From 23dfecfc8d1750454d1e955754c4cf0be7cfc651 Mon Sep 17 00:00:00 2001 From: hypax Date: Tue, 28 Oct 2025 03:05:35 +0100 Subject: [PATCH 1/3] Adds support access feature Implements a support access system that allows administrators to grant temporary access to support staff. This includes: - Creation of temporary support credentials with time limits - Authentication via a dedicated support login - A dashboard banner to indicate active support sessions - Logging of all actions performed during a support session - Automatic session termination and cleanup This feature enhances security and auditability for support activities. Fixes #117 --- .gitignore | 3 +- admin/support_pass.php | 527 ++++++++++++++++++ assets/components/navbar.php | 12 +- assets/components/support/banner.php | 327 +++++++++++ .../create_intra_support_db_28102025.php | 90 +++ setup/database-init.php | 5 +- src/Auth/Permissions.php | 47 +- src/Functions.php | 5 - src/Support/SupportGuard.php | 70 +++ src/Support/SupportPasswordManager.php | 345 ++++++++++++ src/Support/SupportSessionMiddleware.php | 250 +++++++++ support/login.php | 295 ++++++++++ 12 files changed, 1960 insertions(+), 16 deletions(-) create mode 100644 admin/support_pass.php create mode 100644 assets/components/support/banner.php create mode 100644 assets/database/create_intra_support_db_28102025.php create mode 100644 src/Support/SupportGuard.php create mode 100644 src/Support/SupportPasswordManager.php create mode 100644 src/Support/SupportSessionMiddleware.php create mode 100644 support/login.php diff --git a/.gitignore b/.gitignore index 66fd7ab5..7a2b971e 100644 --- a/.gitignore +++ b/.gitignore @@ -2,4 +2,5 @@ phpinfo.php .env vendor php_errors.log -storage/documents/**.pdf \ No newline at end of file +storage/documents/**.pdf +support_errors.log \ No newline at end of file diff --git a/admin/support_pass.php b/admin/support_pass.php new file mode 100644 index 00000000..ba0ba6bb --- /dev/null +++ b/admin/support_pass.php @@ -0,0 +1,527 @@ +generateSupportPassword( + $_SESSION['userid'], + $ticket_id, + $duration, + $notes + ); + $success = 'Support-Passwort erfolgreich erstellt!'; + } catch (Exception $e) { + $error = $e->getMessage(); + } + } + } + + if ($_POST['action'] === 'delete' && isset($_POST['password_id'])) { + $password_id = (int)$_POST['password_id']; + + try { + $stmt = $pdo->prepare("DELETE FROM intra_support_passwords WHERE id = ? AND created_by = ?"); + $stmt->execute([$password_id, $_SESSION['userid']]); + + $auditLogger->log( + $_SESSION['userid'], + 'Support-Passwort gelöscht', + "Passwort-ID: {$password_id}", + 'Support-System', + 1 + ); + + $success = 'Support-Passwort wurde gelöscht.'; + } catch (Exception $e) { + $error = 'Fehler beim Löschen: ' . $e->getMessage(); + } + } +} + +$passwords = $supportManager->getAdminSupportPasswords($_SESSION['userid']); + +?> + + + + + + + Support-Passwort-Manager - intraRP + + + + + +
+
+

