includes/session.inc

   1 <?php
   2 /**********************************************************************
   3         Copyright (C) FrontAccounting, LLC.
   4         Released under the terms of the GNU General Public License, GPL,
   5         as published by the Free Software Foundation, either version 3
   6         of the License, or (at your option) any later version.
   7         This program is distributed in the hope that it will be useful,
   8         but WITHOUT ANY WARRANTY; without even the implied warranty of
   9         MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
  10         See the License here <http://www.gnu.org/licenses/gpl-3.0.html>.
  11 ***********************************************************************/
  12 define('VARLIB_PATH', $path_to_root.'/tmp');
  13 define('VARLOG_PATH', $path_to_root.'/tmp');
  14
  15 class SessionManager
  16 {
  17         function sessionStart($name, $limit = 0, $path = '/', $domain = null, $secure = null)
  18         {
  19                 // Set the cookie name
  20                 session_name($name);
  21
  22                 // Set SSL level
  23                 $https = isset($secure) ? $secure : (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off');
  24
  25                 // Set session cookie options
  26                 if (version_compare(PHP_VERSION, '5.2', '<')) // avoid failure on older php versions
  27                         session_set_cookie_params($limit, $path, $domain, $https);
  28                 else
  29                         session_set_cookie_params($limit, $path, $domain, $https, true);
  30
  31                 session_start();
  32
  33                 // Make sure the session hasn't expired, and destroy it if it has
  34                 if ($this->validateSession())
  35                 {
  36                         // Check to see if the session is new or a hijacking attempt
  37                         if(!$this->preventHijacking())
  38                         {
  39                                 // Reset session data and regenerate id
  40                                 $_SESSION = array();
  41                                 $_SESSION['IPaddress'] = $_SERVER['REMOTE_ADDR'];
  42                                 $_SESSION['userAgent'] = @$_SERVER['HTTP_USER_AGENT'];
  43                                 $this->regenerateSession();
  44
  45                         // Give a 5% chance of the session id changing on any request
  46                         }
  47                         elseif (rand(1, 100) <= 5)
  48                         {
  49                                 $this->regenerateSession();
  50                         }
  51                 }
  52                 else
  53                 {
  54                         $_SESSION = array();
  55                         session_destroy();
  56                         session_start();
  57                 }
  58         }
  59
  60         function preventHijacking()
  61         {
  62                 if (!isset($_SESSION['IPaddress']) || !isset($_SESSION['userAgent']))
  63                         return false;
  64
  65                 if ($_SESSION['IPaddress'] != $_SERVER['REMOTE_ADDR'])
  66                         return false;
  67
  68                 if ( $_SESSION['userAgent'] != @$_SERVER['HTTP_USER_AGENT'])
  69                         return false;
  70
  71                 return true;
  72         }
  73
  74         function regenerateSession()
  75         {
  76                 // If this session is obsolete it means there already is a new id
  77                 if (isset($_SESSION['OBSOLETE']) && ($_SESSION['OBSOLETE'] == true))
  78                         return;
  79
  80                 // Set current session to expire in 10 seconds
  81                 $_SESSION['OBSOLETE'] = true;
  82                 $_SESSION['EXPIRES'] = time() + 10;
  83
  84                 // Create new session without destroying the old one
  85                 session_regenerate_id();
  86                 // Grab current session ID and close both sessions to allow other scripts to use them
  87                 $newSession = session_id();
  88                 session_write_close();
  89                 // Set session ID to the new one, and start it back up again
  90
  91                 session_id($newSession);
