ZwiiCMS-Team/ZwiiCMS
ZwiiCMS-Team/ZwiiCMS
10
9
Fork 3
Code Releases 154 Activity

méthode authentification

Browse Source
This commit is contained in:
Fred Tempez 2024-09-06 17:32:29 +02:00 committed by Frédéric Tempez
parent 10b79c586b
commit 6b8d769e43
11 changed files with 53 additions and 34 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
core/class/layout.class.php
View File

@ -330,7 +330,7 @@ class layout extends common
// Affichage du lien de connexion
if (
($this->getData(['theme', 'footer', 'loginLink'])
and $this->getUser('password') !== $this->getInput('ZWII_USER_PASSWORD')
and $this->isConnected() === false
)
or $this->getUrl(0) === 'theme'
) {
@ -493,7 +493,7 @@ class layout extends common
// Lien de connexion
if (
($this->getData(['theme', 'menu', 'loginLink'])
and $this->getUser('password') !== $this->getInput('ZWII_USER_PASSWORD')
and $this->isConnected() === false
)
or $this->getUrl(0) === 'theme'
) {
@ -580,9 +580,9 @@ class layout extends common
if (
($this->getData(['page', $parentPageId, 'disable']) === true
and $this->getUser('password') !== $this->getInput('ZWII_USER_PASSWORD')
and $this->isConnected() === false
) or ($this->getData(['page', $parentPageId, 'disable']) === true
and $this->getUser('password') === $this->getInput('ZWII_USER_PASSWORD')
and $this->isConnected() === true
and $this->getUser('group') < self::GROUP_EDITOR
)
) {
@ -646,9 +646,9 @@ class layout extends common
$items .= '<li id=' . $childKey . '>';
if (
($this->getData(['page', $childKey, 'disable']) === true
and $this->getUser('password') !== $this->getInput('ZWII_USER_PASSWORD')
and $this->isConnected() === false
) or ($this->getData(['page', $childKey, 'disable']) === true
and $this->getUser('password') === $this->getInput('ZWII_USER_PASSWORD')
and $this->isConnected() === true
and $this->getUser('group') < self::GROUP_EDITOR
)
) {
@ -742,7 +742,7 @@ class layout extends common
$items .= '<li class="menuSideChild">';
if (
$this->getData(['page', $parentPageId, 'disable']) === true
and $this->getUser('password') !== $this->getInput('ZWII_USER_PASSWORD')
and $this->isConnected() === false
) {
$items .= '<a href="' . $this->getUrl(1) . '">';
} else {
@ -766,7 +766,7 @@ class layout extends common
if (
$this->getData(['page', $childKey, 'disable']) === true
and $this->getUser('password') !== $this->getInput('ZWII_USER_PASSWORD')
and $this->isConnected() === false
) {
$itemsChildren .= '<a href="' . $this->getUrl(1) . '">';
} else {
@ -902,7 +902,7 @@ class layout extends common
*/
public function showBar()
{
if ($this->getUser('password') === $this->getInput('ZWII_USER_PASSWORD')) {
if ($this->isConnected() === true) {
// Items de gauche
$leftItems = '';
// Sélecteur de langues
@ -1188,7 +1188,7 @@ class layout extends common
$vars = 'var baseUrl = ' . json_encode(helper::baseUrl(false)) . ';';
$vars .= 'var baseUrlQs = ' . json_encode(helper::baseUrl()) . ';';
if (
$this->getUser('password') === $this->getInput('ZWII_USER_PASSWORD')
$this->isConnected() === true
and $this->getUser('group') >= self::GROUP_EDITOR
) {
$vars .= 'var privateKey = ' . json_encode(md5_file(self::DATA_DIR . 'core.json')) . ';';

