diff --git a/config/instance.conf b/config/instance.conf index 1a4ee68..fb727f5 100644 --- a/config/instance.conf +++ b/config/instance.conf @@ -1,5 +1,5 @@ domain_name=threadr.lostcave.ddnss.de -threadr_dir=/ +threadr_dir=/threadr db_username=webstuff db_password=Schei// auf Pa$$w0rter! db_database=web diff --git a/macros/pass2_session.json b/macros/pass2_session.json index 86c7e82..17fc6bd 100644 --- a/macros/pass2_session.json +++ b/macros/pass2_session.json @@ -1,6 +1,6 @@ { -"REQUIRE_LOGIN":"if (!$login) { header(\"Location: https:\/\/%DOMAIN_NAME%/%CONTENT_DIR%\/login\/\\?error=session\"); die(); }", -"NO_CHEAP_SESSION_STEALING":"if (isset($_SESSION['user_id'])) {if ($_SESSION['user_ip']!=$_SERVER['REMOTE_ADDR'] || $_SESSION['user_http_user_agent']!=$_SERVER['HTTP_USER_AGENT']){ $_SESSION = array(); if (ini_get(\"session.use_cookies\")){ $params = session_get_cookie_params(); setcookie(session_name(), '', time() - 42000, $params[\"path\"], $params[\"domain\"], $params[\"secure\"], $params[\"httponly\"]); } session_destroy(); header(\"Location: https://%DOMAIN_NAME%/%CONTENT_DIR%/login/\\?error=session\"); die();}}", +"REQUIRE_LOGIN":"if (!$login) { header(\"Location: https:\/\/%DOMAIN_NAME%%CONTENT_DIR%\/login\/\\?error=session\"); die(); }", +"NO_CHEAP_SESSION_STEALING":"if (isset($_SESSION['user_id'])) {if ($_SESSION['user_ip']!=$_SERVER['REMOTE_ADDR'] || $_SESSION['user_http_user_agent']!=$_SERVER['HTTP_USER_AGENT']){ $_SESSION = array(); if (ini_get(\"session.use_cookies\")){ $params = session_get_cookie_params(); setcookie(session_name(), '', time() - 42000, $params[\"path\"], $params[\"domain\"], $params[\"secure\"], $params[\"httponly\"]); } session_destroy(); header(\"Location: https://%DOMAIN_NAME%%CONTENT_DIR%/login/\\?error=session\"); die();}}", "SET_LOGIN_VARIABLE":"if (isset($_SESSION['user_id'])) { $login = true; } else { $login = false; }", "FORCE_LOGOUT":"$_SESSION = array(); if (ini_get('session.use_cookies')) { $params = session_get_cookie_params(); setcookie(session_name(), '', time() - 42000, $params['path'], $params['domain'], $params['secure'], $params['httponly']);} session_destroy();" } diff --git a/macros/templates/navbar.template b/macros/templates/navbar.template index d59da49..2d0ef1b 100644 --- a/macros/templates/navbar.template +++ b/macros/templates/navbar.template @@ -11,15 +11,15 @@ if (!isset($login)){ echo "\"My\"My\"My\"My\"Home\"\"Home\"\"Home\"\"Home\""; diff --git a/src/login/redirect.php b/src/login/redirect.php index 882b2fe..3560bfc 100644 --- a/src/login/redirect.php +++ b/src/login/redirect.php @@ -15,15 +15,15 @@ if ($statement->rowCount() > 0) { // IP and user agent string are used to prevent cheap session stealing $_SESSION['user_ip'] = $_SERVER['REMOTE_ADDR']; $_SESSION['user_http_user_agent'] = $_SERVER['HTTP_USER_AGENT']; - header("Location: https://%DOMAIN_NAME%/%CONTENT_DIR%/userhome/"); + header("Location: https://%DOMAIN_NAME%%CONTENT_DIR%/userhome/"); } else { //password inorrect - header("Location: https://%DOMAIN_NAME%/%CONTENT_DIR%/login/?error=credentials"); + header("Location: https://%DOMAIN_NAME%%CONTENT_DIR%/login/?error=credentials"); die(); } } else { //wrong user name - header("Location: https://%DOMAIN_NAME%/%CONTENT_DIR%/login/?error=credentials"); + header("Location: https://%DOMAIN_NAME%%CONTENT_DIR%/login/?error=credentials"); die(); } ?>