From b45a1c21ee8f4fa05edcebfa5835f95c6ddd5b02 Mon Sep 17 00:00:00 2001 From: ldestailleur Date: Tue, 11 Mar 2025 10:21:45 +0100 Subject: [PATCH] NEW introduce method dolSetCookie --- htdocs/core/lib/functions.lib.php | 34 +++++++++++++++++++ htdocs/core/lib/security2.lib.php | 17 +--------- .../core/modules/openid_connect/callback.php | 20 +++++++---- htdocs/core/tpl/login.tpl.php | 4 ++- htdocs/main.inc.php | 20 ++--------- .../public/webportal/webportal.main.inc.php | 2 +- htdocs/takepos/index.php | 2 +- 7 files changed, 55 insertions(+), 44 deletions(-) diff --git a/htdocs/core/lib/functions.lib.php b/htdocs/core/lib/functions.lib.php index ee955bc3ed5..31be8e4360b 100644 --- a/htdocs/core/lib/functions.lib.php +++ b/htdocs/core/lib/functions.lib.php @@ -1370,6 +1370,40 @@ function sanitizeVal($out = '', $check = 'alphanohtml', $filter = null, $options return $out; } +/** + * Set a cookie + * + * @param string $cookiename Cookie name + * @param string $cookievalue Cookie value + * @param int $expire Expire delay. If 0, expire at end of session. -1 means 1 year. + * @return void + */ +function dolSetCookie(string $cookiename, string $cookievalue, int $expire = -1) +{ + global $dolibarr_main_force_https; + + if ($expire == -1) { + $expire = (time() + (86400 * 354)); // keep cookie 1 year. + } + + if (PHP_VERSION_ID < 70300) { + setcookie($cookiename, empty($cookievalue) ? '' : $cookievalue, empty($cookievalue) ? 0 : $expire, '/', '', !(empty($dolibarr_main_force_https) && isHTTPS() === false), true); // add tag httponly + } else { + // Only available for php >= 7.3 + $cookieparams = array( + 'expires' => empty($cookievalue) ? 0 : $expire, + 'path' => '/', + //'domain' => '.mywebsite.com', // the dot at the beginning allows compatibility with subdomains + 'secure' => !(empty($dolibarr_main_force_https) && isHTTPS() === false), + 'httponly' => true, + 'samesite' => 'Lax' // None || Lax || Strict + ); + setcookie($cookiename, empty($cookievalue) ? '' : $cookievalue, $cookieparams); + } + if (empty($cookievalue)) { + unset($_COOKIE[$cookiename]); + } +} if (!function_exists('dol_getprefix')) { /** diff --git a/htdocs/core/lib/security2.lib.php b/htdocs/core/lib/security2.lib.php index 27c42b94192..3ac12c9f211 100644 --- a/htdocs/core/lib/security2.lib.php +++ b/htdocs/core/lib/security2.lib.php @@ -197,22 +197,7 @@ if (!function_exists('dol_loginfunction')) { if (getDolGlobalString('MAIN_SESSION_TIMEOUT')) { if (session_status() != PHP_SESSION_ACTIVE) { - if (PHP_VERSION_ID < 70300) { - session_set_cookie_params(0, '/', null, !(empty($dolibarr_main_force_https) && isHTTPS() === false), true); // Add tag secure and httponly on session cookie (same as setting session.cookie_httponly into php.ini). Must be called before the session_start. - } else { - // Only available for php >= 7.3 - $sessioncookieparams = array( - 'lifetime' => 0, - 'path' => '/', - //'domain' => '.mywebsite.com', // the dot at the beginning allows compatibility with subdomains - 'secure' => !(empty($dolibarr_main_force_https) && isHTTPS() === false), - 'httponly' => true, - 'samesite' => 'Lax' // None || Lax || Strict - ); - session_set_cookie_params($sessioncookieparams); - } - - setcookie($sessiontimeout, getDolGlobalString('MAIN_SESSION_TIMEOUT'), 0, "/", '', !empty($dolibarr_main_force_https), true); + dolSetCookie($sessiontimeout, getDolGlobalString('MAIN_SESSION_TIMEOUT'), 0); } } diff --git a/htdocs/core/modules/openid_connect/callback.php b/htdocs/core/modules/openid_connect/callback.php index c55a4772053..065e6801588 100644 --- a/htdocs/core/modules/openid_connect/callback.php +++ b/htdocs/core/modules/openid_connect/callback.php @@ -1,4 +1,4 @@ -top_htmlhead * * This program is free software; you can redistribute it and/or modify @@ -30,9 +30,12 @@ if (!defined('NOTOKENRENEWAL')) { require '../../../main.inc.php'; require_once DOL_DOCUMENT_ROOT.'/core/lib/functions.lib.php'; + /** * @var string $dolibarr_main_url_root + * @var string $dolibarr_main_force_https */ + // Javascript code on logon page only to detect user tz, dst_observed, dst_first, dst_second $arrayofjs = array( '/includes/jstz/jstz.min.js'.