You've already forked postfixadmin
mirror of
https://github.com/postfixadmin/postfixadmin.git
synced 2026-10-24 12:19:19 +03:00
8a1f9a11af
possible fix for https://github.com/postfixadmin/postfixadmin/issues/967 CSRF Token changes : rather than have one PFA_Token value in $_SESSION, store a list of them, where each value has a time stamp it was issued on. The aim is to allow the user to have multiple browser tabs open at once - and not have the last tab that loaded trample on others. Tokens expire after 1 hour. Adds a Smarty helper function `{CSRF_Token}` which will output `<input type=hidden name=CSRF_Token value=asdf123>` or `{CSRF_Token type=url}` which outputs a literal string like 'asdf123' suitable for placing in a URL. Adds a PHP exception handler in public/common.php, which could be used to display a more friendly error message/response (but at the moment is fairly minimal). Removes most uses of `die()` within the codebase, and instead moves to throw an exception
114 lines
3.5 KiB
PHP
114 lines
3.5 KiB
PHP
<?php
|
|
|
|
if (!is_file(dirname(__FILE__) . '/vendor/autoload.php')) {
|
|
die("vendor/autoload.php is missing. Please run 'install.sh' or follow the instructions in INSTALL.md");
|
|
}
|
|
|
|
require_once(dirname(__FILE__) . '/vendor/autoload.php');
|
|
|
|
/**
|
|
* Postfix Admin
|
|
*
|
|
* LICENSE
|
|
* This source file is subject to the GPL license that is bundled with
|
|
* this package in the file LICENSE.TXT.
|
|
*
|
|
* Further details on the project are available at https://github.com/postfixadmin/postfixadmin
|
|
*
|
|
* @license GNU GPL v2 or later.
|
|
*
|
|
* File: common.php
|
|
* All pages should include this file - which itself sets up the necessary
|
|
* environment and ensures other functions are loaded.
|
|
*/
|
|
|
|
// See: https://github.com/postfixadmin/postfixadmin/pull/541 - try and check if the user has a turkish locale and warn?
|
|
$old = setlocale(LC_ALL, 'C');
|
|
if (preg_match('/_TR/i', $old)) {
|
|
error_log("WARNING: You may have a Turkish locale set; this breaks the loading of some libraries (Smarty) we depend upon.");
|
|
// don't revert back to $old?
|
|
} else {
|
|
setlocale(LC_ALL, $old); // revert back.
|
|
}
|
|
|
|
if (!defined('POSTFIXADMIN')) {
|
|
define('POSTFIXADMIN', 1);
|
|
|
|
if (!defined('POSTFIXADMIN_CLI')) { // postfixadmin-cli
|
|
// this is the default; see also https://sourceforge.net/p/postfixadmin/bugs/347/
|
|
session_cache_limiter('nocache');
|
|
|
|
/**
|
|
* @see https://github.com/postfixadmin/postfixadmin/issues/903
|
|
*/
|
|
$cookie_params = session_get_cookie_params();
|
|
$cookie_params['samesite'] = 'Strict';
|
|
$cookie_params['httponly'] = true;
|
|
// Is this worthwhile? a non https request will get a non 'secure' cookie.
|
|
if (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] == 'on') {
|
|
$cookie_params['secure'] = true;
|
|
}
|
|
session_set_cookie_params($cookie_params);
|
|
session_name('postfixadmin_session');
|
|
session_start();
|
|
|
|
if (empty($_SESSION['flash'])) {
|
|
$_SESSION['flash'] = array();
|
|
}
|
|
|
|
// avoid clickjacking attacks?
|
|
header('X-Frame-Options: DENY');
|
|
// see https://github.com/postfixadmin/postfixadmin/issues/905
|
|
header("Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:");
|
|
}
|
|
}
|
|
|
|
$incpath = dirname(__FILE__);
|
|
|
|
if (!is_file("$incpath/config.inc.php")) {
|
|
die("config.inc.php is missing!");
|
|
}
|
|
|
|
global $CONF;
|
|
|
|
require_once("$incpath/config.inc.php");
|
|
|
|
|
|
if (isset($CONF['configured']) && !defined('PHPUNIT_TEST')) {
|
|
if ($CONF['configured'] == false) {
|
|
die("Please edit config.local.php - change \$CONF['configured'] to true after specifying appropriate local settings (database_type etc)");
|
|
}
|
|
}
|
|
|
|
Config::getInstance()->setAll($CONF);
|
|
|
|
$PALANG = [];
|
|
|
|
require_once("$incpath/functions.inc.php");
|
|
|
|
if (defined('POSTFIXADMIN_CLI')) {
|
|
$language = 'en'; # TODO: make configurable or autodetect from locale settings
|
|
} else {
|
|
$language = Languages::check_language();
|
|
$_SESSION['lang'] = $language;
|
|
}
|
|
if (!empty($language)) {
|
|
require_once("$incpath/languages/" . $language . ".lang");
|
|
}
|
|
|
|
if (!empty($CONF['language_hook']) && function_exists($CONF['language_hook'])) {
|
|
$hook_func = $CONF['language_hook'];
|
|
$PALANG = $hook_func($PALANG, $language);
|
|
}
|
|
|
|
Config::write('__LANG', $PALANG);
|
|
|
|
if (!defined('POSTFIXADMIN_CLI')) {
|
|
if (!isset($PALANG)) {
|
|
die("environment not setup correctly");
|
|
}
|
|
Smarty_Autoloader::register();
|
|
}
|
|
|
|
/* vim: set expandtab softtabstop=4 tabstop=4 shiftwidth=4: */
|