[TASK] rework user auth

This is a cleaner way to upload files and also prepare for #311.

Signed-off-by: Jerome Jutteau <jerome@jutteau.fr>

diff --git a/admin.php b/admin.php
index d05ce35bc726b6daab7c739af233f0c651b21468..d196f3f1952e28343f60a558f30427e346fcbe32 100644 (file)
--- a/admin.php
+++ b/admin.php
@@ -57,7 +57,7 @@ if (php_sapi_name() == "cli") {
 
     /* Logout if requested. */
     if (jirafeau_admin_session_logged() && isset($_POST['action']) && (strcmp($_POST['action'], 'logout') == 0)) {
 
     /* Logout if requested. */
     if (jirafeau_admin_session_logged() && isset($_POST['action']) && (strcmp($_POST['action'], 'logout') == 0)) {

-        jirafeau_admin_session_end();
+        jirafeau_session_end();

     }
 
     if (!jirafeau_admin_session_logged()) {
     }
 
     if (!jirafeau_admin_session_logged()) {

diff --git a/index.php b/index.php
index 33bb83ea6d34fbfd0e3284bf1712796a605bfdd9..f7aeb04d6b60c1c3bd48a9ea7b60d777a30b0b42 100644 (file)
--- a/index.php
+++ b/index.php
@@ -32,39 +32,36 @@ if (has_error()) {
     require(JIRAFEAU_ROOT . 'lib/template/footer.php');
     exit;
 }
     require(JIRAFEAU_ROOT . 'lib/template/footer.php');
     exit;
 }

-

 require(JIRAFEAU_ROOT . 'lib/template/header.php');
 
 require(JIRAFEAU_ROOT . 'lib/template/header.php');
 

+// Logout action
+if (isset($_POST['action']) && (strcmp($_POST['action'], 'logout') == 0)) {
+    jirafeau_session_end();
+}
+

 /* Check if user is allowed to upload. */
 /* Check if user is allowed to upload. */

-// First check: Challenge by IP NO PASSWORD
-if (true === jirafeau_challenge_upload_ip_without_password($cfg, get_ip_address($cfg))) {
-    $_SESSION['upload_auth'] = true;
-    $_POST['upload_password'] = '';
-    $_SESSION['user_upload_password'] = $_POST['upload_password'];
+// First check: Is user already logged
+if (jirafeau_user_session_logged()) {}
+// Second check: Challenge by IP NO PASSWORD
+elseif (true === jirafeau_challenge_upload_ip_without_password($cfg, get_ip_address($cfg))) {
+    jirafeau_user_session_start();

 }
 }

-// Second check: Challenge by IP
+// Third check: Challenge by IP

 elseif (true === jirafeau_challenge_upload_ip($cfg, get_ip_address($cfg))) {
     // Is an upload password required?
     if (jirafeau_has_upload_password($cfg)) {
 elseif (true === jirafeau_challenge_upload_ip($cfg, get_ip_address($cfg))) {
     // Is an upload password required?
     if (jirafeau_has_upload_password($cfg)) {

-        // Logout action
-        if (isset($_POST['action']) && (strcmp($_POST['action'], 'logout') == 0)) {
-            session_unset();
-        }
-

         // Challenge by password
         // Challenge by password

-        // …save successful logins in session

         if (isset($_POST['upload_password'])) {
             if (jirafeau_challenge_upload_password($cfg, $_POST['upload_password'])) {
         if (isset($_POST['upload_password'])) {
             if (jirafeau_challenge_upload_password($cfg, $_POST['upload_password'])) {

-                $_SESSION['upload_auth'] = true;
-                $_SESSION['user_upload_password'] = $_POST['upload_password'];
+                jirafeau_user_session_start();

             } else {
             } else {

-                $_SESSION['admin_auth'] = false;
+                jirafeau_session_end();

                 jirafeau_fatal_error(t('BAD_PSW'), $cfg);
             }
         }
 
         // Show login form if user session is not authorized yet
                 jirafeau_fatal_error(t('BAD_PSW'), $cfg);
             }
         }
 
