Skip to content
This repository was archived by the owner on Aug 27, 2022. It is now read-only.

Commit 5dfbc21

Browse files
andi34andi34
committed
protection: handle login check earlier to protect other endpoints
1 parent e0ac501 commit 5dfbc21

File tree

4 files changed

+86
-66
lines changed

4 files changed

+86
-66
lines changed

‎admin/diskusage.php‎

Lines changed: 15 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,21 @@
11
<?php
22
session_start();
33

4-
require_once('../lib/config.php');
5-
require_once('../lib/diskusage.php');
4+
require_once '../lib/config.php';
5+
6+
// Login / Authentication check
7+
if (
8+
!$config['login']['enabled'] ||
9+
(!$config['protect']['localhost_admin'] && $_SERVER['REMOTE_ADDR'] === $_SERVER['SERVER_ADDR']) ||
10+
(isset($_SESSION['auth']) && $_SESSION['auth'] === true) ||
11+
!$config['protect']['admin']
12+
) {
13+
require_once '../lib/diskusage.php';
14+
} else {
15+
header('location: ../login');
16+
exit();
17+
}
18+
619
?>
720

821
<!DOCTYPE html>
@@ -38,7 +51,6 @@
3851
<body class="loginbody">
3952
<div class="login-panel">
4053
<h2>Photobooth <span data-i18n="disk_usage"></span></h2>
41-
<?php if( !$config['login']['enabled'] || !$config['protect']['localhost_admin'] && $_SERVER['REMOTE_ADDR'] === $_SERVER['SERVER_ADDR'] || (isset($_SESSION['auth']) && $_SESSION['auth'] === true) || !$config['protect']['admin']): ?>
4254
<a class="btn btn--tiny btn--flex back-to-admin" href="./"><i class="fa fa-arrow-left"></i></a>
4355
<button class="download-zip-btn btn btn--tiny btn--flex">
4456
<span data-i18n="download_zip"></span>
@@ -55,10 +67,6 @@
5567

5668
}
5769
?>
58-
<?php else:
59-
header("location: ../login");
60-
exit;
61-
endif; ?>
6270
</div>
6371

6472
<div id="adminsettings">

‎admin/index.php‎

Lines changed: 14 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,19 @@
11
<?php
22
session_start();
3-
require_once('../lib/config.php');
4-
require_once('../lib/configsetup.inc.php');
3+
require_once '../lib/config.php';
4+
5+
// Login / Authentication check
6+
if (
7+
!$config['login']['enabled'] ||
8+
(!$config['protect']['localhost_admin'] && $_SERVER['REMOTE_ADDR'] === $_SERVER['SERVER_ADDR']) ||
9+
(isset($_SESSION['auth']) && $_SESSION['auth'] === true) ||
10+
!$config['protect']['admin']
11+
) {
12+
require_once '../lib/configsetup.inc.php';
13+
} else {
14+
header('location: ../login');
15+
exit();
16+
}
517
?>
618
<!DOCTYPE html>
719
<html>
@@ -26,10 +38,6 @@
2638
<body>
2739
<!-- NavBar content -->
2840
<?php
29-
// Login / Authentication check
30-
if( !$config['login']['enabled'] || !$config['protect']['localhost_admin'] && $_SERVER['REMOTE_ADDR'] === $_SERVER['SERVER_ADDR'] || (isset($_SESSION['auth']) && $_SESSION['auth'] === true) || !$config['protect']['admin'] )
31-
{
32-
3341
/***********************
3442
** PHP helper functions
3543
***********************/
@@ -258,11 +266,6 @@ function isElementHidden($element_class, $setting)
258266
echo '</div>';
259267
}
260268
}
261-
else
262-
{
263-
header("location: ../login");
264-
exit;
265-
}
266269
?>
267270
</div>
268271
</form>

‎index.php‎

Lines changed: 31 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -1,31 +1,41 @@
11
<?php
22
session_start();
33

4-
require_once('lib/config.php');
5-
require_once('lib/db.php');
6-
require_once('lib/filter.php');
7-
8-
if ($config['database']['enabled']) {
9-
$images = getImagesFromDB();
10-
} else {
11-
$images = getImagesFromDirectory($config['foldersAbs']['images']);
4+
require_once 'lib/config.php';
5+
if ($config['live_keying']['enabled']) {
6+
header('location: livechroma.php');
127
}
138

