MBonaldo/hfs2
1
0
Fork 0
mirror of https://github.com/rejetto/hfs2.git synced 2025-12-19 10:03:56 +01:00
Code Issues Packages Projects Releases Wiki Activity

fix: login randomly broken (when 'D' in SID)

Browse Source
This commit is contained in:
Massimo Melina 2020-05-30 15:48:28 +02:00
parent ebf997951f
commit 82e971bc47
1 changed files with 10 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
main.pas
View File

@ -2234,7 +2234,7 @@ if assigned(mainFrm) then
end; // reenableUserInteraction end; // reenableUserInteraction
function sanitizeSID(s:string):string; function sanitizeSID(s:string):string;
begin result:=reReplace(s, '[\D\W]', '', '!') end; begin result:=reReplace(s, '[^0-9a-zA-Z]', '', '!') end;
function getNewSID():string; function getNewSID():string;
begin result:=sanitizeSID(base64encode(str_(now())+str_(random()))) end; begin result:=sanitizeSID(base64encode(str_(now())+str_(random()))) end;
@ -4874,7 +4874,7 @@ var
function sessionSetup():boolean; function sessionSetup():boolean;
var var
sid: string; sid, s: string;
begin begin
result:=TRUE; result:=TRUE;
if data = NIL then if data = NIL then
@ -4886,14 +4886,7 @@ var
sid:=conn.getCookie(SESSION_COOKIE); sid:=conn.getCookie(SESSION_COOKIE);
if sid = '' then if sid = '' then
sid:=data.urlvars.Values[SESSION_COOKIE]; sid:=data.urlvars.Values[SESSION_COOKIE];
sid:=sanitizeSID(sid); if (sid = sanitizeSID(sid)) and (sid.length >= 10) then
if sid.length < 10 then
begin
data.session:=Tsession.create();
data.session.ip:=conn.address;
conn.setCookie(SESSION_COOKIE, data.session.id, ['path','/'], 'HttpOnly'); // the session is site-wide, even if this request was related to a folder
end
else
try try
data.session:=sessions[sid]; data.session:=sessions[sid];
if data.session.ip <> conn.address then if data.session.ip <> conn.address then
@ -4905,7 +4898,13 @@ var
except except
data.session:=Tsession.create(sid); // probably expired data.session:=Tsession.create(sid); // probably expired
data.session.ip:=conn.address; data.session.ip:=conn.address;
end; end
else
begin
data.session:=Tsession.create();
data.session.ip:=conn.address;
conn.setCookie(SESSION_COOKIE, data.session.id, ['path','/'], 'HttpOnly'); // the session is site-wide, even if this request was related to a folder
end
end; end;
if conn.request.user > '' then // priority if conn.request.user > '' then // priority
begin begin