From eb28a76636e5b8f7a90f390cbc3ea6ec14b69cc1 Mon Sep 17 00:00:00 2001
From: Fred Tempez <frederic.tempez@outlook.com>
Date: Fri, 6 Sep 2024 17:32:29 +0200
Subject: [PATCH] =?UTF-8?q?m=C3=A9thode=20authentification?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 core/class/layout.class.php          | 20 ++++++++++----------
 core/class/router.class.php          | 16 ++++++++--------
 core/core.php                        | 11 +++++++++--
 core/layout/main.php                 |  2 +-
 core/module/user/user.php            | 20 ++++++++++++++++----
 module/blog/blog.php                 |  4 ++--
 module/blog/view/article/article.php |  6 +++---
 module/blog/view/index/index.php     |  2 +-
 module/news/view/article/article.php |  2 +-
 module/news/view/index/index.php     |  2 +-
 module/redirection/redirection.php   |  2 +-
 11 files changed, 53 insertions(+), 34 deletions(-)

diff --git a/core/class/layout.class.php b/core/class/layout.class.php
index 721967c7..db2d044d 100644
--- a/core/class/layout.class.php
+++ b/core/class/layout.class.php
@@ -330,7 +330,7 @@ class layout extends common
         // Affichage du lien de connexion
         if (
             ($this->getData(['theme', 'footer', 'loginLink'])
-                and $this->getUser('password') !== $this->getInput('ZWII_USER_PASSWORD')
+                and $this->isConnected() === false
             )
             or $this->getUrl(0) === 'theme'
         ) {
@@ -493,7 +493,7 @@ class layout extends common
         // Lien de connexion
         if (
             ($this->getData(['theme', 'menu', 'loginLink'])
-                and $this->getUser('password') !== $this->getInput('ZWII_USER_PASSWORD')
+                and $this->isConnected() === false
             )
             or $this->getUrl(0) === 'theme'
         ) {
@@ -580,9 +580,9 @@ class layout extends common
 
             if (
                 ($this->getData(['page', $parentPageId, 'disable']) === true
-                    and $this->getUser('password') !== $this->getInput('ZWII_USER_PASSWORD')
+                    and $this->isConnected() === false
                 ) or ($this->getData(['page', $parentPageId, 'disable']) === true
-                    and $this->getUser('password') === $this->getInput('ZWII_USER_PASSWORD')
+                    and $this->isConnected() === true
                     and $this->getUser('group') < self::GROUP_EDITOR
                 )
             ) {
@@ -646,9 +646,9 @@ class layout extends common
                 $items .= '<li id=' . $childKey . '>';
                 if (
                     ($this->getData(['page', $childKey, 'disable']) === true
-                        and $this->getUser('password') !== $this->getInput('ZWII_USER_PASSWORD')
+                        and $this->isConnected() === false
                     ) or ($this->getData(['page', $childKey, 'disable']) === true
-                        and $this->getUser('password') === $this->getInput('ZWII_USER_PASSWORD')
+                        and $this->isConnected() === true
                         and $this->getUser('group') < self::GROUP_EDITOR
                     )
                 ) {
@@ -742,7 +742,7 @@ class layout extends common
                 $items .= '<li class="menuSideChild">';
                 if (
                     $this->getData(['page', $parentPageId, 'disable']) === true
-                    and $this->getUser('password') !== $this->getInput('ZWII_USER_PASSWORD')
+                    and $this->isConnected() === false
                 ) {
                     $items .= '<a href="' . $this->getUrl(1) . '">';
                 } else {
@@ -766,7 +766,7 @@ class layout extends common
 