  92                 session_start();
  93
  94                 // Now we unset the obsolete and expiration values for the session we want to keep
  95                 unset($_SESSION['OBSOLETE']);
  96                 unset($_SESSION['EXPIRES']);
  97         }
  98
  99         function validateSession()
 100         {
 101                 if (isset($_SESSION['OBSOLETE']) && !isset($_SESSION['EXPIRES']) )
 102                         return false;
 103
 104                 if (isset($_SESSION['EXPIRES']) && $_SESSION['EXPIRES'] < time())
 105                         return false;
 106
 107                 return true;
 108         }
 109 }
 110
 111 function output_html($text)
 112 {
 113         global $before_box, $Ajax, $messages;
 114         // Fatal errors are not send to error_handler,
 115         // so we must check the output
 116         if ($text && preg_match('/\bFatal error(<.*?>)?:(.*)/i', $text, $m)) {
 117                 $Ajax->aCommands = array();  // Don't update page via ajax on errors
 118                 $text = preg_replace('/\bFatal error(<.*?>)?:(.*)/i','', $text);
 119                 $messages[] = array(E_ERROR, $m[2], null, null);
 120         }
 121         $Ajax->run();
 122         return  in_ajax() ? fmt_errors() : ($before_box.fmt_errors().$text);
 123 }
 124 //----------------------------------------------------------------------------------------
 125
 126 function kill_login()
 127 {
 128         session_unset();
 129         session_destroy();
 130 }
 131 //----------------------------------------------------------------------------------------
 132
 133 function login_fail()
 134 {
 135         global $path_to_root;
 136
 137         header("HTTP/1.1 401 Authorization Required");
 138         echo "<center><br><br><font size='5' color='red'><b>" . _("Incorrect Password") . "<b></font><br><br>";
 139         echo "<b>" . _("The user and password combination is not valid for the system.") . "<b><br><br>";
 140         echo _("If you are not an authorized user, please contact your system administrator to obtain an account to enable you to use the system.");
 141         echo "<br><a href='$path_to_root/index.php'>" . _("Try again") . "</a>";
 142         echo "</center>";
 143         kill_login();
 144         die();
 145 }
 146
 147 function password_reset_fail()
 148 {
 149         global $path_to_root;
 150
 151         echo "<center><br><br><font size='5' color='red'><b>" . _("Incorrect Email") . "<b></font><br><br>";
 152         echo "<b>" . _("The email address does not exist in the system, or is used by more than one user.") . "<b><br><br>";
 153
 154         echo _("Plase try again or contact your system administrator to obtain new password.");
 155         echo "<br><a href='$path_to_root/index.php?reset=1'>" . _("Try again") . "</a>";
 156         echo "</center>";
 157
 158         kill_login();
 159         die();
 160 }
 161
 162 function password_reset_success()
 163 {
 164         global $path_to_root;
 165
 166         echo "<center><br><br><font size='5' color='green'><b>" . _("New password sent") . "<b></font><br><br>";
 167         echo "<b>" . _("A new password has been sent to your mailbox.") . "<b><br><br>";
 168
 169         echo "<br><a href='$path_to_root/index.php'>" . _("Login here") . "</a>";
 170         echo "</center>";
 171
 172         kill_login();
 173         die();
 174 }
 175
 176 function check_faillog()
 177 {
 178         global $SysPrefs, $login_faillog;
 179
 180         $user = $_SESSION["wa_current_user"]->user;
 181
 182         $_SESSION["wa_current_user"]->login_attempt++;
 183         if (@$SysPrefs->login_delay && (@$login_faillog[$user][$_SERVER['REMOTE_ADDR']] >= @$SysPrefs->login_max_attempts) && (time() < $login_faillog[$user]['last'] + $SysPrefs->login_delay))
 184                 return true;
 185
 186         return false;
 187 }
 188
 189 /*
 190         Ensure file is re-read on next request if php caching is active
 191 */
 192 function cache_invalidate($filename)
 193 {
 194         if (function_exists('opcache_invalidate'))      // OpCode extension
 195                 opcache_invalidate($filename);
 196 }
 197
 198 /*
 199         Simple brute force attack detection is performed before connection to company database is open. Therefore access counters have to be stored in file.