16
core/class/router.class.php
View File

@ -415,7 +415,7 @@ class core extends common
// Force la déconnexion des membres bannis ou d'une seconde session
if (
$this->getUser('password') === $this->getInput('ZWII_USER_PASSWORD')
$this->isConnected() === true
and ($this->getUser('group') === common::GROUP_BANNED
or ($_SESSION['csrf'] !== $this->getData(['user', $this->getUser('id'), 'accessCsrf'])
and $this->getData(['config', 'connect', 'autoDisconnect']) === true)
@ -429,8 +429,8 @@ class core extends common
$this->getData(['config', 'maintenance'])
and in_array($this->getUrl(0), ['maintenance', 'user']) === false
and $this->getUrl(1) !== 'login'
and ($this->getUser('password') !== $this->getInput('ZWII_USER_PASSWORD')
or ($this->getUser('password') === $this->getInput('ZWII_USER_PASSWORD')
and ($this->isConnected() === false
or ($this->isConnected() === true
and $this->getUser('group') < common::GROUP_ADMIN
)
)
@ -449,7 +449,7 @@ class core extends common
if ($this->getData(['page', $this->getUrl(0)]) !== null) {
if (
$this->getData(['page', $this->getUrl(0), 'group']) === common::GROUP_VISITOR
or ($this->getUser('password') === $this->getInput('ZWII_USER_PASSWORD')
or ($this->isConnected() === true
// and $this->getUser('group') >= $this->getData(['page', $this->getUrl(0), 'group'])
// Modification qui tient compte du profil de la page
and ($this->getUser('group') * 10 + $this->getUser('profil')) >= ($this->getData(['page', $this->getUrl(0), 'group']) * 10 + $this->getData(['page', $this->getUrl(0), 'profil']))
@ -466,9 +466,9 @@ class core extends common
// Empêcher l'accès aux pages désactivées par URL directe
if (
($this->getData(['page', $this->getUrl(0), 'disable']) === true
and $this->getUser('password') !== $this->getInput('ZWII_USER_PASSWORD')
and $this->isConnected() === false
) or ($this->getData(['page', $this->getUrl(0), 'disable']) === true
and $this->getUser('password') === $this->getInput('ZWII_USER_PASSWORD')
and $this->isConnected() === true
and $this->getUser('group') < common::GROUP_EDITOR
)
) {
@ -515,7 +515,7 @@ class core extends common
}
// Accès concurrent stocke la page visitée
if (
$this->getUser('password') === $this->getInput('ZWII_USER_PASSWORD')
$this->isConnected() === true
&& $this->getUser('id')
) {
$this->setData(['user', $this->getUser('id'), 'accessUrl', $this->getUrl()]);
@ -635,7 +635,7 @@ class core extends common
// Check le groupe de l'utilisateur
if (
($module::$actions[$action] === common::GROUP_VISITOR
or ($this->getUser('password') === $this->getInput('ZWII_USER_PASSWORD')
or ($this->isConnected() === true
and $this->getUser('group') >= $module::$actions[$action]
and $this->getUser('permission', $moduleId, $action)
)

11
core/core.php
View File

@ -768,7 +768,7 @@ class common
$this->getData(['page', $pageId, 'parentPageId']) === ""
// Ignore les pages dont l'utilisateur n'a pas accès
and ($this->getData(['page', $pageId, 'group']) === self::GROUP_VISITOR
or ($this->getUser('password') === $this->getInput('ZWII_USER_PASSWORD')
or ($this->isConnected() === true
//and $this->getUser('group') >= $this->getData(['page', $pageId, 'group'])
// Modification qui tient compte du profil de la page
and ($this->getUser('group') * self::MAX_PROFILS + $this->getUser('profil')) >= ($this->getData(['page', $pageId, 'group']) * self::MAX_PROFILS + $this->getData(['page', $pageId, 'profil']))
@ -799,7 +799,7 @@ class common
$this->getData(['page', $parentId, 'group']) === self::GROUP_VISITOR
)
or (
$this->getUser('password') === $this->getInput('ZWII_USER_PASSWORD')
$this->isConnected() === true
and
$this->getUser('group') * self::MAX_PROFILS + $this->getUser('profil')) >= ($this->getData(['page', $pageId, 'group']) * self::MAX_PROFILS + $this->getData(['page', $pageId, 'profil'])
@ -1028,6 +1028,13 @@ class common
}
/**
* @return bool l'utilisateur est connecté true sinon false
*/
public function isConnected() {
return ($this->getUser('authKey') === $this->getInput('ZWII_AUTH_KEY'));
}
/**
* Check qu'une valeur est transmise par la méthode _POST
* @return bool