14-
$imagelist = ($config['gallery']['newest_first'] === true) ? array_reverse($images) : $images;
15-
16-
if ($config['ui']['style'] === 'modern') {
17-
$btnClass1 = 'round-btn';
18-
$btnClass2 = 'round-btn';
19-
$galleryIcon = 'fa-picture-o';
9+
// Login / Authentication check
10+
if (
11+
!$config['login']['enabled'] ||
12+
(!$config['protect']['localhost_index'] && $_SERVER['REMOTE_ADDR'] === $_SERVER['SERVER_ADDR']) ||
13+
((isset($_SESSION['auth']) && $_SESSION['auth'] === true) || !$config['protect']['index'])
14+
) {
15+
require_once 'lib/db.php';
16+
require_once 'lib/filter.php';
17+
18+
if ($config['database']['enabled']) {
19+
$images = getImagesFromDB();
20+
} else {
21+
$images = getImagesFromDirectory($config['foldersAbs']['images']);
22+
}
23+
24+
$imagelist = $config['gallery']['newest_first'] === true ? array_reverse($images) : $images;
25+
26+
if ($config['ui']['style'] === 'modern') {
27+
$btnClass1 = 'round-btn';
28+
$btnClass2 = 'round-btn';
29+
$galleryIcon = 'fa-picture-o';
30+
} else {
31+
$btnClass1 = 'btn';
32+
$btnClass2 = '';
33+
$galleryIcon = 'fa-th';
34+
}
2035
} else {
21-
$btnClass1 = 'btn';
22-
$btnClass2 = '';
23-
$galleryIcon = 'fa-th';
36+
header('location: login');
37+
exit();
2438
}
25-
26-
if ($config['live_keying']['enabled']):
27-
header("location: livechroma.php");
28-
endif;
2939
?>
3040
<!DOCTYPE html>
3141
<html>
@@ -65,8 +75,6 @@
6575
<video id="video--preview" autoplay playsinline></video>
6676
<body class="deselect">
6777
<div id="wrapper">
68-
<?php if( !$config['login']['enabled'] || !$config['protect']['localhost_index'] && $_SERVER['REMOTE_ADDR'] === $_SERVER['SERVER_ADDR'] || (isset($_SESSION['auth']) && $_SESSION['auth'] === true || !$config['protect']['index'])): ?>
69-
7078
<?php include('template/' . $config['ui']['style'] . '.template.php'); ?>
7179

7280
<!-- image Filter Pane -->
@@ -184,10 +192,6 @@
184192
<div style="position:absolute; bottom:0; right:0;">
185193
<img src="resources/img/spacer.png" alt="adminsettings" ondblclick="adminsettings()" />
186194
</div>
187-
<?php else:
188-
header("location: login");
189-
exit;
190-
endif; ?>
191195
</div>
192196

193197
<script src="node_modules/whatwg-fetch/dist/fetch.umd.js"></script>

‎livechroma.php‎

Lines changed: 26 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -1,24 +1,34 @@
11
<?php
22
session_start();
33

4-
require_once('lib/config.php');
5-
require_once('lib/db.php');
6-
7-
if ($config['database']['enabled']) {
8-
$images = getImagesFromDB();
4+
require_once 'lib/config.php';
5+
6+
// Login / Authentication check
7+
if (
8+
!$config['login']['enabled'] ||
9+
(!$config['protect']['localhost_index'] && $_SERVER['REMOTE_ADDR'] === $_SERVER['SERVER_ADDR']) ||
10+
((isset($_SESSION['auth']) && $_SESSION['auth'] === true) || !$config['protect']['index'])
11+
) {
12+
require_once 'lib/db.php';
13+
14+
if ($config['database']['enabled']) {
15+
$images = getImagesFromDB();
16+
} else {
17+
$images = getImagesFromDirectory($config['foldersAbs']['images']);
18+
}
19+
$imagelist = $config['gallery']['newest_first'] === true ? array_reverse($images) : $images;
20+
21+
if ($config['ui']['style'] === 'modern') {
22+
$btnClass1 = 'round-btn';
23+
$btnClass2 = 'round-btn';
24+
} else {
25+
$btnClass1 = 'btn btn--small btn--flex';
26+
$btnClass2 = 'btn';
27+
}
928
} else {
10-
$images = getImagesFromDirectory($config['foldersAbs']['images']);
29+
header('location: login');
30+
exit();
1131
}
12-
$imagelist = ($config['gallery']['newest_first'] === true) ? array_reverse($images) : $images;
13-
14-
if ($config['ui']['style'] === 'modern') {
15-
$btnClass1 = 'round-btn';
16-
$btnClass2 = 'round-btn';
17-
} else {
18-
$btnClass1 = 'btn btn--small btn--flex';
19-
$btnClass2 = 'btn';
20-
}
21-
2232
?>
2333
<!doctype html>
2434
<html>
@@ -53,7 +63,6 @@
5363
</head>
5464
<body>
5565
<div class="chromawrapper">
56-
<?php if( !$config['login']['enabled'] || !$config['protect']['localhost_index'] && $_SERVER['REMOTE_ADDR'] === $_SERVER['SERVER_ADDR'] || (isset($_SESSION['auth']) && $_SESSION['auth'] === true || !$config['protect']['index'])): ?>
5766
<div class="top-bar">
5867
<?php if (!$config['live_keying']['enabled']): ?>
5968
<a href="index.php" class="<?php echo $btnClass1; ?> closebtn"><i class="fa fa-times"></i></a>
@@ -140,10 +149,6 @@
140149

141150
<div class="modal" id="print_mesg">
142151
<div class="modal__body"><span data-i18n="printing"></span></div>
143-
<?php else:
144-
header("location: login");
145-
exit;
146-
endif; ?>
147152
</div>
148153

149154
<script src="node_modules/whatwg-fetch/dist/fetch.umd.js"></script>

0 commit comments

Comments
 (0)
⚡