         // Show login form if user session is not authorized yet

-        if (true === empty($_SESSION['upload_auth'])) {
+        if (!jirafeau_user_session_logged()) {

             ?>
             <form method="post" class="form login">
             <fieldset>
             ?>
             <form method="post" class="form login">
             <fieldset>


@@ -81,8 +78,7 @@ elseif (true === jirafeau_challenge_upload_ip($cfg, get_ip_address($cfg))) {
                 </tr>
                 <tr class = "nav">
                     <td class = "nav next">
                 </tr>
                 <tr class = "nav">
                     <td class = "nav next">

-                    <input type = "submit" name = "key" value =
-                    "<?php echo t('LOGIN'); ?>" />
+                    <input type = "submit" name = "key" value = "<?php echo t('LOGIN'); ?>" />

                     </td>
                 </tr>
                 </table>
                     </td>
                 </tr>
                 </table>


@@ -255,17 +251,6 @@ elseif (true === jirafeau_challenge_upload_ip($cfg, get_ip_address($cfg))) {
 
         <p id="max_file_size" class="config"></p>
     <p>
 
         <p id="max_file_size" class="config"></p>
     <p>

-    <?php
-    if (jirafeau_has_upload_password($cfg) && $_SESSION['upload_auth']) {
-        ?>
-    <input type="hidden" id="upload_password" name="upload_password" value="<?php echo $_SESSION['user_upload_password'] ?>"/>
-    <?php
-    } else {
-        ?>
-    <input type="hidden" id="upload_password" name="upload_password" value=""/>
-    <?php
-    }
-    ?>

     <input type="submit" id="send" value="<?php echo t('SEND'); ?>"
     onclick="
         document.getElementById('upload').style.display = 'none';
     <input type="submit" id="send" value="<?php echo t('SEND'); ?>"
     onclick="
         document.getElementById('upload').style.display = 'none';


@@ -277,9 +262,8 @@ elseif (true === jirafeau_challenge_upload_ip($cfg, get_ip_address($cfg))) {
     </div> </fieldset>
 
     <?php
     </div> </fieldset>
 
     <?php

-    if (jirafeau_has_upload_password($cfg)
-        && false === jirafeau_challenge_upload_ip_without_password($cfg, get_ip_address($cfg))) {
-        ?>
+    if (jirafeau_user_session_logged()) {
+    ?>

     <form method="post" class="form logout">
         <input type = "hidden" name = "action" value = "logout"/>
         <input type = "submit" value = "<?php echo t('LOGOUT'); ?>" />
     <form method="post" class="form logout">
         <input type = "hidden" name = "action" value = "logout"/>
         <input type = "submit" value = "<?php echo t('LOGOUT'); ?>" />

diff --git a/lib/functions.js.php b/lib/functions.js.php
index e7bc339ce6fa62c3b9ab5e72f76f5c263f5df572..50aa2f07be3d9d76a358eb40a6df3ef396f5abb9 100644 (file)
--- a/lib/functions.js.php
+++ b/lib/functions.js.php
@@ -24,6 +24,7 @@ define('JIRAFEAU_ROOT', dirname(__FILE__) . '/../');
 require(JIRAFEAU_ROOT . 'lib/settings.php');
 require(JIRAFEAU_ROOT . 'lib/functions.php');
 require(JIRAFEAU_ROOT . 'lib/lang.php');
 require(JIRAFEAU_ROOT . 'lib/settings.php');
 require(JIRAFEAU_ROOT . 'lib/functions.php');
 require(JIRAFEAU_ROOT . 'lib/lang.php');

+

 ?>
 // @license magnet:?xt=urn:btih:0b31508aeb0634b347b8270c7bee4d411b5d4109&dn=agpl-3.0.txt AGPL-v3-or-Later
 var web_root = "<?php echo $cfg['web_root']; ?>";
 ?>
 // @license magnet:?xt=urn:btih:0b31508aeb0634b347b8270c7bee4d411b5d4109&dn=agpl-3.0.txt AGPL-v3-or-Later
 var web_root = "<?php echo $cfg['web_root']; ?>";