2
core/layout/main.php
View File

@ -54,7 +54,7 @@
if (
$this->getData(['theme', 'menu', 'position']) === 'top'
and $this->getData(['theme', 'menu', 'fixed']) === true
and $this->getUser('password') === $this->getInput('ZWII_USER_PASSWORD')
and $this->isConnected() === true
and $this->getUser('group') > self::GROUP_MEMBER
) {
echo '<nav id="navfixedconnected" >';

18
core/module/user/user.php
View File

@ -1046,18 +1046,28 @@ class user extends common
$this->setData(['user', $userId, 'connectFail', 0]);
$this->setData(['user', $userId, 'connectTimeout', 0]);
// Clé d'authenfication
$authKey = uniqid('', true) . bin2hex(random_bytes(8));
$this->setData(['user', $userId, 'authKey', $authKey]);
// Validité du cookie
$expire = $this->getInput('userLoginLongTime', helper::FILTER_BOOLEAN) === true ? strtotime("+1 year") : 0;
switch ($this->getInput('userLoginLongTime', helper::FILTER_BOOLEAN)) {
case false:
// Cookie de session
setcookie('ZWII_USER_ID', $userId, $expire, helper::baseUrl(false, false), '', helper::isHttps(), true);
setcookie('ZWII_USER_PASSWORD', $this->getData(['user', $userId, 'password']), $expire, helper::baseUrl(false, false), '', helper::isHttps(), true);
//setcookie('ZWII_USER_PASSWORD', $this->getData(['user', $userId, 'password']), $expire, helper::baseUrl(false, false), '', helper::isHttps(), true);
// Connexion par clé
setcookie('ZWII_AUTH_KEY', $authKey, $expire, helper::baseUrl(false, false), '', helper::isHttps(), true);
break;
default:
// Cookie persistant
setcookie('ZWII_USER_ID', $userId, $expire, helper::baseUrl(false, false));
setcookie('ZWII_USER_PASSWORD', $this->getData(['user', $userId, 'password']), $expire, helper::baseUrl(false, false));
//setcookie('ZWII_USER_PASSWORD', $this->getData(['user', $userId, 'password']), $expire, helper::baseUrl(false, false));
// Connexion par clé
setcookie('ZWII_AUTH_KEY', $authKey, $expire, helper::baseUrl(false, false));
break;
}
@ -1136,7 +1146,9 @@ class user extends common
public function logout()
{
helper::deleteCookie('ZWII_USER_ID');
helper::deleteCookie('ZWII_USER_PASSWORD');
//helper::deleteCookie('ZWII_USER_PASSWORD');
helper::deleteCookie('ZWII_AUTH_KEY');
$this->setData(['user', $this->getUser('id'), 'authKey', '']);
// Détruit la session
session_destroy();

4
module/blog/blog.php
View File

@ -749,7 +749,7 @@ class blog extends common
) {
// Check la captcha
if (
$this->getUser('password') !== $this->getInput('ZWII_USER_PASSWORD')
$this->isConnected() === false
//AND $this->getInput('blogArticlecaptcha', helper::FILTER_INT) !== $this->getInput('blogArticlecaptchaFirstNumber', helper::FILTER_INT) + $this->getInput('blogArticlecaptchaSecondNumber', helper::FILTER_INT))
and password_verify($this->getInput('blogArticleCaptcha', helper::FILTER_INT), $this->getInput('blogArticleCaptchaResult')) === false
) {
@ -831,7 +831,7 @@ class blog extends common
// Signature de l'article
self::$articleSignature = $this->signature($this->getData(['module', $this->getUrl(0), 'posts', $this->getUrl(1), 'userId']));
// Signature du commentaire édité
if ($this->getUser('password') === $this->getInput('ZWII_USER_PASSWORD')) {
if ($this->isConnected() === true) {
self::$editCommentSignature = $this->signature($this->getUser('id'));
}
// Commentaires en fonction de la pagination

