Skip to content

Commit a9c3233

Browse files
nilsteampassnetnilsteampassnet
committed
3.0.10
Code review on performChecks
1 parent caa1452 commit a9c3233

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

80 files changed

+91
-99
lines changed

‎includes/config/include.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@
1717
*/
1818
define('TP_VERSION', '3.0.10');
1919
define("UPGRADE_MIN_DATE", "1697990713");
20-
define('TP_VERSION_MINOR', '135');
20+
define('TP_VERSION_MINOR', '136');
2121
define('TP_TOOL_NAME', 'Teampass');
2222
define('TP_ONE_DAY_SECONDS', 86400);
2323
define('TP_ONE_WEEK_SECONDS', 604800);

‎includes/libraries/teampassclasses/performchecks/src/PerformChecks.php

+6-7
Original file line numberDiff line numberDiff line change
@@ -69,15 +69,15 @@ public function checkSession(): bool
6969
/**
7070
* Handle the case
7171
*
72-
* @return void
72+
* @return string
7373
*/
74-
public function caseHandler(): void
74+
public function caseHandler(): string
7575
{
7676
switch ($this->postType) {
7777
case 'checkSessionExists':
78-
$this->checkUserSessionExists();
79-
break;
78+
return $this->checkUserSessionExists();
8079
}
80+
return false;
8181
}
8282

8383
/**
@@ -92,10 +92,9 @@ function checkUserSessionExists(): string
9292
session_start();
9393

9494
if (isset($_SESSION['CPM']) === true) {
95-
echo json_encode([
95+
return json_encode([
9696
'status' => true,
9797
]);
98-
exit();
9998
}
10099

101100
// In case that no session is available
@@ -104,7 +103,7 @@ function checkUserSessionExists(): string
104103
$csrfp_array = __DIR__ . '/../includes/libraries/csrfp/libs/csrfp.config.php';
105104

106105
// Send back CSRFP info
107-
echo $csrfp_array['CSRFP_TOKEN'] . ';' . filter_input(INPUT_POST, $csrfp_array['CSRFP_TOKEN'], FILTER_SANITIZE_FULL_SPECIAL_CHARS);
106+
return $csrfp_array['CSRFP_TOKEN'] . ';' . filter_input(INPUT_POST, $csrfp_array['CSRFP_TOKEN'], FILTER_SANITIZE_FULL_SPECIAL_CHARS);
108107
}
109108

110109
/**

‎includes/libraries/teampassclasses/superglobal/src/SuperGlobal.php

-1
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,6 @@ class SuperGlobal
3131
*/
3232
protected function dataSanitizerCall($key)
3333
{
34-
//include_once __DIR__ . '/../../../../sources/main.functions.php';
3534
return dataSanitizer(
3635
['key' => $key],
3736
['key' => 'trim|escape'],

‎index.php

+8-13
Original file line numberDiff line numberDiff line change
@@ -168,7 +168,7 @@
168168

169169
// Load user languages files
170170
if (file_exists($SETTINGS['cpassman_dir'] . '/includes/language/' . $session_user_language . '.php') === true) {
171-
$_SESSION['teampass']['lang'] = include $SETTINGS['cpassman_dir'] . '/includes/language/' . $session_user_language . '.php';
171+
$superGlobal->put('lang', include $SETTINGS['cpassman_dir'] . '/includes/language/' . $session_user_language . '.php', 'SESSION', 'teampass');
172172
} else {
173173
$superGlobal->put('code', ERR_NOT_ALLOWED, 'SESSION', 'error');
174174
//not allowed page
@@ -652,8 +652,7 @@
652652
<a href="<?php echo HELP_URL; ?>" target="_blank" class="text-info"><i class="fa-solid fa-life-ring mr-2 infotip" title="<?php echo langHdl('admin_help'); ?>"></i></a>
653653
<i class="fa-solid fa-bug infotip pointer text-info" title="<?php echo langHdl('bugs_page'); ?>" onclick="generateBugReport()"></i>
654654
</div>
655-
<?php
656-
//print_r($_SESSION);
655+
<?php
657656
?>
658657
</div>
659658
</div>
@@ -982,15 +981,14 @@
982981
} elseif (empty($get['page']) === false) {
983982
include $SETTINGS['cpassman_dir'] . '/pages/' . $get['page'] . '.php';
984983
} else {
985-
$_SESSION['error']['code'] = ERR_NOT_EXIST;
984+
$superGlobal->put('code', ERR_NOT_EXIST, 'SESSION', 'error');
986985
//page doesn't exist
987986
include $SETTINGS['cpassman_dir'].'/error.php';
988987
}
989988

