Digitalstack/myaac
2
0
Fork 0
mirror of https://github.com/slawkens/myaac.git synced 2025-05-30 09:24:30 +02:00
Code Issues Packages Projects Releases Wiki Activity

Add new setting/configurable: site_url, prevents domain spoofing

Browse Source
This commit is contained in:
slawkens 2025-05-29 09:27:29 +02:00
parent 52109f5cca
commit d8a6090be3
8 changed files with 67 additions and 29 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

49
common.php
View File

@ -122,38 +122,31 @@ if (!IS_CLI) {
session_start();
}
// basedir
$basedir = '';
$tmp = explode('/', $_SERVER['SCRIPT_NAME']);
$size = count($tmp) - 1;
for($i = 1; $i < $size; $i++)
$basedir .= '/' . $tmp[$i];
$basedir = str_replace(['/' . ADMIN_PANEL_FOLDER, '/install', '/tools'], '', $basedir);
define('BASE_DIR', $basedir);
if(!IS_CLI) {
if (isset($_SERVER['HTTP_HOST'][0])) {
$baseHost = $_SERVER['HTTP_HOST'];
} else {
if (isset($_SERVER['SERVER_NAME'][0])) {
$baseHost = $_SERVER['SERVER_NAME'];
} else {
$baseHost = $_SERVER['SERVER_ADDR'];
}
}
define('SERVER_URL', 'http' . (isHttps() ? 's' : '') . '://' . $baseHost);
define('BASE_URL', SERVER_URL . BASE_DIR . '/');
define('ADMIN_URL', SERVER_URL . BASE_DIR . '/' . ADMIN_PANEL_FOLDER . '/');
//define('CURRENT_URL', BASE_URL . $_SERVER['REQUEST_URI']);
}
if (file_exists(BASE . 'config.local.php')) {
require BASE . 'config.local.php';
}
if(!IS_CLI) {
require SYSTEM . 'base.php';
define('BASE_DIR', $baseDir);
if (isset($config['site_url'])) {
$hasSlashAtEnd = ($config['site_url'][strlen($config['site_url']) - 1] == '/');
define('SERVER_URL', $config['site_url']);
define('BASE_URL', SERVER_URL . ($hasSlashAtEnd ? '' : '/'));
define('ADMIN_URL', SERVER_URL . ($hasSlashAtEnd ? '' : '/') . ADMIN_PANEL_FOLDER . '/');
}
else {
define('SERVER_URL', 'http' . (isHttps() ? 's' : '') . '://' . $baseHost);
define('BASE_URL', SERVER_URL . BASE_DIR . '/');
define('ADMIN_URL', SERVER_URL . BASE_DIR . '/' . ADMIN_PANEL_FOLDER . '/');
//define('CURRENT_URL', BASE_URL . $_SERVER['REQUEST_URI']);
}
}
/** @var array $config */
ini_set('log_errors', 1);
if(@$config['env'] === 'dev' || defined('MYAAC_INSTALL')) {

8
install/steps/4-config.php
View File

@ -10,6 +10,14 @@ foreach($config['clients'] as $client) {
$clients[$client] = $client_version;
}
if (empty($_SESSION['var_site_url'])) {
//require SYSTEM . 'base.php';
$serverUrl = 'http' . (isHttps() ? 's' : '') . '://' . $baseHost;
$siteURL = $serverUrl . $baseDir;
$_SESSION['var_site_url'] = $siteURL;
}
$twig->display('install.config.html.twig', array(
'clients' => $clients,
'timezones' => DateTimeZone::listIdentifiers(),

19
system/base.php Normal file
View File

@ -0,0 +1,19 @@
<?php
$baseDir = '';
$tmp = explode('/', $_SERVER['SCRIPT_NAME']);
$size = count($tmp) - 1;
for($i = 1; $i < $size; $i++)
$baseDir .= '/' . $tmp[$i];
$baseDir = str_replace(['/' . ADMIN_PANEL_FOLDER, '/install', '/tools'], '', $baseDir);
if (isset($_SERVER['HTTP_HOST'][0])) {
$baseHost = $_SERVER['HTTP_HOST'];
} else {
if (isset($_SERVER['SERVER_NAME'][0])) {
$baseHost = $_SERVER['SERVER_NAME'];
} else {
$baseHost = $_SERVER['SERVER_ADDR'];
}
}

