nok/wms-app
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Complete security audit fixes

Browse Source
This commit is contained in:
Thanakorn S
2026-03-09 14:31:39 +07:00
parent 93d903c4b2
commit 7cb78d013b
33 changed files with 317 additions and 313 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/login/api/engine/back.php
-1
View File
@@ -1,7 +1,6 @@
<?php
session_start();
require '../../../preset.php';
require '../../../assets/utils/db_auth.php';
sleep(1);
app/login/api/engine/login_confirm.php
+20 -49
View File
@@ -1,14 +1,20 @@
<?php
session_start();
require '../../../config.php';
require '../../../preset.php';
require '../../../assets/utils/db_auth.php';
$data["username"] = $_SESSION["login_data"]['username'];
$data["password"] = $_SESSION["login_data"]['password'];
$user_id = $_SESSION["login_user_id"];
$password = md5(trim(strtolower($data["password"])));
$salt_password = md5($user_id."_".trim(strtolower($data["password"])));
// get password
$sth = $pdo1->prepare("select * from user where user_id = :user_id limit 1;");
$sth->execute([
":user_id" => $user_id
]);
$temp = $sth->fetch(PDO::FETCH_ASSOC);
/**
* Validate OTP
@@ -24,7 +30,7 @@
return str_pad(strval($otp), $length, '0', STR_PAD_LEFT);
}
$otp = generateOTP($password);
$otp = generateOTP($temp["password"]);
// time diff between $_SESSION["otpTime"] and now() in minutes
$otp_time = isset($_SESSION['otpTime']) ? (int)$_SESSION['otpTime'] : 0;
@@ -44,55 +50,20 @@
exit(json_encode($answer));
}
// get password
$sth = $pdo1->prepare("select * from user where user_id = {$user_id} limit 1;");
$sth->execute();
$temp = $sth->fetch(PDO::FETCH_ASSOC);
session_regenerate_id(true); // ← fixes session fixation
$_SESSION['csrf_token'] = bin2hex(random_bytes(32)); // ← CSRF token
if( strtolower($data["username"]) == "support" ){
if( $data["password"] == strtolower(substr(md5("trcloud".date("Ymd")),0,4)) ){
$support = true;
}else{
$support = false;
}
}else{
$support = false;
}
/**
* validate password
/**
* Create login session
*/
if((($password == $temp["password"]||$salt_password == $temp["password"]) && strtolower($data["username"]) != "support") || $support == true ){
$_SESSION["login_status"] = 1;
$_SESSION["login_username"] = $temp["username"];
$_SESSION["login_name"] = $temp["name"];
$_SESSION["login_surname"] = $temp["surname"];
$_SESSION["login_company_id"] = $temp["default_company"];
// create user session
if( strtolower($data["username"]) == "support" ){
$s = $pdo1->query("select *, 'info@trcloud.co' as email from user where username='support' limit 1;");
$temp = $s->fetch(PDO::FETCH_ASSOC);
}
/**
* Create login session
*/
$_SESSION["login_status"] = 1;
$_SESSION["login_username"] = $temp["username"];
$_SESSION["login_name"] = $temp["name"];
$_SESSION["login_surname"] = $temp["surname"];
$_SESSION["login_company_id"] = $temp["default_company"];
$answer["success"] = 1;
$answer["message"] = "Login Complete!";
exit(json_encode($answer));
}
else
{
$answer["message"] = "Incorrect Password";
setcookie("u", "", time()-1, "/");
setcookie("h1", "", time()-1, "/");
setcookie("h2", "", time()-1, "/");
exit(json_encode($answer));
}
$answer["success"] = 1;
$answer["success"] = 1;
$answer["message"] = "Login Complete!";
exit(json_encode($answer));
?>
app/login/api/engine/login_otp.php
+3 -14
View File
@@ -1,6 +1,7 @@
<?php
session_start();
require '../../../config.php';
require '../../../preset.php';
require '../../../assets/utils/db_auth.php';
@@ -10,27 +11,15 @@
$user_id = $sth->fetchColumn();
$username = strtolower($data["username"]);
$password = md5(trim(strtolower($data["password"])));
$salt_password = md5($user_id."_".trim(strtolower($data["password"])));
// get password
$sth = $pdo1->prepare("select password from user where username = ? or email = ? limit 1;");
$sth->execute(array($username,$username));
$temp = $sth->fetch(PDO::FETCH_ASSOC);
if( strtolower($data["username"]) == "support" ){
if( $data["password"] == strtolower(substr(md5("trcloud".date("Ymd")),0,4)) ){
$support = true;
}else{
$support = false;
}
}else{
$support = false;
}
/**
* validate password
*/
if((($password == $temp["password"]||$salt_password == $temp["password"]) && strtolower($data["username"]) != "support") || $support == true ){
if(password_verify(trim($data["password"]), $temp["password"])) {
// create user session
if( strtolower($data["username"]) == "support" ){
@@ -150,7 +139,7 @@
return str_pad($result, 6, 'A', STR_PAD_LEFT);
}
$otp = generateOTP($password);
$otp = generateOTP($temp["password"]);
$reference_number = numberToLetters(generateOTP($otp));
app/login/api/engine/request_new_otp.php
+9 -18
View File
@@ -1,37 +1,28 @@
<?php
session_start();
require '../../../config.php';
require '../../../preset.php';
require '../../../assets/utils/db_auth.php';
$data["username"] = $_SESSION["login_data"]['username'];
$data["password"] = $_SESSION["login_data"]['password'];
$user_id = (int)$_SESSION["login_user_id"];
$password = md5(trim(strtolower($data["password"])));
$salt_password = md5($user_id."_".trim(strtolower($data["password"])));
// get password
$sth = $pdo1->prepare("select * from user where user_id = {$user_id} limit 1;");
$sth->execute();
// get password
$sth = $pdo1->prepare("select * from user where user_id = :user_id limit 1;");
$sth->execute([
":user_id" => $user_id
]);
$temp = $sth->fetch(PDO::FETCH_ASSOC);
// user email
$user_email = $temp["email"];
if( strtolower($data["username"]) == "support" ){
if( $data["password"] == strtolower(substr(md5("trcloud".date("Ymd")),0,4)) ){
$support = true;
}else{
$support = false;
}
}else{
$support = false;
}
/**
/**
* validate password
*/
if((($password == $temp["password"]||$salt_password == $temp["password"]) && strtolower($data["username"]) != "support") || $support == true ){
if(password_verify(trim($data["password"]), $temp["password"])) {
/**
* Generate OTP
@@ -63,7 +54,7 @@
return str_pad($result, 6, 'A', STR_PAD_LEFT);
}
$otp = generateOTP($password);
$otp = generateOTP($temp["password"]);
$reference_number = numberToLetters(generateOTP($otp));