                 if (
                     $this->getData(['page', $childKey, 'disable']) === true
-                    and $this->getUser('password') !== $this->getInput('ZWII_USER_PASSWORD')
+                    and $this->isConnected() === false
                 ) {
                     $itemsChildren .= '<a href="' . $this->getUrl(1) . '">';
                 } else {
@@ -902,7 +902,7 @@ class layout extends common
      */
     public function showBar()
     {
-        if ($this->getUser('password') === $this->getInput('ZWII_USER_PASSWORD')) {
+        if ($this->isConnected() === true) {
             // Items de gauche
             $leftItems = '';
             // Sélecteur de langues
@@ -1188,7 +1188,7 @@ class layout extends common
         $vars = 'var baseUrl = ' . json_encode(helper::baseUrl(false)) . ';';
         $vars .= 'var baseUrlQs = ' . json_encode(helper::baseUrl()) . ';';
         if (
-            $this->getUser('password') === $this->getInput('ZWII_USER_PASSWORD')
+            $this->isConnected() === true
             and $this->getUser('group') >= self::GROUP_EDITOR
         ) {
             $vars .= 'var privateKey = ' . json_encode(md5_file(self::DATA_DIR . 'core.json')) . ';';
diff --git a/core/class/router.class.php b/core/class/router.class.php
index cb22a9b7..27d4dc55 100644
--- a/core/class/router.class.php
+++ b/core/class/router.class.php
@@ -415,7 +415,7 @@ class core extends common
 
 		// Force la déconnexion des membres bannis ou d'une seconde session
 		if (
-			$this->getUser('password') === $this->getInput('ZWII_USER_PASSWORD')
+			$this->isConnected() === true
 			and ($this->getUser('group') === common::GROUP_BANNED
 				or ($_SESSION['csrf'] !== $this->getData(['user', $this->getUser('id'), 'accessCsrf'])
 					and $this->getData(['config', 'connect', 'autoDisconnect']) === true)
@@ -429,8 +429,8 @@ class core extends common
 			$this->getData(['config', 'maintenance'])
 			and in_array($this->getUrl(0), ['maintenance', 'user']) === false
 			and $this->getUrl(1) !== 'login'
-			and ($this->getUser('password') !== $this->getInput('ZWII_USER_PASSWORD')
-				or ($this->getUser('password') === $this->getInput('ZWII_USER_PASSWORD')
+			and ($this->isConnected() === false
+				or ($this->isConnected() === true
 					and $this->getUser('group') < common::GROUP_ADMIN
 				)
 			)
@@ -449,7 +449,7 @@ class core extends common
 		if ($this->getData(['page', $this->getUrl(0)]) !== null) {
 			if (
 				$this->getData(['page', $this->getUrl(0), 'group']) === common::GROUP_VISITOR
-				or ($this->getUser('password') === $this->getInput('ZWII_USER_PASSWORD')
+				or ($this->isConnected() === true
 					// and $this->getUser('group') >= $this->getData(['page', $this->getUrl(0), 'group'])
 					// Modification qui tient compte du profil de la page
 					and ($this->getUser('group') * 10 + $this->getUser('profil')) >= ($this->getData(['page', $this->getUrl(0), 'group']) * 10 + $this->getData(['page', $this->getUrl(0), 'profil']))
@@ -466,9 +466,9 @@ class core extends common
 			// Empêcher l'accès aux pages désactivées par URL directe
 			if (
 				($this->getData(['page', $this->getUrl(0), 'disable']) === true
-					and $this->getUser('password') !== $this->getInput('ZWII_USER_PASSWORD')
+					and $this->isConnected() === false
 				) or ($this->getData(['page', $this->getUrl(0), 'disable']) === true
-					and $this->getUser('password') === $this->getInput('ZWII_USER_PASSWORD')
+					and $this->isConnected() === true
 					and $this->getUser('group') < common::GROUP_EDITOR
 				)
 			) {
@@ -515,7 +515,7 @@ class core extends common
 		}
 		// Accès concurrent stocke la page visitée
 		if (
-			$this->getUser('password') === $this->getInput('ZWII_USER_PASSWORD')
+			$this->isConnected() === true
 			&& $this->getUser('id')
 		) {
 			$this->setData(['user', $this->getUser('id'), 'accessUrl', $this->getUrl()]);
@@ -635,7 +635,7 @@ class core extends common
 					// Check le groupe de l'utilisateur
 					if (
 						($module::$actions[$action] === common::GROUP_VISITOR
-							or ($this->getUser('password') === $this->getInput('ZWII_USER_PASSWORD')
+							or ($this->isConnected() === true
 								and $this->getUser('group') >= $module::$actions[$action]
 								and $this->getUser('permission', $moduleId, $action)
 							)
diff --git a/core/core.php b/core/core.php
index 7451a1db..2b617e44 100644
--- a/core/core.php
+++ b/core/core.php
@@ -768,7 +768,7 @@ class common
 				 $this->getData(['page', $pageId, 'parentPageId']) === ""
 				 // Ignore les pages dont l'utilisateur n'a pas accès
 				 and ($this->getData(['page', $pageId, 'group']) === self::GROUP_VISITOR
-					 or ($this->getUser('password') === $this->getInput('ZWII_USER_PASSWORD')
+					 or ($this->isConnected() === true
 						 //and $this->getUser('group') >= $this->getData(['page', $pageId, 'group'])
 						 // Modification qui tient compte du profil de la page
 						 and ($this->getUser('group') * self::MAX_PROFILS + $this->getUser('profil')) >= ($this->getData(['page', $pageId, 'group']) * self::MAX_PROFILS + $this->getData(['page', $pageId, 'profil']))
@@ -799,7 +799,7 @@ class common
 						 $this->getData(['page', $parentId, 'group']) === self::GROUP_VISITOR
 					 )
 					 or (
-						 $this->getUser('password') === $this->getInput('ZWII_USER_PASSWORD')
+						 $this->isConnected() === true
 						 and
 						 $this->getUser('group') * self::MAX_PROFILS + $this->getUser('profil')) >= ($this->getData(['page', $pageId, 'group']) * self::MAX_PROFILS + $this->getData(['page', $pageId, 'profil'])
  
