Lanmikeman/chandler
1
1
Fork 0
mirror of https://github.com/openvk/chandler.git synced 2024-11-14 19:19:11 +03:00
Code Issues Projects Releases Packages Wiki Activity

UA and IP checks can now be disabled via extendedValidation option

Browse source
This commit is contained in:
Alma Armas 2021-04-21 11:41:56 +00:00
parent 60bbd5b8b5
commit 586aa99cd6
2 changed files with 10 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
chandler-example.yml
View file

@ -20,4 +20,5 @@ chandler:
security:
secret: ""
csrfProtection: "permissive"
extendedValidation: false
sessionDuration: 14

10
chandler/Security/Authenticator.php
View file

@ -27,6 +27,7 @@ class Authenticator
->table("ChandlerTokens")
->where($data)
->fetch();
if(!$token) {
$this->db->table("ChandlerTokens")->insert($data);
$token = $this->db->table("ChandlerTokens")->where($data)->fetch();
@ -68,9 +69,16 @@ class Authenticator
"token" => $token,
])
->fetch();
if(!$token) return null;
if($token->ip === CONNECTING_IP && $token->ua === $_SERVER["HTTP_USER_AGENT"]) {
$checksPassed = false;
if(CHANDLER_ROOT_CONF["security"]["extendedValidation"])
$checksPassed = $token->ip === CONNECTING_IP && $token->ua === $_SERVER["HTTP_USER_AGENT"];
else
$checksPassed = true;
if($checksPassed) {
$su = $this->session->get("_su");
$user = $this->db->table("ChandlerUsers")->get($su ?? $token->user);
if(!$user) return null;