@@ -344,7 +345,7 @@ function add_time_string_to_date(d, time)
     return false;
 }
 
     return false;
 }
 

-function classic_upload (file, time, password, one_time, upload_password)
+function classic_upload (file, time, password, one_time)

 {
     // Delay time estimation init as we can't have file size
     upload_time_estimation_init(0);
 {
     // Delay time estimation init as we can't have file size
     upload_time_estimation_init(0);


@@ -397,9 +398,6 @@ function classic_upload (file, time, password, one_time, upload_password)
         form.append ("key", password);
     if (one_time)
         form.append ("one_time_download", '1');
         form.append ("key", password);
     if (one_time)
         form.append ("one_time_download", '1');

-    if (upload_password.length > 0)
-        form.append ("upload_password", upload_password);
-

     req.send (form);
 }
 
     req.send (form);
 }
 


@@ -416,7 +414,7 @@ var async_global_time;
 var async_global_transfering = 0;
 var async_global_last_code;
 
 var async_global_transfering = 0;
 var async_global_last_code;
 

-function async_upload_start (max_size, file, time, password, one_time, upload_password)
+function async_upload_start (max_size, file, time, password, one_time)

 {
     async_global_transfered = 0;
     async_global_file = file;
 {
     async_global_transfered = 0;
     async_global_file = file;


@@ -455,8 +453,6 @@ function async_upload_start (max_size, file, time, password, one_time, upload_pa
         form.append ("key", password);
     if (one_time)
         form.append ("one_time_download", '1');
         form.append ("key", password);
     if (one_time)
         form.append ("one_time_download", '1');

-    if (upload_password.length > 0)
-        form.append ("upload_password", upload_password);

 
     // Start time estimation
     upload_time_estimation_init(async_global_file.size);
 
     // Start time estimation
     upload_time_estimation_init(async_global_file.size);


@@ -607,8 +603,7 @@ function upload (max_chunk_size)
             document.getElementById('file_select').files[0],
             document.getElementById('select_time').value,
             document.getElementById('input_key').value,
             document.getElementById('file_select').files[0],
             document.getElementById('select_time').value,
             document.getElementById('input_key').value,

-            one_time,
-            document.getElementById('upload_password').value
+            one_time

             );
     }
     else
             );
     }
     else


@@ -617,8 +612,7 @@ function upload (max_chunk_size)
             document.getElementById('file_select').files[0],
             document.getElementById('select_time').value,
             document.getElementById('input_key').value,
             document.getElementById('file_select').files[0],
             document.getElementById('select_time').value,
             document.getElementById('input_key').value,

-            one_time,
-            document.getElementById('upload_password').value
+            one_time

             );
     }
 }
             );
     }
 }


@@ -807,7 +801,7 @@ function set_light_mode() {
 }
 
 function color_scheme_preferences() {
 }
 
 function color_scheme_preferences() {

-    
+

     let dark_mode_steel_sheet = "<?php echo 'media/' . $cfg['dark_style'] . '/style.css.php'; ?>"
     if (window.matchMedia && window.matchMedia('(prefers-color-scheme: dark)').matches) {
         set_dark_mode();
     let dark_mode_steel_sheet = "<?php echo 'media/' . $cfg['dark_style'] . '/style.css.php'; ?>"
     if (window.matchMedia && window.matchMedia('(prefers-color-scheme: dark)').matches) {
         set_dark_mode();

diff --git a/lib/functions.php b/lib/functions.php
index 1e084fbe33d9064f7153fc366af43a66831910d8..9672fe13deed1fe03f647363dc4decaa51e9043b 100644 (file)
--- a/lib/functions.php
+++ b/lib/functions.php
@@ -1476,7 +1476,7 @@ function jirafeau_admin_session_start()
     $_SESSION['admin_csrf'] = md5(uniqid(mt_rand(), true));
 }
 
     $_SESSION['admin_csrf'] = md5(uniqid(mt_rand(), true));
 }
 

-function jirafeau_admin_session_end()
+function jirafeau_session_end()