 200         Login attempts counter is created for every new user IP, which partialy prevent DOS attacks.
 201 */
 202 function write_login_filelog($login, $result)
 203 {
 204         global $login_faillog, $SysPrefs, $path_to_root;
 205
 206         $user = $_SESSION["wa_current_user"]->user;
 207
 208         $ip = $_SERVER['REMOTE_ADDR'];
 209
 210         if (!isset($login_faillog[$user][$ip]) || $result) // init or reset on successfull login
 211                 $login_faillog[$user] = array($ip => 0, 'last' => '');
 212
 213         if (!$result)
 214         {
 215                 if ($login_faillog[$user][$ip] < @$SysPrefs->login_max_attempts) {
 216
 217                         $login_faillog[$user][$ip]++;
 218                 } else {
 219                         $login_faillog[$user][$ip] = 0; // comment out to restart counter only after successfull login.
 220                         error_log(sprintf(_("Brute force attack on account '%s' detected. Access for non-logged users temporarily blocked."     ), $login));
 221                 }
 222                 $login_faillog[$user]['last'] = time();
 223         }
 224
 225         $msg = "<?php\n";
 226         $msg .= "/*\n";
 227         $msg .= "Login attempts info.\n";
 228         $msg .= "*/\n";
 229         $msg .= "\$login_faillog = " .var_export($login_faillog, true). ";\n";
 230
 231         $filename = VARLIB_PATH."/faillog.php";
 232
 233         if ((!file_exists($filename) && is_writable(VARLIB_PATH)) || is_writable($filename))
 234         {
 235                 file_put_contents($filename, $msg);
 236                 cache_invalidate($filename);
 237         }
 238 }
 239
 240 //----------------------------------------------------------------------------------------
 241
 242 function check_page_security($page_security)
 243 {
 244         global $SysPrefs;
 245
 246         $msg = '';
 247
 248         if (!$_SESSION["wa_current_user"]->check_user_access())
 249         {
 250                 // notification after upgrade from pre-2.2 version
 251                 $msg = $_SESSION["wa_current_user"]->old_db ?
 252                          _("Security settings have not been defined for your user account.")
 253                                 . "<br>" . _("Please contact your system administrator.")
 254                         : _("Please remove \$security_groups and \$security_headings arrays from config.php file!");
 255         } elseif (!$SysPrefs->db_ok && !$_SESSION["wa_current_user"]->can_access('SA_SOFTWAREUPGRADE'))
 256         {
 257                 $msg = _('Access to application has been blocked until database upgrade is completed by system administrator.');
 258         }
 259
 260         if ($msg){
 261                 display_error($msg);
 262                 end_page(@$_REQUEST['popup']);
 263                 kill_login();
 264                 exit;
 265         }
 266
 267         if (!$_SESSION["wa_current_user"]->can_access_page($page_security))
 268         {
 269
 270                 echo "<center><br><br><br><b>";
 271                 echo _("The security settings on your account do not permit you to access this function");
 272                 echo "</b>";
 273                 echo "<br><br><br><br></center>";
 274                 end_page(@$_REQUEST['popup']);
 275                 exit;
 276         }
 277         if (!$SysPrefs->db_ok
 278                 && !in_array($page_security, array('SA_SOFTWAREUPGRADE', 'SA_OPEN', 'SA_BACKUP')))
 279         {
 280                 display_error(_('System is blocked after source upgrade until database is updated on System/Software Upgrade page'));
 281                 end_page();
 282                 exit;
 283         }
 284
 285 }
 286 /*
 287         Helper function for setting page security level depeding on
 288         GET start variable and/or some value stored in session variable.
 289         Before the call $page_security should be set to default page_security value.
 290 */
 291 function set_page_security($value=null, $trans = array(), $gtrans = array())
 292 {
 293         global $page_security;
 294
 295         // first check is this is not start page call
 296         foreach($gtrans as $key => $area)
 297                 if (isset($_GET[$key])) {
 298                         $page_security = $area;
 299                         return;
 300                 }
 301
 302         // then check session value
 303         if (isset($trans[$value])) {
 304                 $page_security = $trans[$value];
 305                 return;
 306         }
 307 }
 308
 309 //-----------------------------------------------------------------------------
 310 //      Removing magic quotes from nested arrays/variables
 311 //
 312 function strip_quotes($data)
 313 {
 314         if(version_compare(phpversion(), '5.4', '<') && get_magic_quotes_gpc()) {
 315                 if(is_array($data)) {
 316                         foreach($data as $k => $v) {
 317                                 $data[$k] = strip_quotes($data[$k]);
 318                         }
 319                 } else
 320                         return stripslashes($data);
 321         }
 322         return $data;
 323 }
 324
 325 /*
 326         htmlspecialchars does not support certain encodings.