990989
// Case where login attempts have been identified
991-
if (isset($_SESSION['unsuccessfull_login_attempts']) === true
992-
&& $_SESSION['unsuccessfull_login_attempts_nb'] !== 0
993-
&& $_SESSION['unsuccessfull_login_attempts_shown'] === false
990+
if ((int) $superGlobal->get('unsuccessfull_login_attempts', 'SESSION') !== 0
991+
&& (bool) $superGlobal->get('unsuccessfull_login_attempts_shown', 'SESSION') === false
994992
) {
995993
?>
996994
<input type="hidden" id="user-login-attempts" value="1">
@@ -1028,7 +1026,7 @@
10281026
<?php
10291027
/* MAIN PAGE */
10301028
echo '
1031-
<input type="hidden" id="temps_restant" value="', $_SESSION['sessionDuration'] ?? '', '" />';
1029+
<input type="hidden" id="temps_restant" value="', $superGlobal->get('sessionDuration', 'SESSION') ?? '', '" />';
10321030
// display an item in the context of OTV link
10331031
} elseif (($session_validite_pw === null
10341032
|| empty($session_validite_pw) === true
@@ -1040,7 +1038,7 @@
10401038
) {
10411039
include './includes/core/otv.php';
10421040
} else {
1043-
$_SESSION['error']['code'] = ERR_VALID_SESSION;
1041+
$superGlobal->put('code', ERR_VALID_SESSION, 'SESSION', 'error');
10441042
$superGlobal->put(
10451043
'initial_url',
10461044
filter_var(
@@ -1291,10 +1289,7 @@
12911289
$get['page'] = $superGlobal->get('page', 'GET') === null ? '' : $superGlobal->get('page', 'GET');
12921290

12931291
// Load links, css and javascripts
1294-
if (
1295-
isset($_SESSION['CPM']) === true
1296-
&& isset($SETTINGS['cpassman_dir']) === true
1297-
) {
1292+
if (isset($SETTINGS['cpassman_dir']) === true) {
12981293
include_once $SETTINGS['cpassman_dir'] . '/includes/core/load.js.php';
12991294
if ($menuAdmin === true) {
13001295
include_once $SETTINGS['cpassman_dir'] . '/pages/admin.js.php';

‎pages/2fa.js.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -67,7 +67,7 @@
6767
]
6868
);
6969
// Handle the case
70-
$checkUserAccess->caseHandler();
70+
echo $checkUserAccess->caseHandler();
7171
if ($checkUserAccess->checkSession() === false || $checkUserAccess->userAccessPage('mfa') === false) {
7272
// Not allowed page
7373
$superGlobal->put('code', ERR_NOT_ALLOWED, 'SESSION', 'error');

‎pages/2fa.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,7 @@
5959
]
6060
);
6161
// Handle the case
62-
$checkUserAccess->caseHandler();
62+
echo $checkUserAccess->caseHandler();
6363
if ($checkUserAccess->checkSession() === false || $checkUserAccess->userAccessPage('mfa') === false) {
6464
// Not allowed page
6565
$superGlobal->put('code', ERR_NOT_ALLOWED, 'SESSION', 'error');

‎pages/admin.js.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -58,7 +58,7 @@
5858
]
5959
);
6060
// Handle the case
61-
$checkUserAccess->caseHandler();
61+
echo $checkUserAccess->caseHandler();
6262
if ($checkUserAccess->checkSession() === false || $checkUserAccess->userAccessPage('admin') === false) {
6363
// Not allowed page
6464
$superGlobal->put('code', ERR_NOT_ALLOWED, 'SESSION', 'error');

