gnh1201/seeddms-code
1
0
Fork 0
mirror of https://git.code.sf.net/p/seeddms/code synced 2025-02-11 09:35:00 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

redirekt to out/out.Setup2Auth.php if 2-fact-auth isn't setup

Browse Source 
make sure user has not been substituted for setting up 2-fact-auth
or password change
This commit is contained in:
Uwe Steinmann 2016-07-12 17:40:54 +02:00
parent 2bc217b156
commit b8b1996fb4
1 changed files with 16 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
inc/inc.Authentication.php
View File

@ -81,8 +81,10 @@ if (!is_object($user)) {
exit;
}
$origuser = null;
if($resArr["su"] && $su = $dms->getUser($resArr["su"])) {
if($user->isAdmin() || $user->maySwitchToUser($su)) {
$origuser = $user;
$user = $su;
} else {
$session->resetSu();
@ -127,10 +129,10 @@ if(file_exists($settings->_rootDir . "view/".$theme."/languages/" . $lang . "/la
/* Check if password needs to be changed because it expired. If it needs
* to be changed redirect to out/out.ForcePasswordChange.php. Do this
* check only if password expiration is turned on, we are not on the
* page to change the password or the page that changes the password, and
* it is not admin */
* page to change the password or the page that changes the password, the
* current user is not admin, and no user substiation has occured. */
if (!$user->isAdmin()) {
if (!$user->isAdmin() && $origuser == null) {
if($settings->_passwordExpiration > 0) {
if(basename($_SERVER['SCRIPT_NAME']) != 'out.ForcePasswordChange.php' && basename($_SERVER['SCRIPT_NAME']) != 'op.EditUserData.php') {
$pwdexp = $user->getPwdExpiration();
@ -145,6 +147,17 @@ if (!$user->isAdmin()) {
}
}
/* Check if secret is set for 2-factor authentication. Redirect to Setup2Factor.php
* if secret is not set and 2-factor authentication is turned on. Also check if
* already on the page Setup2Factor.php and no user substiation has occured.
*/
if($settings->_enable2FactorAuthentication && $origuser == null && $user->getSecret() == '') {
if(basename($_SERVER['SCRIPT_NAME']) != 'out.Setup2Factor.php') {
header("Location: ../out/out.Setup2Factor.php");
exit;
}
}
/* Update cookie lifetime */
if($settings->_cookieLifetime) {
$lifetime = time() + intval($settings->_cookieLifetime);