@@ -1028,6 +1028,13 @@ class common
 
 	}
 
+		/**
+	 * @return bool l'utilisateur est connecté true sinon false
+	 */ 
+	public function isConnected() {
+		return ($this->getUser('authKey') === $this->getInput('ZWII_AUTH_KEY'));
+	}
+
 	/**
 	 * Check qu'une valeur est transmise par la méthode _POST
 	 * @return bool
diff --git a/core/layout/main.php b/core/layout/main.php
index db25adc7..e3932c4e 100644
--- a/core/layout/main.php
+++ b/core/layout/main.php
@@ -54,7 +54,7 @@
 		if (
 			$this->getData(['theme', 'menu', 'position']) === 'top'
 			and $this->getData(['theme', 'menu', 'fixed']) === true
-			and $this->getUser('password') === $this->getInput('ZWII_USER_PASSWORD')
+			and $this->isConnected() === true
 			and $this->getUser('group') > self::GROUP_MEMBER
 		) {
 			echo '<nav id="navfixedconnected" >';
diff --git a/core/module/user/user.php b/core/module/user/user.php
index 4e5ebe26..7c8fd109 100644
--- a/core/module/user/user.php
+++ b/core/module/user/user.php
@@ -1045,19 +1045,29 @@ class user extends common
 					// RAZ
 					$this->setData(['user', $userId, 'connectFail', 0]);
 					$this->setData(['user', $userId, 'connectTimeout', 0]);
-					
+
+					// Clé d'authenfication
+					$authKey = uniqid('', true) . bin2hex(random_bytes(8));
+					$this->setData(['user', $userId, 'authKey', $authKey]);
+
 					// Validité du cookie
 					$expire = $this->getInput('userLoginLongTime', helper::FILTER_BOOLEAN) === true ? strtotime("+1 year") : 0;
 					switch ($this->getInput('userLoginLongTime', helper::FILTER_BOOLEAN)) {
 						case false:
 							// Cookie de session
 							setcookie('ZWII_USER_ID', $userId, $expire, helper::baseUrl(false, false), '', helper::isHttps(), true);
-							setcookie('ZWII_USER_PASSWORD', $this->getData(['user', $userId, 'password']), $expire, helper::baseUrl(false, false), '', helper::isHttps(), true);
+							//setcookie('ZWII_USER_PASSWORD', $this->getData(['user', $userId, 'password']), $expire, helper::baseUrl(false, false), '', helper::isHttps(), true);
+
+							// Connexion par clé							
+							setcookie('ZWII_AUTH_KEY', $authKey, $expire, helper::baseUrl(false, false), '', helper::isHttps(), true);
 							break;
 						default:
 							// Cookie persistant
 							setcookie('ZWII_USER_ID', $userId, $expire, helper::baseUrl(false, false));
-							setcookie('ZWII_USER_PASSWORD', $this->getData(['user', $userId, 'password']), $expire, helper::baseUrl(false, false));
+							//setcookie('ZWII_USER_PASSWORD', $this->getData(['user', $userId, 'password']), $expire, helper::baseUrl(false, false));
+
+							// Connexion par clé
+							setcookie('ZWII_AUTH_KEY', $authKey, $expire, helper::baseUrl(false, false));
 							break;
 					}
 
