vignesh/dolibarr
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

NEW introduce method dolSetCookie

Browse source
This commit is contained in:
ldestailleur 2025-03-11 10:21:45 +01:00
parent 7e40249364
commit b45a1c21ee
7 changed files with 55 additions and 44 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

34
htdocs/core/lib/functions.lib.php
View file

@ -1370,6 +1370,40 @@ function sanitizeVal($out = '', $check = 'alphanohtml', $filter = null, $options
return $out;
}
/**
* Set a cookie
*
* @param string $cookiename Cookie name
* @param string $cookievalue Cookie value
* @param int $expire Expire delay. If 0, expire at end of session. -1 means 1 year.
* @return void
*/
function dolSetCookie(string $cookiename, string $cookievalue, int $expire = -1)
{
global $dolibarr_main_force_https;
if ($expire == -1) {
$expire = (time() + (86400 * 354)); // keep cookie 1 year.
}
if (PHP_VERSION_ID < 70300) {
setcookie($cookiename, empty($cookievalue) ? '' : $cookievalue, empty($cookievalue) ? 0 : $expire, '/', '', !(empty($dolibarr_main_force_https) && isHTTPS() === false), true); // add tag httponly
} else {
// Only available for php >= 7.3
$cookieparams = array(
'expires' => empty($cookievalue) ? 0 : $expire,
'path' => '/',
//'domain' => '.mywebsite.com', // the dot at the beginning allows compatibility with subdomains
'secure' => !(empty($dolibarr_main_force_https) && isHTTPS() === false),
'httponly' => true,
'samesite' => 'Lax' // None || Lax || Strict
);
setcookie($cookiename, empty($cookievalue) ? '' : $cookievalue, $cookieparams);
}
if (empty($cookievalue)) {
unset($_COOKIE[$cookiename]);
}
}
if (!function_exists('dol_getprefix')) {
/**

17
htdocs/core/lib/security2.lib.php
View file

@ -197,22 +197,7 @@ if (!function_exists('dol_loginfunction')) {
if (getDolGlobalString('MAIN_SESSION_TIMEOUT')) {
if (session_status() != PHP_SESSION_ACTIVE) {
if (PHP_VERSION_ID < 70300) {
session_set_cookie_params(0, '/', null, !(empty($dolibarr_main_force_https) && isHTTPS() === false), true); // Add tag secure and httponly on session cookie (same as setting session.cookie_httponly into php.ini). Must be called before the session_start.
} else {
// Only available for php >= 7.3
$sessioncookieparams = array(
'lifetime' => 0,
'path' => '/',
//'domain' => '.mywebsite.com', // the dot at the beginning allows compatibility with subdomains
'secure' => !(empty($dolibarr_main_force_https) && isHTTPS() === false),
'httponly' => true,
'samesite' => 'Lax' // None || Lax || Strict
);
session_set_cookie_params($sessioncookieparams);
}
setcookie($sessiontimeout, getDolGlobalString('MAIN_SESSION_TIMEOUT'), 0, "/", '', !empty($dolibarr_main_force_https), true);
dolSetCookie($sessiontimeout, getDolGlobalString('MAIN_SESSION_TIMEOUT'), 0);
}
}

20
htdocs/core/modules/openid_connect/callback.php
View file

@ -1,4 +1,4 @@
top_htmlhead <?php
<?php
/* Copyright (C) 2023 Maximilien Rozniecki <mrozniecki@easya.solutions>
*
* This program is free software; you can redistribute it and/or modify
@ -30,9 +30,12 @@ if (!defined('NOTOKENRENEWAL')) {
require '../../../main.inc.php';
require_once DOL_DOCUMENT_ROOT.'/core/lib/functions.lib.php';
/**
* @var string $dolibarr_main_url_root
* @var string $dolibarr_main_force_https
*/
// Javascript code on logon page only to detect user tz, dst_observed, dst_first, dst_second
$arrayofjs = array(
'/includes/jstz/jstz.min.js'.(empty($conf->dol_use_jmobile) ? '' : '?version='.urlencode(DOL_VERSION)),
@ -42,16 +45,19 @@ $arrayofjs = array(
top_htmlhead('', '', 0, 0, $arrayofjs);
$prefix = dol_getprefix('');
$rollback_url = $_COOKIE["DOL_rollback_url_$prefix"];
if (empty($rollback_url) || $rollback_url === '/') {
$action = $dolibarr_main_url_root . '/index.php?mainmenu=home&leftmenu=';
$callbackUrl = $_COOKIE["DOL_rollback_url_".$prefix]; // Was set by login page to $_SERVER['REQUEST_URI'] to allow come back to initial requested page
if (empty($callbackUrl) || !preg_match('/^\//', $callbackUrl)) {
// We accept only value that is an internal relative URL. URL starting with http are not allowed.
$callbackUrl = '/';
}
if ($callbackUrl === '/') {
$callbackUrl = $dolibarr_main_url_root . '/index.php?mainmenu=home&leftmenu=';
} else {
$action = $rollback_url;
setcookie('DOL_rollback_url_' . dol_getprefix(''), "", time() + 1, '/');
dolSetCookie('DOL_rollback_url_'.dol_getprefix(''), "", time() + 1);
}
?>
<form id="login" name="login" method="post" action="<?php echo $action; ?>">
<form id="login" name="login" method="post" action="<?php echo $callbackUrl; ?>">
<!-- Add fields to send OpenID information -->
<input type="hidden" name="openid_mode" value="true" />
<input type="hidden" name="state" value="<?php echo GETPOST('state'); ?>" />