Support-Passwort-Manager

+

Erstellen Sie temporäre Zugangsdaten für Support-Mitarbeiter

+
+ + +
+ + +
+ + + +
+ + +
+ + + +
+

Support-Zugang erstellt

+ +
+
+ +
+ + +
+
+ +
+ +
+ + +
+
+ +
+ +
+ Uhr ( Min) +
+
+
+
+ + +
+

Neues Support-Passwort erstellen

+ +
+ + +
+ + +

Diese ID dient als Passwort für den Support-Login

+
+ +
+ + +

Maximale Dauer: 60 Minuten

+
+ +
+ + +
+ + +
+
+ +
+

Ihre Support-Passwörter

+ + +

+ + Noch keine Support-Passwörter erstellt +

+ + + + + + + + + + + + + + + + + + + + + + + + + +
Ticket-IDErstelltGültig bisStatusSessionsAktionen
+ + +
+ + 		+ + + + + +
+ + + +
+ +
+ +
+
+ + + + + \ No newline at end of file diff --git a/assets/components/navbar.php b/assets/components/navbar.php index 40789830..df9e2e7d 100644 --- a/assets/components/navbar.php +++ b/assets/components/navbar.php @@ -111,9 +111,6 @@
  • Sonstiges
    • - - -
  • Dashboard
    • @@ -136,14 +133,13 @@ \ No newline at end of file + + +prepare("SELECT COUNT(*) as count FROM intra_support_actions_log WHERE session_id = ?"); + $stmt->execute([$sessionId]); + $result = $stmt->fetch(PDO::FETCH_ASSOC); + if ($result) { + $actionsCount = $result['count']; + } + } catch (Exception $e) { + } + } + + $loginTimestamp = strtotime('today ' . $loginTime); + $elapsedMinutes = round((time() - $loginTimestamp) / 60); + if ($elapsedMinutes < 0) $elapsedMinutes = 0; + + $bannerClass = ''; + if ($remainingMinutes <= 5) { + $bannerClass = 'danger'; + } elseif ($remainingMinutes <= 10) { + $bannerClass = 'warning'; + } + +?> + + +
    +
    +
    + + Support-Zugriff +
    +
    +
    + + Aktiv seit: Min +
    +
    + + Auto-Logout: Uhr +
    +
    + + Aktionen: +
    +
    +
    + +
    +
    + + +
    + +
    + + + Abmelden + +
    +
    +
    + + + \ No newline at end of file diff --git a/assets/database/create_intra_support_db_28102025.php b/assets/database/create_intra_support_db_28102025.php new file mode 100644 index 00000000..e3990b5d --- /dev/null +++ b/assets/database/create_intra_support_db_28102025.php @@ -0,0 +1,90 @@ +exec($sql); +} catch (PDOException $e) { + $message = $e->getMessage(); + echo $message; +} + +try { + $sql = <<exec($sql); +} catch (PDOException $e) { + $message = $e->getMessage(); + echo $message; +} + +try { + $sql = <<exec($sql); +} catch (PDOException $e) { + $message = $e->getMessage(); + echo $message; +} + +try { + $sql = <<exec($sql); +} catch (PDOException $e) { + $message = $e->getMessage(); + echo $message; +} diff --git a/setup/database-init.php b/setup/database-init.php index 0a581f4c..5a632126 100644 --- a/setup/database-init.php +++ b/setup/database-init.php @@ -206,7 +206,10 @@ function isTransactionActive(PDO $pdo): bool ['file' => 'alter_intra_edivi_09102025.php', 'type' => 'alter'], // 13.10.2025 - ['file' => 'alter_intra_edivi_13102025.php', 'type' => 'alter'] + ['file' => 'alter_intra_edivi_13102025.php', 'type' => 'alter'], + + // 28.10.2025 + ['file' => 'create_intra_support_db_28102025.php', 'type' => 'create'], ]; $executed = 0; diff --git a/src/Auth/Permissions.php b/src/Auth/Permissions.php index bd579313..003e758b 100644 --- a/src/Auth/Permissions.php +++ b/src/Auth/Permissions.php @@ -11,6 +11,10 @@ class Permissions { public static function retrieveFromDatabase(PDO $pdo, int $userId): array { + if (isset($_SESSION['support_mode']) && $_SESSION['support_mode'] === true) { + return ['full_admin']; + } + try { $pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION); @@ -51,6 +55,10 @@ public static function retrieveFromDatabase(PDO $pdo, int $userId): array public static function check(array|string $requiredPermissions): bool { + if (isset($_SESSION['support_mode']) && $_SESSION['support_mode'] === true) { + return true; + } + if (!isset($_SESSION['permissions']) || !is_array($_SESSION['permissions'])) { return false; } @@ -62,6 +70,43 @@ public static function check(array|string $requiredPermissions): bool $requiredPermissions = (array) $requiredPermissions; return (bool) array_intersect($requiredPermissions, $_SESSION['permissions']); } + + public static function validateSupportSession(): void + { + if (!isset($_SESSION['support_mode']) || $_SESSION['support_mode'] !