(empty($conf->dol_use_jmobile) ? '' : '?version='.urlencode(DOL_VERSION)), @@ -42,16 +45,19 @@ $arrayofjs = array( top_htmlhead('', '', 0, 0, $arrayofjs); $prefix = dol_getprefix(''); -$rollback_url = $_COOKIE["DOL_rollback_url_$prefix"]; -if (empty($rollback_url) || $rollback_url === '/') { - $action = $dolibarr_main_url_root . '/index.php?mainmenu=home&leftmenu='; +$callbackUrl = $_COOKIE["DOL_rollback_url_".$prefix]; // Was set by login page to $_SERVER['REQUEST_URI'] to allow come back to initial requested page +if (empty($callbackUrl) || !preg_match('/^\//', $callbackUrl)) { + // We accept only value that is an internal relative URL. URL starting with http are not allowed. + $callbackUrl = '/'; +} +if ($callbackUrl === '/') { + $callbackUrl = $dolibarr_main_url_root . '/index.php?mainmenu=home&leftmenu='; } else { - $action = $rollback_url; - setcookie('DOL_rollback_url_' . dol_getprefix(''), "", time() + 1, '/'); + dolSetCookie('DOL_rollback_url_'.dol_getprefix(''), "", time() + 1); } ?> -
+ diff --git a/htdocs/core/tpl/login.tpl.php b/htdocs/core/tpl/login.tpl.php index ef2f44d0630..604c4551d74 100644 --- a/htdocs/core/tpl/login.tpl.php +++ b/htdocs/core/tpl/login.tpl.php @@ -32,6 +32,8 @@ if (!defined('NOBROWSERNOTIF')) { * @var Translate $langs * @var User $user * + * @var string $dolibarr_main_force_https + * * @var string $captcha * * @var int<0,1> $dol_hide_leftmenu @@ -166,7 +168,7 @@ if (getDolGlobalInt('MAIN_MODULE_OPENIDCONNECT', 0) > 0 && isset($conf->file->ma // Set a cookie to transfer rollback page information $prefix = dol_getprefix(''); if (empty($_COOKIE["DOL_rollback_url_$prefix"])) { - setcookie('DOL_rollback_url_' . $prefix, $_SERVER['REQUEST_URI'], time() + 3600, '/'); + dolSetCookie('DOL_rollback_url_'.$prefix, $_SERVER['REQUEST_URI'], time() + 3600); // $_SERVER["REQUEST_URI"] is for example /mydolibarr/mypage.php } // Auto redirect if OpenID Connect is the only authentication diff --git a/htdocs/main.inc.php b/htdocs/main.inc.php index 5c8e3bb9782..1cdc7f115cb 100644 --- a/htdocs/main.inc.php +++ b/htdocs/main.inc.php @@ -384,24 +384,8 @@ if (GETPOST("DOL_AUTOSET_COOKIE")) { } $cookiename = $tmpautoset[0]; $cookievalue = json_encode($cookiearrayvalue); - //var_dump('setcookie cookiename='.$cookiename.' cookievalue='.$cookievalue); - if (PHP_VERSION_ID < 70300) { - setcookie($cookiename, empty($cookievalue) ? '' : $cookievalue, empty($cookievalue) ? 0 : (time() + (86400 * 354)), '/', '', !(empty($dolibarr_main_force_https) && isHTTPS() === false), true); // keep cookie 1 year and add tag httponly - } else { - // Only available for php >= 7.3 - $cookieparams = array( - 'expires' => empty($cookievalue) ? 0 : (time() + (86400 * 354)), - 'path' => '/', - //'domain' => '.mywebsite.com', // the dot at the beginning allows compatibility with subdomains - 'secure' => !(empty($dolibarr_main_force_https) && isHTTPS() === false), - 'httponly' => true, - 'samesite' => 'Lax' // None || Lax || Strict - ); - setcookie($cookiename, empty($cookievalue) ? '' : $cookievalue, $cookieparams); - } - if (empty($cookievalue)) { - unset($_COOKIE[$cookiename]); - } + + dolSetCookie($cookiename, $cookievalue); } // Set the handler of session diff --git a/htdocs/public/webportal/webportal.main.inc.php b/htdocs/public/webportal/webportal.main.inc.php index f09d3e6cb5e..3cdece15444 100644 --- a/htdocs/public/webportal/webportal.main.inc.php +++ b/htdocs/public/webportal/webportal.main.inc.php @@ -183,7 +183,7 @@ if (!defined('WEBPORTAL_NOLOGIN') && !empty($context->controllerInstance->access if (empty($webportal_logged_thirdparty_account_id)) { // Set cookie for timeout management if (getDolGlobalString('MAIN_SESSION_TIMEOUT')) { - setcookie($sessiontimeout, $conf->global->MAIN_SESSION_TIMEOUT, 0, "/", '', !empty($dolibarr_main_force_https), true); + dolSetCookie($sessiontimeout, getDolGlobalString('MAIN_SESSION_TIMEOUT'), 0); } $context->controller = 'login'; diff --git a/htdocs/takepos/index.php b/htdocs/takepos/index.php index 659a22d10a8..9eccbcb30e1 100644 --- a/htdocs/takepos/index.php +++ b/htdocs/takepos/index.php @@ -77,7 +77,7 @@ if (empty($_SESSION["takeposterminal"])) { if ($setterminal > 0) { $_SESSION["takeposterminal"] = $setterminal; - setcookie("takeposterminal", (string) $setterminal, (time() + (86400 * 354)), '/', '', !empty($dolibarr_main_force_https), true); // Permanent takeposterminal var in a cookie + dolSetCookie("takeposterminal", (string) $setterminal, -1); // takeposterminal var in a 1 year cookie } if ($setcurrency != "") {