 {
     $_SESSION = array();
     session_destroy();
 {
     $_SESSION = array();
     session_destroy();


@@ -1496,6 +1496,17 @@ function jirafeau_admin_csrf_field()
     return "<input type='hidden' name='admin_csrf' value='". $_SESSION['admin_csrf'] . "'/>";
 }
 
     return "<input type='hidden' name='admin_csrf' value='". $_SESSION['admin_csrf'] . "'/>";
 }
 

+function jirafeau_user_session_start()
+{
+    $_SESSION['user_auth'] = true;
+}
+
+function jirafeau_user_session_logged()
+{
+    return isset($_SESSION['user_auth']) &&
+        $_SESSION['user_auth'] === true;
+}
+

 function jirafeau_dir_size($dir)
 {
     $size = 0;
 function jirafeau_dir_size($dir)
 {
     $size = 0;

diff --git a/script.php b/script.php
index 0d4aeab43d59e7ad8cf8f74de6c1fc7e8c9b5942..99ebfebb3f4bbb2ce559265b45546bba0b57fc03 100644 (file)
--- a/script.php
+++ b/script.php
@@ -62,20 +62,22 @@ if (has_error()) {
     exit;
 }
 
     exit;
 }
 

+session_start();
+

 /* Upload file */
 if (isset($_FILES['file']) && is_writable(VAR_FILES)
     && is_writable(VAR_LINKS)) {
 /* Upload file */
 if (isset($_FILES['file']) && is_writable(VAR_FILES)
     && is_writable(VAR_LINKS)) {

-    if (isset($_POST['upload_password'])) {
-        if (!jirafeau_challenge_upload($cfg, get_ip_address($cfg), $_POST['upload_password'])) {
+    if (!jirafeau_user_session_logged()) {
+        if (isset($_POST['upload_password']) &&
+            !jirafeau_challenge_upload($cfg, get_ip_address($cfg), $_POST['upload_password'])) {

             echo 'Error 3: Invalid password';
             exit;
             echo 'Error 3: Invalid password';
             exit;

-        }
-    } else {
-        if (!jirafeau_challenge_upload($cfg, get_ip_address($cfg), null)) {
+        } elseif (!jirafeau_challenge_upload($cfg, get_ip_address($cfg), null)) {

             echo 'Error 2: No password nor allowed IP';
             exit;
         }
     }
             echo 'Error 2: No password nor allowed IP';
             exit;
         }
     }

+

     $key = '';
     if (isset($_POST['key'])) {
         $key = $_POST['key'];
     $key = '';
     if (isset($_POST['key'])) {
         $key = $_POST['key'];


@@ -135,7 +137,7 @@ if (isset($_FILES['file']) && is_writable(VAR_FILES)
     } else {
         $ip = "";
     }
     } else {
         $ip = "";
     }

-    
+

     $res = jirafeau_upload(
         $_FILES['file'],
         isset($_POST['one_time_download']),
     $res = jirafeau_upload(
         $_FILES['file'],
         isset($_POST['one_time_download']),


@@ -405,7 +407,8 @@ fi
 }
 /* Initialize an asynchronous upload. */
 elseif (isset($_GET['init_async'])) {
 }
 /* Initialize an asynchronous upload. */
 elseif (isset($_GET['init_async'])) {

-    if (isset($_POST['upload_password'])) {
+    if (jirafeau_user_session_logged()) {}
+    elseif (isset($_POST['upload_password'])) {

         if (!jirafeau_challenge_upload($cfg, get_ip_address($cfg), $_POST['upload_password'])) {
             echo 'Error 20: Invalid password';
             exit;
         if (!jirafeau_challenge_upload($cfg, get_ip_address($cfg), $_POST['upload_password'])) {
             echo 'Error 20: Invalid password';
             exit;


@@ -479,7 +482,7 @@ elseif (isset($_GET['init_async'])) {
     } else {
         $ip = "";
     }
     } else {
         $ip = "";
     }

-    
+

     echo jirafeau_async_init(
         $_POST['filename'],
         $type,
     echo jirafeau_async_init(
         $_POST['filename'],
         $type,