possible fix for https://github.com/postfixadmin/postfixadmin/issues/967
CSRF Token changes : rather than have one PFA_Token value in $_SESSION, store a list of them, where each value has a time stamp it was issued on. The aim is to allow the user to have multiple browser tabs open at once - and not have the last tab that loaded trample on others. Tokens expire after 1 hour.
Adds a Smarty helper function `{CSRF_Token}` which will output `<input type=hidden name=CSRF_Token value=asdf123>` or `{CSRF_Token type=url}` which outputs a literal string like 'asdf123' suitable for placing in a URL.
Adds a PHP exception handler in public/common.php, which could be used to display a more friendly error message/response (but at the moment is fairly minimal).
Removes most uses of `die()` within the codebase, and instead moves to throw an exception
With the default PHPSESSID cookie name, there are some rare (and hard to
debug) cases that break logging in if a different application on the
domain also uses a PHPSESSID cookie. See
https://sourceforge.net/p/postfixadmin/bugs/314/ for details.
Using 'postfixadmin_session' as cookie name should fix this.
git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1846 a1433add-5e2c-0410-b055-b7f2511e0802
- call Config::write() earlier, because check_language() uses it
- later add $PALANG with Config::write(__LANG)
Thanks to <controlcde> for reporting the results of this bug on IRC
(even if I had to hunt it down to find the reason ;-)
git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1548 a1433add-5e2c-0410-b055-b7f2511e0802
found out that the 'Config' class is too static - it shares its static
data with the 'Lang' child class.
This caused a conflict because we have $CONF[transport] and
$PALANG[transport], and Config::read('transport') returned the $PALANG
text.
To fix this, all texts are now stored as $CONF[__LANG].
I also dropped the 'Lang' class.
model/Config.php:
- mark the 'Config' class as final to ensure we don't trap into the
"too static" problem again.
- bool(): display and log an error message if a $CONF option does not
contain YES or NO (that would have uncovered this bug much earlier)
- add lang() and lang_f() wrapper functions to get $PALANG texts
- remove unused $__cache and $__objects
model/Lang.php:
- deleted
common.php:
- store $PALANG as $CONF[__LANG]
lots of files:
- replace Lang::read() and Lang::read_f() calls with Config::lang()
and Config::lang_f()
git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1536 a1433add-5e2c-0410-b055-b7f2511e0802
- move postfixadmin_autoload() and spl_autoload_register upwards
(it's needed earlier after using the Config class in more functions)
- call Config::write earlier (as soon as $CONF is complete)
git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1454 a1433add-5e2c-0410-b055-b7f2511e0802
- init Lang and Config classes in common.php instead of postfixadmin-cli.php -
they need to be available in the web interface also
git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1215 a1433add-5e2c-0410-b055-b7f2511e0802
