kevinowino869/mitrobill
1
0
Fork 1
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

Testing CSRF from admin login, if works well then we will make it official

Browse Source
This commit is contained in:
Focuslinkstech 2024-10-09 17:13:25 +01:00 committed by Ibnu Maksum
parent bd30261e84
commit 99e8b20bb3
No known key found for this signature in database
GPG Key ID: 7FC82848810579E5
2 changed files with 18 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
system/controllers/admin.php
View File

@ -5,12 +5,12 @@
* by https://t.me/ibnux * by https://t.me/ibnux
**/ **/
header("Cache-Control: no-store, no-cache, must-revalidate, max-age=0"); header("Cache-Control: no-store, no-cache, must-revalidate, max-age=0");
header("Expires: Tue, 01 Jan 2000 00:00:00 GMT"); header("Expires: Tue, 01 Jan 2000 00:00:00 GMT");
header("Pragma: no-cache"); header("Pragma: no-cache");
if(Admin::getID()){ if (Admin::getID()) {
r2(U.'dashboard', "s", Lang::T("You are already logged in")); r2(U . 'dashboard', "s", Lang::T("You are already logged in"));
} }
if (isset($routes['1'])) { if (isset($routes['1'])) {
@ -23,6 +23,11 @@ switch ($do) {
case 'post': case 'post':
$username = _post('username'); $username = _post('username');
$password = _post('password'); $password = _post('password');
//csrf token
$csrf_token = _post('csrf_token');
if (!Csrf::check($csrf_token)) {
_alert(Lang::T('Invalid CSRF Token') . ".", 'danger', "admin");
}
run_hook('admin_login'); #HOOK run_hook('admin_login'); #HOOK
if ($username != '' and $password != '') { if ($username != '' and $password != '') {
$d = ORM::for_table('tbl_users')->where('username', $username)->find_one(); $d = ORM::for_table('tbl_users')->where('username', $username)->find_one();
@ -36,26 +41,28 @@ switch ($do) {
_log($username . ' ' . Lang::T('Login Successful'), $d['user_type'], $d['id']); _log($username . ' ' . Lang::T('Login Successful'), $d['user_type'], $d['id']);
if ($isApi) { if ($isApi) {
if ($token) { if ($token) {
showResult(true, Lang::T('Login Successful'), ['token' => "a.".$token]); showResult(true, Lang::T('Login Successful'), ['token' => "a." . $token]);
} else { } else {
showResult(false, Lang::T('Invalid Username or Password')); showResult(false, Lang::T('Invalid Username or Password'));
} }
} }
_alert(Lang::T('Login Successful'),'success', "dashboard"); _alert(Lang::T('Login Successful'), 'success', "dashboard");
} else { } else {
_log($username . ' ' . Lang::T('Failed Login'), $d['user_type']); _log($username . ' ' . Lang::T('Failed Login'), $d['user_type']);
_alert(Lang::T('Invalid Username or Password').".",'danger', "admin"); _alert(Lang::T('Invalid Username or Password') . ".", 'danger', "admin");
} }
} else { } else {
_alert(Lang::T('Invalid Username or Password')."..",'danger', "admin"); _alert(Lang::T('Invalid Username or Password') . "..", 'danger', "admin");
} }
} else { } else {
_alert(Lang::T('Invalid Username or Password')."...",'danger', "admin"); _alert(Lang::T('Invalid Username or Password') . "...", 'danger', "admin");
} }
break; break;
default: default:
run_hook('view_login'); #HOOK run_hook('view_login'); #HOOK
$csrf_token = Csrf::generateAndStoreToken();
$ui->assign('csrf_token', $csrf_token);
$ui->display('admin-login.tpl'); $ui->display('admin-login.tpl');
break; break;
} }

1
ui/ui/admin-login.tpl
View File

@ -24,6 +24,7 @@
{$notify} {$notify}
{/if} {/if}
<form action="{$_url}admin/post" method="post"> <form action="{$_url}admin/post" method="post">
<input type="hidden" name="csrf_token" value="{$csrf_token}">
<div class="form-group has-feedback"> <div class="form-group has-feedback">
<input type="text" required class="form-control" name="username" placeholder="{Lang::T('Username')}"> <input type="text" required class="form-control" name="username" placeholder="{Lang::T('Username')}">
<span class="glyphicon glyphicon-user form-control-feedback"></span> <span class="glyphicon glyphicon-user form-control-feedback"></span>