6
module/blog/view/article/article.php
View File

@ -25,7 +25,7 @@
<?php echo helper::dateUTF8($module::$dateFormat, $this->getData(['module', $this->getUrl(0), 'posts', $this->getUrl(1), 'publishedOn']), self::$i18nUI) . ' ' . helper::dateUTF8($module::$timeFormat, $this->getData(['module', $this->getUrl(0), 'posts', $this->getUrl(1), 'publishedOn']), self::$i18nUI); ?>
<!-- Bloc edition -->
<?php if (
$this->getUser('password') === $this->getInput('ZWII_USER_PASSWORD')
$this->isConnected() === true
and
( // Propriétaire
($this->getData(['module', $this->getUrl(0), 'posts', $this->getUrl(1), 'editConsent']) === $module::EDIT_OWNER
@ -88,7 +88,7 @@
'readonly' => true
]); ?>
<div id="blogArticleCommentWrapper" class="displayNone">
<?php if ($this->getUser('password') === $this->getInput('ZWII_USER_PASSWORD')): ?>
<?php if ($this->isConnected() === true): ?>
<?php echo template::text('blogArticleUserName', [
'label' => 'Nom',
'readonly' => true,
@ -122,7 +122,7 @@
'maxlength' => $this->getData(['module', $this->getUrl(0), 'posts', $this->getUrl(1), 'commentMaxlength'])
]); ?>
<div id="blogArticleContentAlarm"> </div>
<?php if ($this->getUser('password') !== $this->getInput('ZWII_USER_PASSWORD')): ?>
<?php if ($this->isConnected() === false): ?>
<div class="row">
<div class="col12">
<?php echo template::captcha('blogArticleCaptcha', [

2
module/blog/view/index/index.php
View File

@ -51,7 +51,7 @@
<div class="col6 blogEdit">
<!-- Bloc edition -->
<?php if (
$this->getUser('password') === $this->getInput('ZWII_USER_PASSWORD')
$this->isConnected() === true
and
( // Propriétaire
($this->getData(['module', $this->getUrl(0), 'posts', $articleId, 'editConsent']) === $module::EDIT_OWNER

2
module/news/view/article/article.php
View File

@ -19,7 +19,7 @@
<?php echo helper::dateUTF8('%d %B %Y', $this->getData(['module', $this->getUrl(0), 'posts', $this->getUrl(1), 'publishedOn']), self::$i18nUI) . '&nbsp' . helper::dateUTF8('%H:%M', $this->getData(['module', $this->getUrl(0), 'posts', $this->getUrl(1), 'publishedOn']), self::$i18nUI); ?>
<!-- Bloc edition -->
<?php if (
$this->getUser('password') === $this->getInput('ZWII_USER_PASSWORD')
$this->isConnected() === true
and
( // Propriétaire
($this->getUser('group') === self::GROUP_ADMIN)

2
module/news/view/index/index.php
View File

@ -26,7 +26,7 @@
<?php echo helper::dateUTF8($module::$dateFormat, $news['publishedOn'], self::$i18nUI) . '&nbsp;' . helper::dateUTF8($module::$timeFormat, $news['publishedOn'], self::$i18nUI); ?>
<!-- Bloc edition -->
<?php if (
$this->getUser('password') === $this->getInput('ZWII_USER_PASSWORD')
$this->isConnected() === true
and
( // Propriétaire
($this->getUser('group') === self::GROUP_ADMIN)

2
module/redirection/redirection.php
View File

@ -58,7 +58,7 @@ class redirection extends common
{
// Message si l'utilisateur peut éditer la page
if (
$this->getUser('password') === $this->getInput('ZWII_USER_PASSWORD')
$this->isConnected() === true
&& $this->getUser('group') >= self::GROUP_EDITOR
&& $this->getUrl(1) !== 'force'
) {