Lanmikeman/chandler
1
1
Fork 0
mirror of https://github.com/openvk/chandler.git synced 2025-01-22 15:24:15 +03:00
Code Issues Projects Releases Packages Wiki Activity

UA and IP checks can now be disabled via extendedValidation option

Browse source
This commit is contained in:
Alma Armas 2021-04-21 11:41:56 +00:00
parent 60bbd5b8b5
commit 586aa99cd6
2 changed files with 10 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
chandler-example.yml
View file

@ -20,4 +20,5 @@ chandler:
security: security:
secret: "" secret: ""
csrfProtection: "permissive" csrfProtection: "permissive"
extendedValidation: false
sessionDuration: 14 sessionDuration: 14

10
chandler/Security/Authenticator.php
View file

@ -27,6 +27,7 @@ class Authenticator
->table("ChandlerTokens") ->table("ChandlerTokens")
->where($data) ->where($data)
->fetch(); ->fetch();
if(!$token) { if(!$token) {
$this->db->table("ChandlerTokens")->insert($data); $this->db->table("ChandlerTokens")->insert($data);
$token = $this->db->table("ChandlerTokens")->where($data)->fetch(); $token = $this->db->table("ChandlerTokens")->where($data)->fetch();
@ -68,9 +69,16 @@ class Authenticator
"token" => $token, "token" => $token,
]) ])
->fetch(); ->fetch();
if(!$token) return null; if(!$token) return null;
if($token->ip === CONNECTING_IP && $token->ua === $_SERVER["HTTP_USER_AGENT"]) { $checksPassed = false;
if(CHANDLER_ROOT_CONF["security"]["extendedValidation"])
$checksPassed = $token->ip === CONNECTING_IP && $token->ua === $_SERVER["HTTP_USER_AGENT"];
else
$checksPassed = true;
if($checksPassed) {
$su = $this->session->get("_su"); $su = $this->session->get("_su");
$user = $this->db->table("ChandlerUsers")->get($su ?? $token->user); $user = $this->db->table("ChandlerUsers")->get($su ?? $token->user);
if(!$user) return null; if(!$user) return null;