‎pages/admin.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -65,7 +65,7 @@
6565
]
6666
);
6767
// Handle the case
68-
$checkUserAccess->caseHandler();
68+
echo $checkUserAccess->caseHandler();
6969
if ($checkUserAccess->checkSession() === false || $checkUserAccess->userAccessPage('admin') === false) {
7070
// Not allowed page
7171
$superGlobal->put('code', ERR_NOT_ALLOWED, 'SESSION', 'error');

‎pages/api.js.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -66,7 +66,7 @@
6666
]
6767
);
6868
// Handle the case
69-
$checkUserAccess->caseHandler();
69+
echo $checkUserAccess->caseHandler();
7070
if ($checkUserAccess->checkSession() === false || $checkUserAccess->userAccessPage('api') === false) {
7171
// Not allowed page
7272
$superGlobal->put('code', ERR_NOT_ALLOWED, 'SESSION', 'error');

‎pages/api.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,7 @@
5959
]
6060
);
6161
// Handle the case
62-
$checkUserAccess->caseHandler();
62+
echo $checkUserAccess->caseHandler();
6363
if ($checkUserAccess->checkSession() === false || $checkUserAccess->userAccessPage('api') === false) {
6464
// Not allowed page
6565
$superGlobal->put('code', ERR_NOT_ALLOWED, 'SESSION', 'error');

‎pages/backups.js.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -65,7 +65,7 @@
6565
]
6666
);
6767
// Handle the case
68-
$checkUserAccess->caseHandler();
68+
echo $checkUserAccess->caseHandler();
6969
if ($checkUserAccess->checkSession() === false || $checkUserAccess->userAccessPage('backups') === false) {
7070
// Not allowed page
7171
$superGlobal->put('code', ERR_NOT_ALLOWED, 'SESSION', 'error');

‎pages/backups.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,7 @@
5959
]
6060
);
6161
// Handle the case
62-
$checkUserAccess->caseHandler();
62+
echo $checkUserAccess->caseHandler();
6363
if ($checkUserAccess->checkSession() === false || $checkUserAccess->userAccessPage('backups') === false) {
6464
// Not allowed page
6565
$superGlobal->put('code', ERR_NOT_ALLOWED, 'SESSION', 'error');

‎pages/emails.js.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -66,7 +66,7 @@
6666
]
6767
);
6868
// Handle the case
69-
$checkUserAccess->caseHandler();
69+
echo $checkUserAccess->caseHandler();
7070
if ($checkUserAccess->checkSession() === false || $checkUserAccess->userAccessPage('emails') === false) {
7171
// Not allowed page
7272
$superGlobal->put('code', ERR_NOT_ALLOWED, 'SESSION', 'error');

‎pages/emails.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,7 @@
5959
]
6060
);
6161
// Handle the case
62-
$checkUserAccess->caseHandler();
62+
echo $checkUserAccess->caseHandler();
6363
if ($checkUserAccess->checkSession() === false || $checkUserAccess->userAccessPage('emails') === false) {
6464
// Not allowed page
6565
$superGlobal->put('code', ERR_NOT_ALLOWED, 'SESSION', 'error');

‎pages/export.js.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -66,7 +66,7 @@
6666
]
6767
);
6868
// Handle the case
69-
$checkUserAccess->caseHandler();
69+
echo $checkUserAccess->caseHandler();
7070
if ($checkUserAccess->checkSession() === false || $checkUserAccess->userAccessPage('export') === false) {
7171
// Not allowed page
7272
$superGlobal->put('code', ERR_NOT_ALLOWED, 'SESSION', 'error');

‎pages/export.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,7 @@
5959
]
6060
);
6161
// Handle the case
62-
$checkUserAccess->caseHandler();
62+
echo $checkUserAccess->caseHandler();
6363
if ($checkUserAccess->checkSession() === false || $checkUserAccess->userAccessPage('export') === false) {
6464
// Not allowed page
6565
$superGlobal->put('code', ERR_NOT_ALLOWED, 'SESSION', 'error');

