diff --git a/system/autoload/Admin.php b/system/autoload/Admin.php
index d6b51718..8275d3b3 100644
--- a/system/autoload/Admin.php
+++ b/system/autoload/Admin.php
@@ -47,18 +47,18 @@ class Admin
if (sha1("$tmp[0].$tmp[1].$db_pass") == $tmp[2]) {
// Validate the token in the cookie
$isValid = self::validateToken($tmp[0], $_COOKIE['aid']);
- if (!$isValid) {
+ if (!empty($_COOKIE['aid']) && !$isValid) {
self::removeCookie();
_alert(Lang::T('Token has expired. Please log in again.'), 'danger', "admin");
return 0;
- }
-
- if (time() - $tmp[1] < 86400 * 7) {
- $_SESSION['aid'] = $tmp[0];
- if ($enable_session_timeout) {
- $_SESSION['aid_expiration'] = time() + $session_timeout_duration;
+ } else {
+ if (time() - $tmp[1] < 86400 * 7) {
+ $_SESSION['aid'] = $tmp[0];
+ if ($enable_session_timeout) {
+ $_SESSION['aid_expiration'] = time() + $session_timeout_duration;
+ }
+ return $tmp[0];
}
- return $tmp[0];
}
}
}
@@ -77,13 +77,11 @@ class Admin
// Detect the current protocol
$isSecure = !empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off';
- $serverHost = $_SERVER['HTTP_HOST'];
- $app_stage = ($serverHost === 'localhost') ? '' : APP_URL;
// Set cookie with security flags
setcookie('aid', $token, [
'expires' => time() + 86400 * 7, // 7 days
'path' => '/',
- 'domain' => $app_stage,
+ 'domain' => '',
'secure' => $isSecure,
'httponly' => true,
'samesite' => 'Lax', // or Strict
@@ -108,12 +106,10 @@ class Admin
global $_app_stage;
if (isset($_COOKIE['aid'])) {
$isSecure = !empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off';
- $serverHost = $_SERVER['HTTP_HOST'];
- $app_stage = ($serverHost === 'localhost') ? '' : APP_URL;
setcookie('aid', '', [
'expires' => time() - 3600,
'path' => '/',
- 'domain' => $app_stage,
+ 'domain' => '',
'secure' => $isSecure,
'httponly' => true,
'samesite' => 'Lax',
diff --git a/system/controllers/accounts.php b/system/controllers/accounts.php
index 596c6e71..29e76e1b 100644
--- a/system/controllers/accounts.php
+++ b/system/controllers/accounts.php
@@ -18,11 +18,17 @@ switch ($action) {
case 'change-password':
run_hook('customer_view_change_password'); #HOOK
+ $csrf_token = Csrf::generateAndStoreToken();
+ $ui->assign('csrf_token', $csrf_token);
$ui->display('customer/change-password.tpl');
break;
case 'change-password-post':
$password = _post('password');
+ $csrf_token = _post('csrf_token');
+ if (!Csrf::check($csrf_token)) {
+ r2(U . 'accounts/change-password', 'e', Lang::T('Invalid or Expired CSRF Token') . ".");
+ }
run_hook('customer_change_password'); #HOOK
if ($password != '') {
$d_pass = $user['password'];
@@ -67,9 +73,15 @@ switch ($action) {
case 'profile':
run_hook('customer_view_edit_profile'); #HOOK
+ $csrf_token = Csrf::generateAndStoreToken();
+ $ui->assign('csrf_token', $csrf_token);
$ui->display('customer/profile.tpl');
break;
case 'edit-profile-post':
+ $csrf_token = _post('csrf_token');
+ if (!Csrf::check($csrf_token)) {
+ r2(U . 'accounts/profile', 'e', Lang::T('Invalid or Expired CSRF Token') . ".");
+ }
$fullname = _post('fullname');
$address = _post('address');
$email = _post('email');
@@ -100,11 +112,17 @@ switch ($action) {
case 'phone-update':
+ $csrf_token = Csrf::generateAndStoreToken();
+ $ui->assign('csrf_token', $csrf_token);
$ui->assign('new_phone', $_SESSION['new_phone']);
$ui->display('customer/phone-update.tpl');
break;
case 'phone-update-otp':
+ $csrf_token = _post('csrf_token');
+ if (!Csrf::check($csrf_token)) {
+ r2(U . 'accounts/phone-update', 'e', Lang::T('Invalid or Expired CSRF Token') . ".");
+ }
$phone = Lang::phoneFormat(_post('phone'));
$username = $user['username'];
$otpPath = $CACHE_PATH . '/sms/';
@@ -152,6 +170,10 @@ switch ($action) {
break;
case 'phone-update-post':
+ $csrf_token = _post('csrf_token');
+ if (!Csrf::check($csrf_token)) {
+ r2(U . 'accounts/phone-update', 'e', Lang::T('Invalid or Expired CSRF Token') . ".");
+ }
$phone = Lang::phoneFormat(_post('phone'));
$otp_code = _post('otp');
$username = $user['username'];
@@ -210,10 +232,16 @@ switch ($action) {
break;
case 'email-update':
+ $csrf_token = Csrf::generateAndStoreToken();
+ $ui->assign('csrf_token', $csrf_token);
$ui->assign('new_email', $_SESSION['new_email']);
$ui->display('customer/email-update.tpl');
break;
case 'email-update-otp':
+ $csrf_token = _post('csrf_token');
+ if (!Csrf::check($csrf_token)) {
+ r2(U . 'accounts/email-update', 'e', Lang::T('Invalid or Expired CSRF Token') . ".");
+ }
$email = trim(_post('email'));
$username = $user['username'];
$otpPath = $CACHE_PATH . '/email/';
@@ -255,6 +283,10 @@ switch ($action) {
break;
case 'email-update-post':
+ $csrf_token = _post('csrf_token');
+ if (!Csrf::check($csrf_token)) {
+ r2(U . 'accounts/email-update', 'e', Lang::T('Invalid or Expired CSRF Token') . ".");
+ }
$email = trim(_post('email'));
$otp_code = _post('otp');
$username = $user['username'];
diff --git a/ui/ui/customer/change-password.tpl b/ui/ui/customer/change-password.tpl
index ae15b564..9b07ca78 100644
--- a/ui/ui/customer/change-password.tpl
+++ b/ui/ui/customer/change-password.tpl
@@ -7,6 +7,7 @@
{Lang::T('Change Password')}