joachim/FileRise
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ensure consistent session behavior

Browse Source
This commit is contained in:
Ryan
2025-04-11 22:36:43 -04:00
committed by GitHub
parent 8553efabc1
commit b06c49f213
16 changed files with 49 additions and 62 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
totp_setup.php
View File

@@ -14,10 +14,11 @@ if (!isset($_SESSION['authenticated']) || $_SESSION['authenticated'] !== true) {
exit;
}
// Verify CSRF token provided as a GET parameter.
if (!isset($_GET['csrf']) || $_GET['csrf'] !== $_SESSION['csrf_token']) {
http_response_code(403);
exit;
$headers = array_change_key_case(getallheaders(), CASE_LOWER);
$csrfHeader = isset($headers['x-csrf-token']) ? trim($headers['x-csrf-token']) : '';
if (!isset($_SESSION['csrf_token']) || $csrfHeader !== $_SESSION['csrf_token']) {
respond('error', 403, 'Invalid CSRF token');
}
$username = $_SESSION['username'] ?? '';