']);
+}