vignesh/dolibarr
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Support HTTP_EXPOSED_CREDENTIAL_CHECK and use a better log to parse for

Browse source 
security analysis.
This commit is contained in:
ldestailleur 2025-07-09 18:20:48 +02:00
parent daa4968077
commit 0e88c8ffbc
1 changed files with 8 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
htdocs/main.inc.php
View file

@ -597,7 +597,7 @@ if (!defined('NOLOGIN')) {
// Process error of captcha validation
if (!$ok) {
dol_syslog('Bad value for code, connection refused', LOG_NOTICE);
dol_syslog('--- Security warning: Bad value for code, connection refused', LOG_NOTICE);
// Load translation files required by page
$langs->loadLangs(array('main', 'errors'));
@ -667,6 +667,13 @@ if (!defined('NOLOGIN')) {
$langs->setDefaultLang($langcode);
}
// Test HTTP header
if (!empty($_SERVER['HTTP_EXPOSED_CREDENTIAL_CHECK'])) {
// TODO Read option $dolibarr_main_no_leaked_credentials with value 1, 2, ... and return
//dol_syslog("--- Access to ".(empty($_SERVER["REQUEST_METHOD"]) ? '' : $_SERVER["REQUEST_METHOD"].' ').$_SERVER["PHP_SELF"].' refused by option $dolibarr_main_no_leaked_credentials='.$dolibarr_main_no_leaked_credentials, LOG_NOTICE);
dol_syslog('--- Security warning: credentials reported as leaked were used to try to login. HTTP_EXPOSED_CREDENTIAL_CHECK='.((int) $_SERVER['HTTP_EXPOSED_CREDENTIAL_CHECK']), LOG_NOTICE);
}
// Validation of login/pass/entity
// If ok, the variable login will be returned
// If error, we will put error message in session under the name dol_loginmesg