From 879a6237b186768356f99caf992f0d25d5ec8612 Mon Sep 17 00:00:00 2001
From: Minteck <contact@minteck.org>
Date: Sun, 5 Dec 2021 16:38:49 +0100
Subject: Commit

---
 private/session.php | 65 ++++++++++++++++++++++++++++-------------------------
 1 file changed, 35 insertions(+), 30 deletions(-)

(limited to 'private/session.php')

diff --git a/private/session.php b/private/session.php
index e0135db..7a37d8a 100644
--- a/private/session.php
+++ b/private/session.php
@@ -1,30 +1,35 @@
-<?php
-
-$_CONFIG = json_decode(file_get_contents($_SERVER["DOCUMENT_ROOT"] . "/private/FamilineConfig.json"), true);
-
-if (isset($_COOKIE['FL_SESSION_TOKEN'])) {
-    if (file_exists($_SERVER['DOCUMENT_ROOT'] . "/private/tokens/" . str_replace(".", "", str_replace("/", "", $_COOKIE['FL_SESSION_TOKEN'])))) {
-        $_PROFILE = json_decode(file_get_contents($_SERVER['DOCUMENT_ROOT'] . "/private/tokens/" . str_replace(".", "", str_replace("/", "", $_COOKIE['FL_SESSION_TOKEN']))), true);
-
-        if (isset($_PROFILE['familine'])) {
-            header("Location: /welcome");
-            die();
-        }
-
-        $_USER = $_PROFILE['login'];
-        $_SUID = $_PROFILE['login'];
-        $_FULLNAME = $_PROFILE['name'];
-    } else {
-        header("Location: /welcome");
-        die();
-    }
-} else {
-    header("Location: /welcome");
-    die();
-}
-
-if (isset($_PROFILE["projectRoles"]) && is_array($_PROFILE["projectRoles"]) && isset($_PROFILE["projectRoles"][0]) && is_array($_PROFILE["projectRoles"][0]) && isset($_PROFILE["projectRoles"][0]["role"]) && is_array($_PROFILE["projectRoles"][0]["role"]) && isset($_PROFILE["projectRoles"][0]["role"]["key"]) && is_string($_PROFILE["projectRoles"][0]["role"]["key"]) && $_PROFILE["projectRoles"][0]["role"]["key"] === "system-admin") {
-    $_ADMIN = true;
-} else {
-    $_ADMIN = false;
-}
+<?php
+
+$_CONFIG = json_decode(file_get_contents($_SERVER["DOCUMENT_ROOT"] . "/private/FamilineConfig.json"), true);
+
+if (isset($_COOKIE['FL_SESSION_TOKEN'])) {
+    if (strpos($_COOKIE['FL_SESSION_TOKEN'], ".") !== false || strpos($_COOKIE['FL_SESSION_TOKEN'], "/") !== false) {
+        header("Location: /welcome");
+        die();
+    }
+
+    if (file_exists($_SERVER['DOCUMENT_ROOT'] . "/private/tokens/" . str_replace(".", "", str_replace("/", "", $_COOKIE['FL_SESSION_TOKEN'])))) {
+        $_PROFILE = json_decode(file_get_contents($_SERVER['DOCUMENT_ROOT'] . "/private/tokens/" . str_replace(".", "", str_replace("/", "", $_COOKIE['FL_SESSION_TOKEN']))), true);
+
+        if (isset($_PROFILE['familine'])) {
+            header("Location: /welcome");
+            die();
+        }
+
+        $_USER = $_PROFILE['login'];
+        $_SUID = $_PROFILE['login'];
+        $_FULLNAME = $_PROFILE['name'];
+    } else {
+        header("Location: /welcome");
+        die();
+    }
+} else {
+    header("Location: /welcome");
+    die();
+}
+
+if (isset($_PROFILE["projectRoles"]) && is_array($_PROFILE["projectRoles"]) && isset($_PROFILE["projectRoles"][0]) && is_array($_PROFILE["projectRoles"][0]) && isset($_PROFILE["projectRoles"][0]["role"]) && is_array($_PROFILE["projectRoles"][0]["role"]) && isset($_PROFILE["projectRoles"][0]["role"]["key"]) && is_string($_PROFILE["projectRoles"][0]["role"]["key"]) && $_PROFILE["projectRoles"][0]["role"]["key"] === "system-admin") {
+    $_ADMIN = true;
+} else {
+    $_ADMIN = false;
+}
-- 
cgit