2
system/locale/de/install.php
View File

@ -48,6 +48,8 @@ $locale['step_config'] = 'Konfiguration';
$locale['step_config_title'] = 'Grundkonfiguration';
$locale['step_config_server_path'] = 'Serverpfad';
$locale['step_config_server_path_desc'] = 'Pfad zu Ihrem TFS-Hauptverzeichnis, in dem sich die config.lua befinden.';
$locale['step_config_site_url'] = 'Website URL';
$locale['step_config_site_url_desc'] = 'Ihre Website-Adresse.';
$locale['step_config_mail_admin'] = 'Admin E-Mail';
$locale['step_config_mail_admin_desc'] = 'Adresse, an die E-Mails aus dem Kontaktformular gesendet werden, z. B. admin@gmail.com';
$locale['step_config_mail_admin_error'] = 'Admin E-Mail ist nicht korrekt.';

2
system/locale/en/install.php
View File

@ -52,6 +52,8 @@ $locale['step_config'] = 'Configuration';
$locale['step_config_title'] = 'Basic configuration';
$locale['step_config_server_path'] = 'Server path';
$locale['step_config_server_path_desc'] = 'Path to your TFS main directory, where you have config.lua located.';
$locale['step_config_site_url'] = 'Website URL';
$locale['step_config_site_url_desc'] = 'Your website address.';
$locale['step_config_mail_admin'] = 'Admin Email';
$locale['step_config_mail_admin_desc'] = 'Address where emails from contact form will be delivered, for example admin@gmail.com';
$locale['step_config_mail_admin_error'] = 'Admin Email is not correct.';

2
system/locale/pl/install.php
View File

@ -52,6 +52,8 @@ $locale['step_config'] = 'Konfiguracja';
$locale['step_config_title'] = 'Podstawowa konfiguracja';
$locale['step_config_server_path'] = 'Ścieżka do serwera';
$locale['step_config_server_path_desc'] = 'Ścieżka do Twojego folderu z TFS, gdzie znajduje się plik config.lua.';
$locale['step_config_server_url'] = 'Adres strony';
$locale['step_config_server_url_desc'] = 'Adres tej strony www.';
$locale['step_config_mail_admin'] = 'E-Mail admina';
$locale['step_config_mail_admin_desc'] = 'Na ten adres będą dostarczane E-Maile z formularza kontaktowego, przykładowo admin@gmail.com';
$locale['step_config_mail_admin_error'] = 'E-Mail admina jest niepoprawny.';

12
system/settings.php
View File

@ -21,6 +21,11 @@ $defaultTemplate = in_array('kathrine', $templates) ? 'kathrine' : $templates[0]
global $db;
require SYSTEM . 'base.php';
$serverUrl = 'http' . (isHttps() ? 's' : '') . '://' . $baseHost;
$siteURL = $serverUrl . $baseDir;
return [
'name' => 'MyAAC',
'settings' => [
@ -32,6 +37,13 @@ return [
'type' => 'section',
'title' => 'General'
],
'site_url' => [
'name' => 'Website URL',
'type' => 'text',
'desc' => 'Website address of this MyAAC instance',
'default' => $siteURL,
'is_config' => true,
],
'env' => [
'name' => 'App Environment',
'type' => 'options',

2
system/templates/install.config.html.twig
View File

@ -9,7 +9,7 @@
<form action="{{ constant('BASE_URL') }}install/" method="post" autocomplete="off">
<input type="hidden" name="step" id="step" value="database" />
{% for value in ['server_path'] %}
{% for value in ['site_url', 'server_path'] %}
<div class="form-group mb-2">
<label for="vars_{{ value }}">{{ locale['step_config_' ~ value] }}</label>
<input class="form-control" type="{% if value == 'mail_admin' %}email{% else %}text{% endif %}" name="vars[{{ value }}]" id="vars_{{ value }}"{% if session['var_' ~ value] is not null %} value="{{ session['var_' ~ value] }}"{% endif %}/>