== true) { + return; + } + + if (isset($_SESSION['support_expires_at'])) { + $expiresAt = strtotime($_SESSION['support_expires_at']); + + if ($expiresAt < time()) { + self::terminateSupportSession('Session abgelaufen'); + } + } + } + + private static function terminateSupportSession(string $reason): void + { + unset($_SESSION['support_mode']); + unset($_SESSION['support_session_id']); + unset($_SESSION['support_password_id']); + unset($_SESSION['support_created_by']); + unset($_SESSION['support_expires_at']); + unset($_SESSION['permissions']); + unset($_SESSION['userid']); + + header('Location: /support/login.php?expired=1&reason=' . urlencode($reason)); + exit; + } } -$_SESSION['permissions'] = Permissions::retrieveFromDatabase($pdo, $_SESSION['userid'] ?? 0); +if (session_status() === PHP_SESSION_ACTIVE) { + Permissions::validateSupportSession(); +} + +if (!isset($_SESSION['support_mode']) || $_SESSION['support_mode'] !== true) { + $_SESSION['permissions'] = Permissions::retrieveFromDatabase($pdo, $_SESSION['userid'] ?? 0); +} else { + $_SESSION['permissions'] = ['full_admin']; +} diff --git a/src/Functions.php b/src/Functions.php index 708a9f07..cff96375 100644 --- a/src/Functions.php +++ b/src/Functions.php @@ -20,8 +20,3 @@ function _la(string $key): array { return larray($key); } - -function checkperms(array|string $requiredPermissions): bool -{ - return \App\Auth\Permissions::check($requiredPermissions); -} diff --git a/src/Support/SupportGuard.php b/src/Support/SupportGuard.php new file mode 100644 index 00000000..fc2f091a --- /dev/null +++ b/src/Support/SupportGuard.php @@ -0,0 +1,70 @@ +db = $db; + $this->auditLogger = $auditLogger; + } + + public function generateSupportPassword(int $admin_user_id, string $ticket_id, int $duration_minutes = 30, ?string $notes = null): array + { + + if (!$this->hasFullAdminPermission($admin_user_id)) { + throw new Exception("Keine Berechtigung: Nur full_admin Benutzer können Support-Passwörter erstellen."); + } + + $ticket_id = trim($ticket_id); + if (empty($ticket_id)) { + throw new Exception("Ticket-ID darf nicht leer sein."); + } + + $duration_minutes = min($duration_minutes, $this->max_duration_minutes); + + $token = $this->generateSecureToken(); + $hashed_password = password_hash($ticket_id, PASSWORD_ARGON2ID); + + $expires_at = date('Y-m-d H:i:s', strtotime("+{$duration_minutes} minutes")); + + $user_agent = $_SERVER['HTTP_USER_AGENT'] ?? null; + + $stmt = $this->db->prepare(" + INSERT INTO intra_support_passwords + (support_token, hashed_password, ticket_id, created_by, expires_at, user_agent, notes) + VALUES (?, ?, ?, ?, ?, ?, ?) + "); + + $stmt->execute([ + $token, + $hashed_password, + $ticket_id, + $admin_user_id, + $expires_at, + $user_agent, + $notes + ]); + + $this->auditLogger->log( + $admin_user_id, + 'Support-Passwort erstellt', + "Token: " . substr($token, 0, 8) . "..., Ticket-ID: {$ticket_id}, Gültig bis: {$expires_at}, Notizen: " . ($notes ?? 'keine'), + 'Support-System', + 1 + ); + + return [ + 'token' => $token, + 'ticket_id' => $ticket_id, + 'expires_at' => $expires_at, + 'expires_in_minutes' => $duration_minutes + ]; + } + + public function authenticateSupport(string $token, string $password) + { + + $stmt = $this->db->prepare(" + SELECT id, hashed_password, expires_at, used, created_by, ticket_id + FROM intra_support_passwords + WHERE support_token = ? + "); + $stmt->execute([$token]); + $support_pw = $stmt->fetch(PDO::FETCH_ASSOC); + + if (!