Fix upload IP check

If no IP addresses are listed at 'upload_ip_nopassword', index.php won't
show any login form and indicate the session as authenticated. During
the actual upload, script.php will show the error 'Error 2: No password
nor allowed IP'.

The reason is that jirafeau_challenge_upload_ip returns true if the
supplied IP whitelist is empty, but uploading without a password doesn't
work this way (and shouldn't).

I took the liberty to split 'jirafeau_challenge_upload_ip' into one
function for the normal IP check, and one for checking if allowed to
upload without a password. Having function names that clearly
communicates the intent makes it easier to avoid bugs.

diff --git a/index.php b/index.php
index b03af7698b6b0b16b08c4daa5600cb7cf920fb61..832749bb3303be153066bb2b1797fcc6c7122a63 100644 (file)
--- a/index.php
+++ b/index.php
@@ -36,13 +36,13 @@ require(JIRAFEAU_ROOT . 'lib/template/header.php');
 
 /* Check if user is allowed to upload. */
 // First check: Challenge by IP NO PASSWORD
 
 /* Check if user is allowed to upload. */
 // First check: Challenge by IP NO PASSWORD

-if (true === jirafeau_challenge_upload_ip($cfg['upload_ip_nopassword'], get_ip_address($cfg))) {
+if (true === jirafeau_challenge_upload_ip_without_password($cfg, get_ip_address($cfg))) {

     $_SESSION['upload_auth'] = true;
     $_POST['upload_password'] = '';
     $_SESSION['user_upload_password'] = $_POST['upload_password'];
 }
 // Second check: Challenge by IP
     $_SESSION['upload_auth'] = true;
     $_POST['upload_password'] = '';
     $_SESSION['user_upload_password'] = $_POST['upload_password'];
 }
 // Second check: Challenge by IP

-elseif (true === jirafeau_challenge_upload_ip($cfg['upload_ip'], get_ip_address($cfg))) {
+elseif (true === jirafeau_challenge_upload_ip($cfg, get_ip_address($cfg))) {

     // Is an upload password required?
     if (jirafeau_has_upload_password($cfg)) {
         // Logout action
     // Is an upload password required?
     if (jirafeau_has_upload_password($cfg)) {
         // Logout action


@@ -274,7 +274,7 @@ else {
 
     <?php
     if (jirafeau_has_upload_password($cfg)
 
     <?php
     if (jirafeau_has_upload_password($cfg)

-        && false === jirafeau_challenge_upload_ip($cfg['upload_ip_nopassword'], get_ip_address($cfg))) {
+        && false === jirafeau_challenge_upload_ip_without_password($cfg, get_ip_address($cfg))) {

         ?>
     <form method="post" class="form logout">
         <input type = "hidden" name = "action" value = "logout"/>
         ?>
     <form method="post" class="form logout">
         <input type = "hidden" name = "action" value = "logout"/>

diff --git a/lib/config.original.php b/lib/config.original.php
index 30440a2c6c158b04b1537f98aa5c68e3feb93679..913f3acb0eb385ca753074184abd465840007897 100644 (file)
--- a/lib/config.original.php
+++ b/lib/config.original.php
@@ -85,7 +85,6 @@ $cfg['upload_password'] = array();
 $cfg['upload_ip'] = array();
 
 /* List of IP allowed to upload a file without password.
 $cfg['upload_ip'] = array();
 
 /* List of IP allowed to upload a file without password.

- * If the list is empty, then there is no upload restriction based on IP.

  * Elements of the list can be a single IP (e.g. "123.45.67.89") or
  * an IP range (e.g. "123.45.0.0/16").
  * Note that CIDR notation is available for IPv4 only for the moment.
  * Elements of the list can be a single IP (e.g. "123.45.67.89") or
  * an IP range (e.g. "123.45.0.0/16").
  * Note that CIDR notation is available for IPv4 only for the moment.

diff --git a/lib/functions.php b/lib/functions.php
index c234f4cdedf8f62050895f46e73e34c75f86588a..bff319f75a9fa5a3b8e8b148abc9f7e2684f0caf 100644 (file)
--- a/lib/functions.php
+++ b/lib/functions.php
@@ -1074,19 +1074,14 @@ function jirafeau_challenge_upload_password($cfg, $password)
 }
 
 /**
 }
 
 /**

- * Test if visitor's IP is authorized to upload.
+ * Test if the given IP is whitelisted by the given list.

  *
  * @param $allowedIpList array of allowed IPs
  * @param $challengedIp IP to be challenged
  * @return true if IP is authorized, false otherwise.
  */
  *
  * @param $allowedIpList array of allowed IPs
  * @param $challengedIp IP to be challenged
  * @return true if IP is authorized, false otherwise.
  */

-function jirafeau_challenge_upload_ip($allowedIpList, $challengedIp)
+function jirafeau_challenge_ip($allowedIpList, $challengedIp)

 {
 {

-    // skip if list is empty = all IPs allowed
-    if (count($allowedIpList) == 0) {
-        return true;
-    }
-    // test given IP against each allowed IP

     foreach ($allowedIpList as $i) {
         if ($i == $challengedIp) {
             return true;
     foreach ($allowedIpList as $i) {
         if ($i == $challengedIp) {
             return true;


@@ -1102,6 +1097,42 @@ function jirafeau_challenge_upload_ip($allowedIpList, $challengedIp)
     return false;
 }
 
     return false;
 }
 

+/**
+ * Check if Jirafeau has a restriction on the IP address for uploading.
+ * @return true if uploading is IP restricted, false otherwise.
+ */
+function jirafeau_upload_has_ip_restriction($cfg) {
+    return count($cfg['upload_ip']) > 0;
+}
+
+/**
+ * Test if visitor's IP is authorized to upload at all.
+ *
+ * @param $cfg configuration
+ * @param $challengedIp IP to be challenged
+ * @return true if IP is authorized, false otherwise.
+ */
+function jirafeau_challenge_upload_ip($cfg, $challengedIp)
+{
+    // If no IP address have been listed, allow upload from any IP
+    if (!jirafeau_upload_has_ip_restriction($cfg)) {
+        return true;
+    }
+    return jirafeau_challenge_ip($cfg['upload_ip'], $challengedIp);
+}
+
+/**
+ * Test if visitor's IP is authorized to upload without a password.
+ *
+ * @param $cfg configuration
+ * @param $challengedIp IP to be challenged
+ * @return true if IP is authorized, false otherwise.
+ */
+function jirafeau_challenge_upload_ip_without_password($cfg, $challengedIp)
+{
+    return jirafeau_challenge_ip($cfg['upload_ip_nopassword'], $challengedIp);
+}
+

 /**
  * Test if visitor's IP is authorized or password is supplied and authorized
  * @param $ip IP to be challenged
 /**
  * Test if visitor's IP is authorized or password is supplied and authorized
  * @param $ip IP to be challenged