@@ -1136,7 +1146,9 @@ class user extends common
 	public function logout()
 	{
 		helper::deleteCookie('ZWII_USER_ID');
-		helper::deleteCookie('ZWII_USER_PASSWORD');
+		//helper::deleteCookie('ZWII_USER_PASSWORD');
+		helper::deleteCookie('ZWII_AUTH_KEY');
+		$this->setData(['user', $this->getUser('id'), 'authKey', '']);
 
 		// Détruit la session
 		session_destroy();
diff --git a/module/blog/blog.php b/module/blog/blog.php
index 4417a92e..257ca8f8 100755
--- a/module/blog/blog.php
+++ b/module/blog/blog.php
@@ -749,7 +749,7 @@ class blog extends common
 				) {
 					// Check la captcha
 					if (
-						$this->getUser('password') !== $this->getInput('ZWII_USER_PASSWORD')
+						$this->isConnected() === false
 						//AND $this->getInput('blogArticlecaptcha', helper::FILTER_INT) !== $this->getInput('blogArticlecaptchaFirstNumber', helper::FILTER_INT) + $this->getInput('blogArticlecaptchaSecondNumber', helper::FILTER_INT))
 						and password_verify($this->getInput('blogArticleCaptcha', helper::FILTER_INT), $this->getInput('blogArticleCaptchaResult')) === false
 					) {
@@ -831,7 +831,7 @@ class blog extends common
 				// Signature de l'article
 				self::$articleSignature = $this->signature($this->getData(['module', $this->getUrl(0), 'posts', $this->getUrl(1), 'userId']));
 				// Signature du commentaire édité
-				if ($this->getUser('password') === $this->getInput('ZWII_USER_PASSWORD')) {
+				if ($this->isConnected() === true) {
 					self::$editCommentSignature = $this->signature($this->getUser('id'));
 				}
 				// Commentaires en fonction de la pagination
diff --git a/module/blog/view/article/article.php b/module/blog/view/article/article.php
index 9eef66e4..6f4eb217 100755
--- a/module/blog/view/article/article.php
+++ b/module/blog/view/article/article.php
@@ -25,7 +25,7 @@
 		<?php echo helper::dateUTF8($module::$dateFormat, $this->getData(['module', $this->getUrl(0), 'posts', $this->getUrl(1), 'publishedOn']), self::$i18nUI) . ' ' . helper::dateUTF8($module::$timeFormat, $this->getData(['module', $this->getUrl(0), 'posts', $this->getUrl(1), 'publishedOn']), self::$i18nUI); ?>
 		<!-- Bloc edition -->
 		<?php if (
-			$this->getUser('password') === $this->getInput('ZWII_USER_PASSWORD')
+			$this->isConnected() === true
 			and
 			(  // Propriétaire
 				($this->getData(['module', $this->getUrl(0), 'posts', $this->getUrl(1), 'editConsent']) === $module::EDIT_OWNER
@@ -88,7 +88,7 @@
 		'readonly' => true
 	]); ?>
 	<div id="blogArticleCommentWrapper" class="displayNone">
-		<?php if ($this->getUser('password') === $this->getInput('ZWII_USER_PASSWORD')): ?>
+		<?php if ($this->isConnected() === true): ?>
 			<?php echo template::text('blogArticleUserName', [
 				'label' => 'Nom',
 				'readonly' => true,
@@ -122,7 +122,7 @@