‎pages/favorites.js.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -66,7 +66,7 @@
6666
]
6767
);
6868
// Handle the case
69-
$checkUserAccess->caseHandler();
69+
echo $checkUserAccess->caseHandler();
7070
if ($checkUserAccess->checkSession() === false || $checkUserAccess->userAccessPage('favourites') === false) {
7171
// Not allowed page
7272
$superGlobal->put('code', ERR_NOT_ALLOWED, 'SESSION', 'error');

‎pages/favourites.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -58,7 +58,7 @@
5858
]
5959
);
6060
// Handle the case
61-
$checkUserAccess->caseHandler();
61+
echo $checkUserAccess->caseHandler();
6262
if ($checkUserAccess->checkSession() === false || $checkUserAccess->userAccessPage('favourites') === false) {
6363
// Not allowed page
6464
$superGlobal->put('code', ERR_NOT_ALLOWED, 'SESSION', 'error');

‎pages/fields.js.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -65,7 +65,7 @@
6565
]
6666
);
6767
// Handle the case
68-
$checkUserAccess->caseHandler();
68+
echo $checkUserAccess->caseHandler();
6969
if ($checkUserAccess->checkSession() === false || $checkUserAccess->userAccessPage('fields') === false) {
7070
// Not allowed page
7171
$superGlobal->put('code', ERR_NOT_ALLOWED, 'SESSION', 'error');

‎pages/fields.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,7 @@
5959
]
6060
);
6161
// Handle the case
62-
$checkUserAccess->caseHandler();
62+
echo $checkUserAccess->caseHandler();
6363
if ($checkUserAccess->checkSession() === false || $checkUserAccess->userAccessPage('fields') === false) {
6464
// Not allowed page
6565
$superGlobal->put('code', ERR_NOT_ALLOWED, 'SESSION', 'error');

‎pages/folders.js.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -65,7 +65,7 @@
6565
]
6666
);
6767
// Handle the case
68-
$checkUserAccess->caseHandler();
68+
echo $checkUserAccess->caseHandler();
6969
if ($checkUserAccess->checkSession() === false || $checkUserAccess->userAccessPage('folders') === false) {
7070
// Not allowed page
7171
$superGlobal->put('code', ERR_NOT_ALLOWED, 'SESSION', 'error');

‎pages/folders.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,7 @@
6060
]
6161
);
6262
// Handle the case
63-
$checkUserAccess->caseHandler();
63+
echo $checkUserAccess->caseHandler();
6464
if ($checkUserAccess->checkSession() === false || $checkUserAccess->userAccessPage('folders') === false) {
6565
// Not allowed page
6666
$superGlobal->put('code', ERR_NOT_ALLOWED, 'SESSION', 'error');

‎pages/import.js.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -66,7 +66,7 @@
6666
]
6767
);
6868
// Handle the case
69-
$checkUserAccess->caseHandler();
69+
echo $checkUserAccess->caseHandler();
7070
if ($checkUserAccess->checkSession() === false || $checkUserAccess->userAccessPage('import') === false) {
7171
// Not allowed page
7272
$superGlobal->put('code', ERR_NOT_ALLOWED, 'SESSION', 'error');

‎pages/import.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,7 @@
5959
]
6060
);
6161
// Handle the case
62-
$checkUserAccess->caseHandler();
62+
echo $checkUserAccess->caseHandler();
6363
if ($checkUserAccess->checkSession() === false || $checkUserAccess->userAccessPage('import') === false) {
6464
// Not allowed page
6565
$superGlobal->put('code', ERR_NOT_ALLOWED, 'SESSION', 'error');

‎pages/items.js.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -67,7 +67,7 @@
6767
]
6868
);
6969
// Handle the case
70-
$checkUserAccess->caseHandler();
70+
echo $checkUserAccess->caseHandler();
7171
if ($checkUserAccess->checkSession() === false || $checkUserAccess->userAccessPage('items') === false) {
7272
// Not allowed page
7373
$superGlobal->put('code', ERR_NOT_ALLOWED, 'SESSION', 'error');

