X-Git-Url: https://git.immae.eu/?a=blobdiff_plain;f=index.php;h=9cbc92416232147fed94f2a10e60cbf707d90b5c;hb=db45a36a53dbd722e5e891827e49d9e7651f2a5e;hp=dbc2bb3b2f37336f06de4c9d1287c15bd059dad0;hpb=9b2bd66fb60ffd5a833480bf329062c7d57bc8c4;p=github%2Fshaarli%2FShaarli.git

diff --git a/index.php b/index.php
index dbc2bb3b..9cbc9241 100644
--- a/index.php
+++ b/index.php
@@ -101,8 +101,6 @@ if (dirname($_SERVER['SCRIPT_NAME']) != '/') {
 // Set default cookie expiration and path.
 session_set_cookie_params($cookie['lifetime'], $cookiedir, $_SERVER['SERVER_NAME']);
 // Set session parameters on server side.
-// If the user does not access any page within this time, his/her session is considered expired.
-define('INACTIVITY_TIMEOUT', 3600); // in seconds.
 // Use cookies to store session.
 ini_set('session.use_cookies', 1);
 // Force cookies for session (phpsessionID forbidden in URL).
@@ -183,11 +181,12 @@ define('STAY_SIGNED_IN_TOKEN', sha1($conf->get('credentials.hash') . $_SERVER['R
 /**
  * Checking session state (i.e. is the user still logged in)
  *
- * @param ConfigManager $conf The configuration manager.
+ * @param ConfigManager  $conf           Configuration Manager instance.
+ * @param SessionManager $sessionManager SessionManager instance
  *
- * @return bool: true if the user is logged in, false otherwise.
+ * @return bool true if the user is logged in, false otherwise.
  */
-function setup_login_state($conf)
+function setup_login_state($conf, $sessionManager)
 {
     if ($conf->get('security.open_shaarli')) {
         return true;
@@ -202,12 +201,12 @@ function setup_login_state($conf)
         $_COOKIE['shaarli_staySignedIn']===STAY_SIGNED_IN_TOKEN &&
         !$loginFailure)
     {
-        fillSessionInfo($conf);
+        fillSessionInfo($conf, $sessionManager);
         $userIsLoggedIn = true;
     }
     // If session does not exist on server side, or IP address has changed, or session has expired, logout.
     if (empty($_SESSION['uid'])
-        || ($conf->get('security.session_protection_disabled') === false && $_SESSION['ip'] != allIPs())
+        || ($conf->get('security.session_protection_disabled') === false && $_SESSION['ip'] != client_ip_id($_SERVER))
         || time() >= $_SESSION['expires_on'])
     {
         logout();
@@ -216,9 +215,8 @@ function setup_login_state($conf)
     }
     if (!empty($_SESSION['longlastingsession'])) {
         $_SESSION['expires_on']=time()+$_SESSION['longlastingsession']; // In case of "Stay signed in" checked.
-    }
-    else {
-        $_SESSION['expires_on']=time()+INACTIVITY_TIMEOUT; // Standard session expiration date.
+    } else {
+        $_SESSION['expires_on'] = time() + $sessionManager::$INACTIVITY_TIMEOUT;
     }
     if (!$loginFailure) {
         $userIsLoggedIn = true;
@@ -226,49 +224,42 @@ function setup_login_state($conf)
 
     return $userIsLoggedIn;
 }
-$userIsLoggedIn = setup_login_state($conf);
+
+$userIsLoggedIn = setup_login_state($conf, $sessionManager);
 
 // ------------------------------------------------------------------------------------------
 // Session management
 
-// Returns the IP address of the client (Used to prevent session cookie hijacking.)
-function allIPs()
-{
-    $ip = $_SERVER['REMOTE_ADDR'];
-    // Then we use more HTTP headers to prevent session hijacking from users behind the same proxy.
-    if (isset($_SERVER['HTTP_X_FORWARDED_FOR'])) { $ip=$ip.'_'.$_SERVER['HTTP_X_FORWARDED_FOR']; }
-    if (isset($_SERVER['HTTP_CLIENT_IP'])) { $ip=$ip.'_'.$_SERVER['HTTP_CLIENT_IP']; }
-    return $ip;
-}
-
 /**
- * Load user session.
+ * Load user session
  *
- * @param ConfigManager $conf Configuration Manager instance.
+ * @param ConfigManager  $conf           Configuration Manager instance.
+ * @param SessionManager $sessionManager SessionManager instance
  */
-function fillSessionInfo($conf)
+function fillSessionInfo($conf, $sessionManager)
 {
     $_SESSION['uid'] = sha1(uniqid('',true).'_'.mt_rand()); // Generate unique random number (different than phpsessionid)
-    $_SESSION['ip']=allIPs();                // We store IP address(es) of the client to make sure session is not hijacked.
+    $_SESSION['ip'] = client_ip_id($_SERVER);
     $_SESSION['username']= $conf->get('credentials.login');
-    $_SESSION['expires_on']=time()+INACTIVITY_TIMEOUT;  // Set session expiration.
+    $_SESSION['expires_on'] = time() + $sessionManager::$INACTIVITY_TIMEOUT;
 }
 
 /**
  * Check that user/password is correct.
  *
- * @param string        $login    Username
- * @param string        $password User password
- * @param ConfigManager $conf     Configuration Manager instance.
+ * @param string         $login          Username
+ * @param string         $password       User password
+ * @param ConfigManager  $conf           Configuration Manager instance.
+ * @param SessionManager $sessionManager SessionManager instance
  *
  * @return bool: authentication successful or not.
  */
-function check_auth($login, $password, $conf)
+function check_auth($login, $password, $conf, $sessionManager)
 {
     $hash = sha1($password . $login . $conf->get('credentials.salt'));
-    if ($login == $conf->get('credentials.login') && $hash == $conf->get('credentials.hash'))
-    {   // Login/password is correct.
-        fillSessionInfo($conf);
+    if ($login == $conf->get('credentials.login') && $hash == $conf->get('credentials.hash')) {
+        // Login/password is correct.
+        fillSessionInfo($conf, $sessionManager);
         logm($conf->get('resource.log'), $_SERVER['REMOTE_ADDR'], 'Login successful');
         return true;
     }
@@ -297,14 +288,13 @@ function logout() {
 
 // ------------------------------------------------------------------------------------------
 // Process login form: Check if login/password is correct.
-if (isset($_POST['login']))
-{
+if (isset($_POST['login'])) {
     if (! $loginManager->canLogin($_SERVER)) {
         die(t('I said: NO. You are banned for the moment. Go away.'));
     }
     if (isset($_POST['password'])
         && $sessionManager->checkToken($_POST['token'])
-        && (check_auth($_POST['login'], $_POST['password'], $conf))
+        && (check_auth($_POST['login'], $_POST['password'], $conf, $sessionManager))
     ) {
         // Login/password is OK.
         $loginManager->handleSuccessfulLogin($_SERVER);
@@ -1376,8 +1366,8 @@ function renderPage($conf, $pluginManager, $LINKSDB, $history, $sessionManager,
                 // The callback will fill $charset and $title with data from the downloaded page.
                 get_http_response(
                     $url,
-                    $conf->get('general.download_max_size', 4194304),
                     $conf->get('general.download_timeout', 30),
+                    $conf->get('general.download_max_size', 4194304),
                     get_curl_download_callback($charset, $title)
                 );
                 if (! empty($title) && strtolower($charset) != 'utf-8') {