 327         ISO-8859-2 fortunately has the same special characters positions as
 328         ISO-8859-1, so fix is easy. If any other unsupported encoding is used,
 329         add workaround here.
 330 */
 331 function html_specials_encode($str)
 332 {
 333         return htmlspecialchars($str, ENT_QUOTES, $_SESSION['language']->encoding=='iso-8859-2' ?
 334                  'ISO-8859-1' : $_SESSION['language']->encoding);
 335 }
 336
 337 function html_cleanup(&$parms)
 338 {
 339         foreach($parms as $name => $value) {
 340                 if (is_array($value))
 341                         html_cleanup($parms[$name]);
 342                 else
 343                         $parms[$name] = html_specials_encode($value);
 344         }
 345         reset($parms); // needed for direct key() usage later throughout the sources
 346 }
 347
 348 //============================================================================
 349 //
 350 //
 351 function login_timeout()
 352 {
 353         // skip timeout on logout page
 354         if ($_SESSION["wa_current_user"]->logged) {
 355                 $tout = $_SESSION["wa_current_user"]->timeout;
 356                 if ($tout && (time() > $_SESSION["wa_current_user"]->last_act + $tout))
 357                 {
 358                         $_SESSION["wa_current_user"]->logged = false;
 359                 }
 360                 $_SESSION["wa_current_user"]->last_act = time();
 361         }
 362 }
 363 //============================================================================
 364 if (!isset($path_to_root))
 365 {
 366         $path_to_root = ".";
 367 }
 368
 369 // Prevent register_globals vulnerability
 370 if (isset($_GET['path_to_root']) || isset($_POST['path_to_root']))
 371         die("Restricted access");
 372
 373 include_once($path_to_root . "/includes/errors.inc");
 374 // colect all error msgs
 375 set_error_handler('error_handler' /*, errtypes */);
 376 set_exception_handler('exception_handler');
 377
 378 include_once($path_to_root . "/includes/current_user.inc");
 379 include_once($path_to_root . "/frontaccounting.php");
 380 include_once($path_to_root . "/admin/db/security_db.inc");
 381 include_once($path_to_root . "/includes/lang/language.inc");
 382 include_once($path_to_root . "/config_db.php");
 383 include_once($path_to_root . "/includes/ajax.inc");
 384 include_once($path_to_root . "/includes/ui/ui_msgs.inc");
 385 include_once($path_to_root . "/includes/prefs/sysprefs.inc");
 386
 387 include_once($path_to_root . "/includes/hooks.inc");
 388 //
 389 // include all extensions hook files.
 390 //
 391 foreach ($installed_extensions as $ext)
 392 {
 393         if (file_exists($path_to_root.'/'.$ext['path'].'/hooks.php'))
 394                 include_once($path_to_root.'/'.$ext['path'].'/hooks.php');
 395 }
 396
 397 ini_set('session.gc_maxlifetime', 36000); // moved from below.