 			'maxlength' => $this->getData(['module', $this->getUrl(0), 'posts', $this->getUrl(1), 'commentMaxlength'])
 		]); ?>
 		<div id="blogArticleContentAlarm"> </div>
-		<?php if ($this->getUser('password') !== $this->getInput('ZWII_USER_PASSWORD')): ?>
+		<?php if ($this->isConnected() === false): ?>
 			<div class="row">
 				<div class="col12">
 					<?php echo template::captcha('blogArticleCaptcha', [
diff --git a/module/blog/view/index/index.php b/module/blog/view/index/index.php
index 691aed74..c4d81860 100755
--- a/module/blog/view/index/index.php
+++ b/module/blog/view/index/index.php
@@ -51,7 +51,7 @@
 						<div class="col6 blogEdit">
 							<!-- Bloc edition -->
 							<?php if (
-								$this->getUser('password') === $this->getInput('ZWII_USER_PASSWORD')
+								$this->isConnected() === true
 								and
 								( // Propriétaire
 									($this->getData(['module', $this->getUrl(0), 'posts', $articleId, 'editConsent']) === $module::EDIT_OWNER
diff --git a/module/news/view/article/article.php b/module/news/view/article/article.php
index b143be50..1567e530 100644
--- a/module/news/view/article/article.php
+++ b/module/news/view/article/article.php
@@ -19,7 +19,7 @@
 		<?php echo helper::dateUTF8('%d %B %Y', $this->getData(['module', $this->getUrl(0), 'posts', $this->getUrl(1), 'publishedOn']), self::$i18nUI) . '&nbsp' . helper::dateUTF8('%H:%M', $this->getData(['module', $this->getUrl(0), 'posts', $this->getUrl(1), 'publishedOn']), self::$i18nUI); ?>
 		<!-- Bloc edition -->
 		<?php if (
-			$this->getUser('password') === $this->getInput('ZWII_USER_PASSWORD')
+			$this->isConnected() === true
 			and
 			(  // Propriétaire
 				($this->getUser('group') === self::GROUP_ADMIN)
diff --git a/module/news/view/index/index.php b/module/news/view/index/index.php
index b0649a58..f15d0b0e 100644
--- a/module/news/view/index/index.php
+++ b/module/news/view/index/index.php
@@ -26,7 +26,7 @@
 							<?php echo helper::dateUTF8($module::$dateFormat, $news['publishedOn'], self::$i18nUI) . '&nbsp;' . helper::dateUTF8($module::$timeFormat, $news['publishedOn'], self::$i18nUI); ?>
 							<!-- Bloc edition -->
 							<?php if (
-								$this->getUser('password') === $this->getInput('ZWII_USER_PASSWORD')
+								$this->isConnected() === true
 								and
 								( // Propriétaire
 									($this->getUser('group') === self::GROUP_ADMIN)
diff --git a/module/redirection/redirection.php b/module/redirection/redirection.php
index e96f45fe..edb3ed65 100644
--- a/module/redirection/redirection.php
+++ b/module/redirection/redirection.php
@@ -58,7 +58,7 @@ class redirection extends common
 	{
 		// Message si l'utilisateur peut éditer la page
 		if (
-			$this->getUser('password') === $this->getInput('ZWII_USER_PASSWORD')
+			$this->isConnected() === true
 			&& $this->getUser('group') >= self::GROUP_EDITOR
 			&& $this->getUrl(1) !== 'force'
 		) {