‎pages/items.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,7 @@
5959
]
6060
);
6161
// Handle the case
62-
$checkUserAccess->caseHandler();
62+
echo $checkUserAccess->caseHandler();
6363
if ($checkUserAccess->checkSession() === false || $checkUserAccess->userAccessPage('items') === false) {
6464
// Not allowed page
6565
$superGlobal->put('code', ERR_NOT_ALLOWED, 'SESSION', 'error');

‎pages/ldap.js.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -66,7 +66,7 @@
6666
]
6767
);
6868
// Handle the case
69-
$checkUserAccess->caseHandler();
69+
echo $checkUserAccess->caseHandler();
7070
if ($checkUserAccess->checkSession() === false || $checkUserAccess->userAccessPage('ldap') === false) {
7171
// Not allowed page
7272
$superGlobal->put('code', ERR_NOT_ALLOWED, 'SESSION', 'error');

‎pages/ldap.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,7 @@
6060
]
6161
);
6262
// Handle the case
63-
$checkUserAccess->caseHandler();
63+
echo $checkUserAccess->caseHandler();
6464
if ($checkUserAccess->checkSession() === false || $checkUserAccess->userAccessPage('ldap') === false) {
6565
// Not allowed page
6666
$superGlobal->put('code', ERR_NOT_ALLOWED, 'SESSION', 'error');

‎pages/options.js.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -66,7 +66,7 @@
6666
]
6767
);
6868
// Handle the case
69-
$checkUserAccess->caseHandler();
69+
echo $checkUserAccess->caseHandler();
7070
if ($checkUserAccess->checkSession() === false || $checkUserAccess->userAccessPage('options') === false) {
7171
// Not allowed page
7272
$superGlobal->put('code', ERR_NOT_ALLOWED, 'SESSION', 'error');

‎pages/options.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,7 @@
5959
]
6060
);
6161
// Handle the case
62-
$checkUserAccess->caseHandler();
62+
echo $checkUserAccess->caseHandler();
6363
if ($checkUserAccess->checkSession() === false || $checkUserAccess->userAccessPage('options') === false) {
6464
// Not allowed page
6565
$superGlobal->put('code', ERR_NOT_ALLOWED, 'SESSION', 'error');

‎pages/profile.js.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -66,7 +66,7 @@
6666
]
6767
);
6868
// Handle the case
69-
$checkUserAccess->caseHandler();
69+
echo $checkUserAccess->caseHandler();
7070
if ($checkUserAccess->checkSession() === false || $checkUserAccess->userAccessPage('profile') === false) {
7171
// Not allowed page
7272
$superGlobal->put('code', ERR_NOT_ALLOWED, 'SESSION', 'error');

‎pages/profile.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,7 @@
5959
]
6060
);
6161
// Handle the case
62-
$checkUserAccess->caseHandler();
62+
echo $checkUserAccess->caseHandler();
6363
if ($checkUserAccess->checkSession() === false || $checkUserAccess->userAccessPage('profile') === false) {
6464
// Not allowed page
6565
$superGlobal->put('code', ERR_NOT_ALLOWED, 'SESSION', 'error');

‎pages/roles.js.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -65,7 +65,7 @@
6565
]
6666
);
6767
// Handle the case
68-
$checkUserAccess->caseHandler();
68+
echo $checkUserAccess->caseHandler();
6969
if ($checkUserAccess->checkSession() === false || $checkUserAccess->userAccessPage('roles') === false) {
7070
// Not allowed page
7171
$superGlobal->put('code', ERR_NOT_ALLOWED, 'SESSION', 'error');

‎pages/roles.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,7 @@
6060
]
6161
);
6262
// Handle the case
63-
$checkUserAccess->caseHandler();
63+
echo $checkUserAccess->caseHandler();
6464
if ($checkUserAccess->checkSession() === false || $checkUserAccess->userAccessPage('roles') === false) {
6565
// Not allowed page
6666
$superGlobal->put('code', ERR_NOT_ALLOWED, 'SESSION', 'error');

0 commit comments

Comments
 (0)