public nobgit read

NobMail

Based on mailcow: dockerized

Languages

Repository composition by tracked source files.

PHP

PHP 49% JavaScript 35% HTML 9% CSS 4% Shell 2% Python 1% Lua 0% Perl 0% Ruby 0% SCSS 0%

Create file Wiki Documentation

Clone

https://nobgit.com/orgs/nobgit/nobmail.git

ssh://[email protected]:2222/orgs/nobgit/nobmail.git

Commit

[Web] Important: Do not allow API actions with r/o session key, THANKS TO Samuel Oosterholt

99ab945a

andryyy <[email protected]> 5 years ago

data/web/inc/footer.inc.php   | 7 +++++++
 data/web/inc/triggers.inc.php | 2 +-
 2 files changed, 8 insertions(+), 1 deletion(-)

Diff

diff --git a/data/web/inc/footer.inc.php b/data/web/inc/footer.inc.php
index 8738cc64..caa962fa 100644
--- a/data/web/inc/footer.inc.php
+++ b/data/web/inc/footer.inc.php
@@ -304,5 +304,12 @@ $(document).ready(function() {
 </body>
 </html>
 <?php
+if (isset($_SESSION['mailcow_cc_api'])) {
+  session_regenerate_id(true);
+  session_unset();
+  session_destroy();
+  session_write_close();
+  header("Location: /");
+}
 $stmt = null;
 $pdo = null;
diff --git a/data/web/inc/triggers.inc.php b/data/web/inc/triggers.inc.php
index 8785759a..478bb4bf 100644
--- a/data/web/inc/triggers.inc.php
+++ b/data/web/inc/triggers.inc.php
@@ -93,7 +93,7 @@ if (isset($_SESSION['mailcow_cc_role']) && ($_SESSION['mailcow_cc_role'] == "adm
 		fido2(array("action" => "unset_fido2_key", "post_data" => $_POST));
 	}
 }
-if (isset($_SESSION['mailcow_cc_role']) && $_SESSION['mailcow_cc_role'] == "admin") {
+if (isset($_SESSION['mailcow_cc_role']) && $_SESSION['mailcow_cc_role'] == "admin" && !isset($_SESSION['mailcow_cc_api'])) {
   // TODO: Move file upload to API?
 	if (isset($_POST["submit_main_logo"])) {
     if ($_FILES['main_logo']['error'] == 0) {