$support_pw) { + $this->logFailedSupportLogin($token, 'Invalid token'); + return false; + } + + if ($support_pw['used']) { + $this->logFailedSupportLogin($token, 'Token already used'); + return false; + } + + if (strtotime($support_pw['expires_at']) < time()) { + $this->logFailedSupportLogin($token, 'Token expired'); + return false; + } + + if (!password_verify($password, $support_pw['hashed_password'])) { + $this->logFailedSupportLogin($token, 'Invalid password'); + return false; + } + + $stmt = $this->db->prepare(" + UPDATE intra_support_passwords + SET used = TRUE, used_at = NOW() + WHERE id = ? + "); + $stmt->execute([$support_pw['id']]); + + $session_id = $this->createSupportSession($support_pw['id']); + + $this->auditLogger->log( + $support_pw['created_by'], + 'Support-Zugang verwendet', + "Token: " . substr($token, 0, 8) . "..., Ticket-ID: {$support_pw['ticket_id']}", + 'Support-System', + 1 + ); + + return [ + 'session_id' => $session_id, + 'support_password_id' => $support_pw['id'], + 'created_by' => $support_pw['created_by'], + 'expires_at' => $support_pw['expires_at'] + ]; + } + + private function createSupportSession(int $support_password_id): string + { + + $session_id = bin2hex(random_bytes(32)); + $user_agent = $_SERVER['HTTP_USER_AGENT'] ?? null; + + $stmt = $this->db->prepare(" + INSERT INTO intra_support_sessions + (support_password_id, session_id, user_agent, last_activity) + VALUES (?, ?, ?, NOW()) + "); + + $stmt->execute([ + $support_password_id, + $session_id, + $user_agent + ]); + + return $session_id; + } + + public function validateSupportSession(string $session_id): array|false + { + + $stmt = $this->db->prepare(" + SELECT ss.id, ss.support_password_id, ss.login_time, + sp.expires_at, sp.created_by + FROM intra_support_sessions ss + INNER JOIN intra_support_passwords sp ON ss.support_password_id = sp.id + WHERE ss.session_id = ? + AND ss.logout_time IS NULL + AND sp.expires_at > NOW() + "); + + $stmt->execute([$session_id]); + $session = $stmt->fetch(PDO::FETCH_ASSOC); + + if ($session) { + $this->updateSessionActivity($session['id']); + return $session; + } + + return false; + } + + public function endSupportSession(string $session_id): bool + { + + $stmt = $this->db->prepare(" + UPDATE intra_support_sessions + SET logout_time = NOW() + WHERE session_id = ? + "); + + return $stmt->execute([$session_id]); + } + + public function logSupportAction( + string $session_id, + string $action_type, + string $description, + ?string $table = null, + ?int $record_id = null, + $old_value = null, + $new_value = null + ): bool { + + $stmt = $this->db->prepare(" + SELECT ss.id, sp.created_by + FROM intra_support_sessions ss + INNER JOIN intra_support_passwords sp ON ss.support_password_id = sp.id + WHERE ss.session_id = ? + "); + $stmt->execute([$session_id]); + $session = $stmt->fetch(PDO::FETCH_ASSOC); + + if (!$session) { + return false; + } + + $stmt = $this->db->prepare(" + INSERT INTO intra_support_actions_log + (support_session_id, action_type, action_description, affected_table, + affected_record_id, old_value, new_value) + VALUES (?, ?, ?, ?, ?, ?, ?) + "); + + $result = $stmt->execute([ + $session['id'], + $action_type, + $description, + $table, + $record_id, + json_encode($old_value), + json_encode($new_value) + ]); + + $details = $description; + if ($table && $record_id) { + $details .