Commit d99f86f6 authored by JosephK's avatar JosephK
Browse files

[recovery] security fix

parent 24e3d3fa
<?php
// remplacer http par https
define('URL_BASE', str_replace($_SERVER['DOCUMENT_ROOT'], isset($_SERVER['HTTPS']) ? 'https' : 'http').'://'.$_SERVER['HTTP_HOST'], dirname($_SERVER['SCRIPT_FILENAME'])) );
define('URL_BASE', str_replace($_SERVER['DOCUMENT_ROOT'], isset($_SERVER['HTTPS']) ? 'https' : 'http').'://'.$_SERVER['HTTP_HOST'], dirname($_SERVER['SCRIPT_FILENAME']) );
define('TITLE', 'MyFrama');
/**
......
......@@ -74,7 +74,10 @@ function hook_recovery_render_header($data)
/* Step 2 : check token */
} elseif (isset($_GET['token'])) {
if($_GET['token'] != $GLOBALS['config']['RECOVERY']['token'] ) {
if( empty($_GET['token'])
|| empty($GLOBALS['config']['RECOVERY']['token'])
|| $_GET['token'] != $GLOBALS['config']['RECOVERY']['token']
) {
$data['login'] .= '<p class="alert alert-warning">Le lien pour la récupération du mot de passe n’est pas valide ou a expiré.</p>';
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment