Merge pull request hestiacp#1136 from hestiacp/fix/2020-09-fix_delete_post_on_session_mismatch

ScIT-Raphael · web-flow · commit 06a1ff472012 · 2020-09-05T10:16:59.000+02:00
Delete POST/GET/SESSION data on session token mismatch
diff --git a/web/login/index.php b/web/login/index.php
@@ -98,7 +98,7 @@ function authenticate_user(){
                 if ($data[$_POST['user']]['TWOFA'] != '') {
                    if (empty($_POST['twofa'])){
                        return false;
-                   }else{
+                   } else {
                         $v_twofa = $_POST['twofa'];
                         exec(HESTIA_CMD ."v-check-user-2fa ".$v_user." ".$v_twofa, $output, $return_var);
                         unset($output);
@@ -148,6 +148,13 @@ function authenticate_user(){
                 }
             }
         }
+    } else {
+        unset($_POST);
+        unset($_GET);
+        unset($_SESSION);
+        session_destroy();
+        session_start();
+        return false;
     }
 }
 
@@ -190,4 +197,4 @@ function authenticate_user(){
 } else {
     require_once('../templates/login.html');
 }
-?>
+?>

Original file line number	Diff line number	Diff line change
`@@ -98,7 +98,7 @@ function authenticate_user(){`
`98`	`98`	`if ($data[$_POST['user']]['TWOFA'] != '') {`
`99`	`99`	`if (empty($_POST['twofa'])){`
`100`	`100`	`return false;`
`101`		`- }else{`
	`101`	`+ } else {`
`102`	`102`	`$v_twofa = $_POST['twofa'];`
`103`	`103`	`exec(HESTIA_CMD ."v-check-user-2fa ".$v_user." ".$v_twofa, $output, $return_var);`
`104`	`104`	`unset($output);`
`@@ -148,6 +148,13 @@ function authenticate_user(){`
`148`	`148`	`}`
`149`	`149`	`}`
`150`	`150`	`}`
	`151`	`+ } else {`
	`152`	`+ unset($_POST);`
	`153`	`+ unset($_GET);`
	`154`	`+ unset($_SESSION);`
	`155`	`+ session_destroy();`
	`156`	`+ session_start();`
	`157`	`+ return false;`
`151`	`158`	`}`
`152`	`159`	`}`
`153`	`160`
`@@ -190,4 +197,4 @@ function authenticate_user(){`
`190`	`197`	`} else {`
`191`	`198`	`require_once('../templates/login.html');`
`192`	`199`	`}`
`193`		`-?>`
	`200`	`+?>`