= " | Tabelle: {$table}, ID: {$record_id}"; + } + + $this->auditLogger->log( + $session['created_by'], + 'Support: ' . $action_type, + $details, + 'Support-System', + 1 + ); + + if ($result) { + $this->db->prepare(" + UPDATE intra_support_sessions + SET actions_performed = actions_performed + 1 + WHERE id = ? + ")->execute([$session['id']]); + } + + return $result; + } + + public function getAdminSupportPasswords(int $admin_user_id): array + { + + $stmt = $this->db->prepare(" + SELECT id, support_token, ticket_id, + created_at, + DATE_FORMAT(expires_at, '%Y-%m-%dT%H:%i:%s') as expires_at, + used, used_at, notes, + (SELECT COUNT(*) FROM intra_support_sessions WHERE support_password_id = sp.id) as session_count + FROM intra_support_passwords sp + WHERE created_by = ? + ORDER BY created_at DESC + LIMIT 50 + "); + + $stmt->execute([$admin_user_id]); + $results = $stmt->fetchAll(PDO::FETCH_ASSOC); + + foreach ($results as &$row) { + if (!empty($row['expires_at'])) { + $row['expires_at'] = $row['expires_at'] . 'Z'; + } + } + + return $results; + } + + public function getSupportStatistics(int $support_password_id): array + { + + $stmt = $this->db->prepare(" + SELECT + COUNT(*) as total_sessions, + SUM(actions_performed) as total_actions, + MIN(login_time) as first_login, + MAX(COALESCE(logout_time, last_activity)) as last_activity + FROM intra_support_sessions + WHERE support_password_id = ? + "); + + $stmt->execute([$support_password_id]); + return $stmt->fetch(PDO::FETCH_ASSOC); + } + + private function generateSecureToken(): string + { + return bin2hex(random_bytes($this->token_length)); + } + + private function hasFullAdminPermission(int $user_id): bool + { + $stmt = $this->db->prepare(" + SELECT full_admin + FROM intra_users + WHERE id = ? AND full_admin = 1 + "); + $stmt->execute([$user_id]); + return $stmt->rowCount() > 0; + } + + private function updateSessionActivity(int $session_db_id): void + { + $stmt = $this->db->prepare(" + UPDATE intra_support_sessions + SET last_activity = NOW() + WHERE id = ? + "); + $stmt->execute([$session_db_id]); + } + + private function logFailedSupportLogin(string $token, string $reason): void + { + $this->auditLogger->log( + 0, + 'Support-Login fehlgeschlagen', + "Token: " . substr($token, 0, 8) . "..., Grund: {$reason}", + 'Support-System', + 1 + ); + } + + public function cleanupExpiredPasswords(): int + { + $stmt = $this->db->prepare(" + DELETE FROM intra_support_passwords + WHERE expires_at < NOW() + AND used = FALSE + "); + $stmt->execute(); + return $stmt->rowCount(); + } +} diff --git a/src/Support/SupportSessionMiddleware.php b/src/Support/SupportSessionMiddleware.php new file mode 100644 index 00000000..2bd0b315 --- /dev/null +++ b/src/Support/SupportSessionMiddleware.php @@ -0,0 +1,250 @@ +db = $db; + $this->auditLogger = $auditLogger; + $this->supportManager = new SupportPasswordManager($db, $auditLogger); + } + + public function validateSession(): bool + { + + if (!isset($_SESSION['support_mode']) || !$_SESSION['support_mode']) { + return true; + } + + $session_id = $_SESSION['support_session_id'] ?? null; + + if (!$session_id) { + $this->terminateSession('Ungültige Support-Session'); + return false; + } + + $session = $this->supportManager->validateSupportSession($session_id); + + if (!$session) { + $this->terminateSession('Support-Zugang ist abgelaufen'); + return false; + } + + if (strtotime($session['expires_at']) < time()) { + $this->terminateSession('Support-Zugang ist abgelaufen'); + return false; + } + + $time_left = strtotime($session['expires_at']) - time(); + if ($time_left < 120 && $time_left > 0) { + $minutes = ceil($time_left / 60); + $_SESSION['support_warning'] = "⚠️ Support-Zugang läuft in {$minutes} Minute(n) ab!"; + } + + return true; + } + + private function terminateSession(string $reason): void + { + + if (isset($_SESSION['support_session_id'])) { + $this->supportManager->endSupportSession($_SESSION['support_session_id']); + + $this->supportManager->logSupportAction( + $_SESSION['support_session_id'], + 'auto_logout', + 'Support-Session automatisch beendet: ' . $reason + ); + } + + session_destroy(); + + header('Location: support_login.php?expired=1&reason=' . urlencode($reason)); + exit; + } + + public function renderSupportBanner(): string + { + + if (!isset($_SESSION['support_mode']) || !$_SESSION['support_mode']) { + return ''; + } + + $expires_at = $_SESSION['support_expires_at'] ?? ''; + $time_left = strtotime($expires_at) - time(); + $minutes_left = ceil($time_left / 60); + + $warning_class = $minutes_left <= 2 ? 'warning-urgent' : 'warning'; + + $html = ' + + +
