Fixed issue #19117: [security] Account past their expiration date can…

… be still active (#3525)
LimeSurvey · Oct 30, 2023 · 9334cd4 · 9334cd4
1 parent ccef498
commit 9334cd4
Show file tree

Hide file tree

Showing 4 changed files with 59 additions and 13 deletions.
diff --git a/application/controllers/admin/Authentication.php b/application/controllers/admin/Authentication.php
@@ -270,17 +270,8 @@ public function newPassword()
      */
     public function logout()
     {
-        /* Adding beforeLogout event */
-        $beforeLogout = new PluginEvent('beforeLogout');
-        App()->getPluginManager()->dispatchEvent($beforeLogout);
-        regenerateCSRFToken();
         App()->user->logout();
         App()->user->setFlash('loginmessage', gT('Logout successful.'));
-
-        /* Adding afterLogout event */
-        $event = new PluginEvent('afterLogout');
-        App()->getPluginManager()->dispatchEvent($event);
-
         $this->getController()->redirect(array('/admin/authentication/sa/login'));
     }
 

diff --git a/application/core/LSWebUser.php b/application/core/LSWebUser.php
@@ -13,6 +13,49 @@ public function __construct()
         $this->loginUrl = Yii::app()->createUrl('admin/authentication', array('sa' => 'login'));
     }
 
+    /**
+     * @inheritDoc
+     * Replace auto getter to check if current user is valid or not
+     */
+    public function getId()
+    {
+        if (empty(parent::getId())) {
+            return parent::getId();
+        }
+        $id = App()->getCurrentUserId();
+        if ($id === 0) {
+            /* User is still connected but invalid : logout */
+            $this->logout();
+        }
+        return $id;
+    }
+
+    /**
+     * @inheritDoc
+     * Set id in session too
+     */
+    public function setId($id)
+    {
+        parent::setId($id);
+        \Yii::app()->session['loginID'] = $id;
+    }
+
+    /**
+     * @inheritDoc
+     * Add the specific plugin event and regenerate CSRF
+     */
+    public function logout($destroySession = true)
+    {
+        /* Adding beforeLogout event */
+        $beforeLogout = new PluginEvent('beforeLogout');
+        App()->getPluginManager()->dispatchEvent($beforeLogout);
+        regenerateCSRFToken();
+        parent::logout($destroySession);
+        /* Adding afterLogout event */
+        $event = new PluginEvent('afterLogout');
+        App()->getPluginManager()->dispatchEvent($event);
+    }
+
     /**
      * @inheritdoc
      */

diff --git a/application/core/Traits/LSApplicationTrait.php b/application/core/Traits/LSApplicationTrait.php
@@ -8,17 +8,16 @@
 
 trait LSApplicationTrait
 {
-
     /* @var integer| null the current userId for all action */
     private $currentUserId;
     /**
      * get the current id of connected user,
      * check if user exist before return for security
-     * @return int|null user id
+     * @return int|null user id, 0 mean invalid user
      */
     public function getCurrentUserId()
     {
-        if(empty(App()->session['loginID'])) {
+        if (empty(App()->session['loginID'])) {
             /**
              * NULL for guest,
              * null by default for CConsoleapplication, but Permission always return true for console
@@ -31,7 +30,7 @@ public function getCurrentUserId()
         }
         /* use App()->session and not App()->user fot easiest unit test */
         $this->currentUserId = App()->session['loginID'];
-        if ($this->currentUserId && !User::model()->findByPk($this->currentUserId)) {
+        if ($this->currentUserId && !User::model()->active()->findByPk($this->currentUserId)) {
             $this->currentUserId = 0;
         }
         return $this->currentUserId;

diff --git a/application/models/User.php b/application/models/User.php
@@ -127,6 +127,19 @@ public function rules()
         );
     }
 
+    /** @inheritdoc */
+    public function scopes()
+    {
+        return array(
+            'active' => array(
+                'condition' => "expires > :now OR expires IS NULL",
+                'params' => array(
+                    'now' => dateShift(date("Y-m-d H:i:s"), "Y-m-d H:i:s", Yii::app()->getConfig("timeadjust")),
+                )
+            )
+        );
+    }
+
     public function attributeLabels()
     {
         return [