Changeset 641 for trunk/dns.cgi

Timestamp:

06/06/14 16:57:46 (11 years ago)

Author:

Kris Deugau

Message:

/trunk

Fix another subtle session bug; if a user disabled *themself*, then used
the Back button somewhere along the line, they could continue to browse.
It's not clear if some aspect of this could be abused to view data without
ever having been logged in.

File:

• trunk/dns.cgi (modified) (2 diffs)

trunk/dns.cgi

@@ -97 +97 @@
         or die CGI::Session->errstr();
 
-if (!$sid || $session->is_expired) {
+if (!$sid || $session->is_expired || !$session->param('uid') || !$dnsdb->userStatus($session->param('uid')) ) {
   $webvar{page} = 'login';
 } else {
@@ -1234 +1234 @@
         ($permissions{self_edit} && $webvar{id} == $session->param('uid')) )) {
       my $stat = $dnsdb->userStatus($webvar{id}, $webvar{userstatus});
+      # kick user out if user disabled self
+      # arguably there should be a more specific error message for this case
+      changepage(page=> 'login', sessexpired => 1) if $webvar{id} == $session->param('uid');
       $page->param(resultmsg => $DNSDB::resultstr);
     } else {