Skip to content
This repository has been archived by the owner on Dec 13, 2022. It is now read-only.

fix(security): use user id instead of session id in session page #8876

Merged
merged 5 commits into from
Jul 29, 2020
Merged

fix(security): use user id instead of session id in session page #8876

Changes from 1 commit
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
82e308e
fix(sessions): use user id to logout user
jeremyjaouen Jul 27, 2020
2386868
fix(sessions): use contact id in ajax request
jeremyjaouen Jul 28, 2020
f796641
fix(sessions): correctly sanitize and check contactId
jeremyjaouen Jul 28, 2020
3f88d3f
remove commentary
jeremyjaouen Jul 28, 2020
76f8aeb
adapt commentary
jeremyjaouen Jul 28, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 8 additions & 11 deletions www/api/class/centreon_ldap_synchro.class.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -75,15 +75,15 @@ public function postRequestLdapSynchro(): bool
$result = false;

$contactId = filter_var(
$_POST['contactId'] ?? null,
$_POST['contactId'] ?? false,
FILTER_VALIDATE_INT
);

if (!$this->isLdapEnabled()) {
return $result;
}

if (empty($contactId)) {
if ($contactId === false) {
$this->centreonLog->insertLog(
3, //ldap.log
"LDAP MANUAL SYNC : Error - Chosen contact data are missing."
jeremyjaouen marked this conversation as resolved.
Show resolved Hide resolved
Expand All @@ -93,15 +93,12 @@ public function postRequestLdapSynchro(): bool

$this->pearDB->beginTransaction();
try {
// getting the contact name and ID for the logs
if ($contactId) {
// (getting the contactId to homogenize the next request's bindValue variable name)
$resUser = $this->pearDB->prepare(
'SELECT `contact_id`, `contact_name` FROM `contact`
WHERE `contact_id` = :contactId'
);
$resUser->bindValue(':contactId', $contactId, PDO::PARAM_INT);
}
// (getting the contactId to homogenize the next request's bindValue variable name)
jeremyjaouen marked this conversation as resolved.
Show resolved Hide resolved
$resUser = $this->pearDB->prepare(
'SELECT `contact_id`, `contact_name` FROM `contact`
WHERE `contact_id` = :contactId'
);
$resUser->bindValue(':contactId', $contactId, PDO::PARAM_INT);
$resUser->execute();
$contact = $resUser->fetch();

Expand Down