4
htdocs/core/tpl/login.tpl.php
View file

@ -32,6 +32,8 @@ if (!defined('NOBROWSERNOTIF')) {
* @var Translate $langs
* @var User $user
*
* @var string $dolibarr_main_force_https
*
* @var string $captcha
*
* @var int<0,1> $dol_hide_leftmenu
@ -166,7 +168,7 @@ if (getDolGlobalInt('MAIN_MODULE_OPENIDCONNECT', 0) > 0 && isset($conf->file->ma
// Set a cookie to transfer rollback page information
$prefix = dol_getprefix('');
if (empty($_COOKIE["DOL_rollback_url_$prefix"])) {
setcookie('DOL_rollback_url_' . $prefix, $_SERVER['REQUEST_URI'], time() + 3600, '/');
dolSetCookie('DOL_rollback_url_'.$prefix, $_SERVER['REQUEST_URI'], time() + 3600); // $_SERVER["REQUEST_URI"] is for example /mydolibarr/mypage.php
}
// Auto redirect if OpenID Connect is the only authentication

20
htdocs/main.inc.php
View file

@ -384,24 +384,8 @@ if (GETPOST("DOL_AUTOSET_COOKIE")) {
}
$cookiename = $tmpautoset[0];
$cookievalue = json_encode($cookiearrayvalue);
//var_dump('setcookie cookiename='.$cookiename.' cookievalue='.$cookievalue);
if (PHP_VERSION_ID < 70300) {
setcookie($cookiename, empty($cookievalue) ? '' : $cookievalue, empty($cookievalue) ? 0 : (time() + (86400 * 354)), '/', '', !(empty($dolibarr_main_force_https) && isHTTPS() === false), true); // keep cookie 1 year and add tag httponly
} else {
// Only available for php >= 7.3
$cookieparams = array(
'expires' => empty($cookievalue) ? 0 : (time() + (86400 * 354)),
'path' => '/',
//'domain' => '.mywebsite.com', // the dot at the beginning allows compatibility with subdomains
'secure' => !(empty($dolibarr_main_force_https) && isHTTPS() === false),
'httponly' => true,
'samesite' => 'Lax' // None || Lax || Strict
);
setcookie($cookiename, empty($cookievalue) ? '' : $cookievalue, $cookieparams);
}
if (empty($cookievalue)) {
unset($_COOKIE[$cookiename]);
}
dolSetCookie($cookiename, $cookievalue);
}
// Set the handler of session

2
htdocs/public/webportal/webportal.main.inc.php
View file

@ -183,7 +183,7 @@ if (!defined('WEBPORTAL_NOLOGIN') && !empty($context->controllerInstance->access
if (empty($webportal_logged_thirdparty_account_id)) {
// Set cookie for timeout management
if (getDolGlobalString('MAIN_SESSION_TIMEOUT')) {
setcookie($sessiontimeout, $conf->global->MAIN_SESSION_TIMEOUT, 0, "/", '', !empty($dolibarr_main_force_https), true);
dolSetCookie($sessiontimeout, getDolGlobalString('MAIN_SESSION_TIMEOUT'), 0);
}
$context->controller = 'login';

2
htdocs/takepos/index.php
View file

@ -77,7 +77,7 @@ if (empty($_SESSION["takeposterminal"])) {
if ($setterminal > 0) {
$_SESSION["takeposterminal"] = $setterminal;
setcookie("takeposterminal", (string) $setterminal, (time() + (86400 * 354)), '/', '', !empty($dolibarr_main_force_https), true); // Permanent takeposterminal var in a cookie
dolSetCookie("takeposterminal", (string) $setterminal, -1); // takeposterminal var in a 1 year cookie
}
if ($setcurrency != "") {