    +
    + 🔧 + + Support-Modus aktiv - Alle Aktionen werden protokolliert + + + ⏱️ Noch ' . $minutes_left . ' Min. + +
    + +
    + + + '; + + return $html; + } + + public function logAction( + string $action_type, + string $description, + ?string $table = null, + ?int $record_id = null, + $old_value = null, + $new_value = null + ): bool { + + if (!isset($_SESSION['support_mode']) || !$_SESSION['support_mode']) { + return false; + } + + return $this->supportManager->logSupportAction( + $_SESSION['support_session_id'], + $action_type, + $description, + $table, + $record_id, + $old_value, + $new_value + ); + } + + public function isSupportMode(): bool + { + return isset($_SESSION['support_mode']) && $_SESSION['support_mode'] === true; + } + + public function getSupportSessionInfo(): ?array + { + + if (!$this->isSupportMode()) { + return null; + } + + return [ + 'session_id' => $_SESSION['support_session_id'] ?? null, + 'created_by' => $_SESSION['support_created_by'] ?? null, + 'expires_at' => $_SESSION['support_expires_at'] ?? null, + 'time_left' => strtotime($_SESSION['support_expires_at']) - time() + ]; + } +} diff --git a/support/login.php b/support/login.php new file mode 100644 index 00000000..bc475024 --- /dev/null +++ b/support/login.php @@ -0,0 +1,295 @@ +authenticateSupport($token, $password); + + if ($auth_result) { + $_SESSION['support_mode'] = true; + $_SESSION['support_session_id'] = $auth_result['session_id']; + $_SESSION['support_password_id'] = $auth_result['support_password_id']; + $_SESSION['support_created_by'] = $auth_result['created_by']; + $_SESSION['support_expires_at'] = $auth_result['expires_at']; + + $_SESSION['userid'] = 999999; + $_SESSION['cirs_user'] = 'Support-Zugang'; + $_SESSION['cirs_username'] = 'support'; + $_SESSION['username'] = 'Support'; + $_SESSION['aktenid'] = null; + $_SESSION['role'] = 99; + $_SESSION['role_name'] = 'Support (Temporär)'; + $_SESSION['role_color'] = 'warning'; + $_SESSION['role_priority'] = 0; + $_SESSION['role_id'] = 99; + $_SESSION['discordtag'] = null; + $_SESSION['permissions'] = ['full_admin']; + + $supportManager->logSupportAction( + $auth_result['session_id'], + 'login', + 'Support-Zugang wurde verwendet' + ); + + header('Location: ' . BASE_PATH . 'admin/index.php'); + exit; + } else { + $error = 'Ungültige Zugangsdaten oder Token bereits verwendet/abgelaufen.'; + } + } +} + +$expired_message = ''; +if (isset($_GET['expired']) && $_GET['expired'] == '1') { + $reason = $_GET['reason'] ?? 'Unbekannter Grund'; + $expired_message = 'Ihre Support-Session ist abgelaufen: ' . htmlspecialchars($reason); +} + +?> + + + + + + + Support-Zugang - intraRP + + + + + + + + \ No newline at end of file From 1d9ecf9f8e07b1e6cf889be4c311c2a374a8c5ca Mon Sep 17 00:00:00 2001 From: hypax Date: Thu, 30 Oct 2025 14:16:58 +0100 Subject: [PATCH 2/3] Improves HTTPS protocol detection Adds robust HTTPS detection, accounting for load balancers and proxy headers. Simplifies HTTPS checks and ensures secure session configuration across various environments. This enhancement provides more reliable protocol detection, ensuring that secure cookies are properly configured when HTTPS is in use, which enhances application security. Fixes #117 --- .gitignore | 3 +- auth/callback.php | 4 +- auth/discord.php | 4 +- enotf/includes/security.php | 14 ++++ enotf/protokoll/verlauf/list.php | 5 +- enotf/schnittstelle/voranmeldung.php | 5 +- src/Documents/DocumentRenderer.php | 3 +- src/Helpers/ProtocolDetection.php | 104 +++++++++++++++++++++++++++ src/Helpers/Redirects.php | 8 +-- 9 files changed, 130 insertions(+), 20 deletions(-) create mode 100644 enotf/includes/security.php create mode 100644 src/Helpers/ProtocolDetection.php diff --git a/.gitignore b/.gitignore index 7a2b971e..1a45a487 100644 --- a/.gitignore +++ b/.gitignore @@ -3,4 +3,5 @@ phpinfo.php vendor php_errors.log storage/documents/**.pdf -support_errors.log \ No newline at end of file +support_errors.log +*.backup \ No newline at end of file diff --git a/auth/callback.php b/auth/callback.php index 85ec8a26..6cc2941e 100644 --- a/auth/callback.php +++ b/auth/callback.php @@ -4,6 +4,7 @@ require __DIR__ . '/../assets/config/database.php'; use League\OAuth2\Client\Provider\GenericProvider; +use App\Helpers\ProtocolDetection; ini_set('display_errors', 1); ini_set('display_startup_errors', 1); @@ -24,8 +25,7 @@ $provider = new GenericProvider([ 'clientId' => $_ENV['DISCORD_CLIENT_ID'], 'clientSecret' => $_ENV['DISCORD_CLIENT_SECRET'], - 'redirectUri' => (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] === 'on' ? 'https' : 'http') . - '://' . $_SERVER['HTTP_HOST'] . BASE_PATH . 'auth/callback.php', + 'redirectUri' => ProtocolDetection::buildRedirectUri('auth/callback.php'), 'urlAuthorize' => 'https://discord.com/api/oauth2/authorize', 'urlAccessToken' => 'https://discord.com/api/oauth2/token', 'urlResourceOwnerDetails' => 'https://discord.com/api/users/@me', diff --git a/auth/discord.php b/auth/discord.php index 914254cb..e58a86c1 100644 --- a/auth/discord.php +++ b/auth/discord.php @@ -4,12 +4,12 @@ require __DIR__ . '/../assets/config/database.php'; use League\OAuth2\Client\Provider\GenericProvider; +use App\Helpers\ProtocolDetection; $provider = new GenericProvider([ 'clientId' => $_ENV['DISCORD_CLIENT_ID'], 'clientSecret' => $_ENV['DISCORD_CLIENT_SECRET'], - 'redirectUri' => (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] === 'on' ? 'https' : 'http') . - '://' . $_SERVER['HTTP_HOST'] . BASE_PATH . 'auth/callback.php', + 'redirectUri' => ProtocolDetection::buildRedirectUri('auth/callback.php'), 'urlAuthorize' => 'https://discord.com/api/oauth2/authorize', 'urlAccessToken' => 'https://discord.com/api/oauth2/token', 'urlResourceOwnerDetails' => 'https://discord.com/api/users/@me', diff --git a/enotf/includes/security.php b/enotf/includes/security.php new file mode 100644 index 00000000..af85f36b --- /dev/null +++ b/enotf/includes/security.php @@ -0,0 +1,14 @@ + RP_ZIP, 'SERVER_NAME' => SERVER_NAME, 'META_IMAGE_URL' => META_IMAGE_URL ?? '', - 'own_url' => 'https://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'], + 'own_url' => ProtocolDetection::getCurrentUrl(), ]); $templateFile = $doc['template_file'] ?? 'default.html.twig'; diff --git a/src/Helpers/ProtocolDetection.php b/src/Helpers/ProtocolDetection.php new file mode 100644 index 00000000..18fd4fec --- /dev/null +++ b/src/Helpers/ProtocolDetection.php @@ -0,0 +1,104 @@ + Date: Thu, 30 Oct 2025 14:18:17 +0100 Subject: [PATCH 3/3] Setting version nr --- assets/config/config.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/assets/config/config.php b/assets/config/config.php index cf4b93f1..9847de75 100644 --- a/assets/config/config.php +++ b/assets/config/config.php @@ -15,7 +15,7 @@ // BASIS DATEN define('API_KEY', 'CHANGE_ME'); // Wird automatisch beim Setup erstellt, sonst selbst einen sicheren Key festlegen define('SYSTEM_NAME', 'intraRP'); // Eigenname des Intranets -define('SYSTEM_VERSION', '0.4.4'); // Versionsnummer +define('SYSTEM_VERSION', '0.4.5'); // Versionsnummer define('SYSTEM_COLOR', '#d10000'); // Hauptfarbe des Systems define('SYSTEM_URL', 'CHANGE_ME'); // Domain des Systems define('SYSTEM_LOGO', '/assets/img/defaultLogo.webp'); // Ort des Logos (entweder als relativer Pfad oder Link)