 398
 399 $Session_manager = new SessionManager();
 400 $Session_manager->sessionStart('FA'.md5(dirname(__FILE__)));
 401
 402 $_SESSION['SysPrefs'] = new sys_prefs();
 403
 404 $SysPrefs = &$_SESSION['SysPrefs'];
 405
 406 //----------------------------------------------------------------------------------------
 407 // set to reasonable values if not set in config file (pre-2.3.12 installations)
 408
 409 if ((!isset($SysPrefs->login_delay)) || ($SysPrefs->login_delay < 0))
 410     $SysPrefs->login_delay = 10;
 411
 412 if ((!isset($SysPrefs->login_max_attempts)) || ($SysPrefs->login_max_attempts < 0))
 413     $SysPrefs->login_max_attempts = 3;
 414
 415 if ($SysPrefs->go_debug > 0)
 416         error_reporting(-1);
 417 else
 418         error_reporting(E_USER_WARNING|E_USER_ERROR|E_USER_NOTICE);
 419 ini_set("display_errors", "On");
 420
 421 if ($SysPrefs->error_logfile != '') {
 422         ini_set("error_log", $SysPrefs->error_logfile);
 423         ini_set("ignore_repeated_errors", "On");
 424         ini_set("log_errors", "On");
 425 }
 426
 427 /*
 428         Uncomment the setting below when using FA on shared hosting
 429         to avoid unexpeced session timeouts.
 430         Make sure this directory exists and is writable!
 431 */
 432 // ini_set('session.save_path', VARLIB_PATH.'/');
 433
 434 // ini_set('session.gc_maxlifetime', 36000); // 10hrs - moved to before session_manager
 435
 436 hook_session_start(@$_POST["company_login_name"]);
 437
 438 // this is to fix the "back-do-you-want-to-refresh" issue - thanx PHPFreaks
 439 header("Cache-control: private");
 440
 441 get_text_init();
 442
 443 if ($SysPrefs->login_delay > 0 && file_exists(VARLIB_PATH."/faillog.php"))
 444         include_once(VARLIB_PATH."/faillog.php");
 445
 446 // Page Initialisation
 447 if (!isset($_SESSION['wa_current_user']) || !$_SESSION['wa_current_user']->logged_in()
 448         || !isset($_SESSION['language']) || !method_exists($_SESSION['language'], 'set_language'))
 449 {
 450         $l = array_search_value($dflt_lang, $installed_languages,  'code');
 451         $_SESSION['language'] = new language($l['name'], $l['code'], $l['encoding'],
 452          (isset($l['rtl']) && $l['rtl'] === true) ? 'rtl' : 'ltr');
 453 }
 454
 455 $_SESSION['language']->set_language($_SESSION['language']->code);
 456
 457
 458 include_once($path_to_root . "/includes/access_levels.inc");
 459 include_once($path_to_root . "/version.php");
 460 include_once($path_to_root . "/includes/main.inc");
 461 include_once($path_to_root . "/includes/app_entries.inc");
 462
 463 // Ajax communication object
 464 $Ajax = new Ajax();
 465
 466 // js/php validation rules container
 467 $Validate = array();
 468 // bindings for editors
 469 $Editors = array();
 470 // page help. Currently help for function keys.
 471 $Pagehelp = array();
 472
 473 $Refs = new references();
 474
 475 // intercept all output to destroy it in case of ajax call
 476 register_shutdown_function('end_flush');
 477 ob_start('output_html',0);
 478
 479 if (!isset($_SESSION["wa_current_user"]))
 480         $_SESSION["wa_current_user"] = new current_user();
 481
 482 html_cleanup($_GET);
 483 html_cleanup($_POST);
 484 html_cleanup($_REQUEST);
 485 html_cleanup($_SERVER);
 486
 487 // logout.php is the only page we should have always
 488 // accessable regardless of access level and current login status.
 489 if (!defined('FA_LOGOUT_PHP_FILE')){
 490
 491         login_timeout();
 492
 493         if (!$_SESSION["wa_current_user"]->old_db && file_exists($path_to_root . '/company/'.user_company().'/installed_extensions.php'))
 494                 include($path_to_root . '/company/'.user_company().'/installed_extensions.php');
 495
 496         install_hooks();
 497
 498         if (!$_SESSION["wa_current_user"]->logged_in())
 499         {
 500       if (@$SysPrefs->allow_password_reset && !$SysPrefs->allow_demo_mode
 501         && (isset($_GET['reset']) || isset($_POST['email_entry_field']))) {
 502                   if (!isset($_POST["email_entry_field"])) {
 503         include($path_to_root . "/access/password_reset.php");
 504         exit();
 505       }
 506       else {
 507         if (isset($_POST["company_login_nickname"]) && !isset($_POST["company_login_name"])) {
 508           for ($i = 0; $i < count($db_connections); $i++) {
 509             if ($db_connections[$i]["name"] == $_POST["company_login_nickname"]) {
 510               $_POST["company_login_name"] = $i;
 511               unset($_POST["company_login_nickname"]);
 512               break 1; // cannot pass variables to break from PHP v5.4 onwards
 513             }
 514           }
 515         }
 516         $_succeed = isset($db_connections[$_POST["company_login_name"]]) &&
 517           $_SESSION["wa_current_user"]->reset_password($_POST["company_login_name"],
 518           $_POST["email_entry_field"]);
 519         if ($_succeed)
 520         {
 521           password_reset_success();
 522         }
 523
 524         password_reset_fail();
 525       }
 526     }
 527                 // Show login screen
 528                 if (!isset($_POST["user_name_entry_field"]) or $_POST["user_name_entry_field"] == "")
 529                 {
 530                         // strip ajax marker from uri, to force synchronous page reload
 531                         $_SESSION['timeout'] = array( 'uri'=>preg_replace('/JsHttpRequest=(?:(\d+)-)?([^&]+)/s',
 532                                         '', html_specials_encode($_SERVER['REQUEST_URI'])),
 533                                 'post' => $_POST);
 534                 if (in_ajax())
 535                         $Ajax->popup($path_to_root ."/access/timeout.php");
 536                 else
 537                         include($path_to_root . "/access/login.php");
 538                         exit;
 539                 } else {
 540                         if (isset($_POST["company_login_nickname"]) && !isset($_POST["company_login_name"])) {
 541                                 for ($i = 0; $i < count($db_connections); $i++) {
 542                                         if ($db_connections[$i]["name"] == $_POST["company_login_nickname"]) {
 543                                                 $_POST["company_login_name"] = $i;
 544                                                 unset($_POST["company_login_nickname"]);
 545                                                 break 1; // cannot pass variables to break from PHP v5.4 onwards
 546                                         }
 547                                 }
 548                         }
 549                         $succeed = isset($db_connections[$_POST["company_login_name"]]) &&
 550                                 $_SESSION["wa_current_user"]->login($_POST["company_login_name"],
 551                                 $_POST["user_name_entry_field"], $_POST["password"]);
 552                         // select full vs fallback ui mode on login
 553                         $_SESSION["wa_current_user"]->ui_mode = $_POST['ui_mode'];
 554                         if (!$succeed)
 555                         {
 556                         // Incorrect password
 557                                 if (isset($_SESSION['timeout'])) {
 558                                         include($path_to_root . "/access/login.php");
 559                                         exit;
 560                                 } else
 561                                         login_fail();
 562                         }
 563                         elseif(isset($_SESSION['timeout']) && !$_SESSION['timeout']['post'])
 564                         {
 565                                 // in case of GET request redirect to avoid confirmation dialog
 566                                 // after return from menu option
 567                                 header("HTTP/1.1 307 Temporary Redirect");
 568                                 header("Location: ".$_SESSION['timeout']['uri']);
 569                                 exit();
 570                         }
 571                         $lang = &$_SESSION['language'];
 572                         $lang->set_language($_SESSION['language']->code);
 573                 }
 574         } else
 575         {
 576                 set_global_connection();
 577
 578                 if (db_fixed())
 579                         db_set_encoding($_SESSION['language']->encoding);
 580
 581                 $SysPrefs->refresh();
 582         }
 583         if (!isset($_SESSION["App"])) {
 584                 $_SESSION["App"] = new front_accounting();
 585                 $_SESSION["App"]->init();
 586         }
 587 }
 588
 589 // POST vars cleanup needed for direct reuse.
 590 // We quote all values later with db_escape() before db update.
 591 $_POST = strip_quotes($_POST);