From 47281ed7fc6a8f975ce6a1cca41f38b67b12d0c5 Mon Sep 17 00:00:00 2001 From: djpbessems Date: Mon, 28 Jan 2019 14:42:49 +0100 Subject: [PATCH] Comments added, along with tiny fixes --- public/lucidAuth.login.php | 2 ++ public/lucidAuth.validateRequest.php | 2 +- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/public/lucidAuth.login.php b/public/lucidAuth.login.php index f51d157..cf7dccd 100644 --- a/public/lucidAuth.login.php +++ b/public/lucidAuth.login.php @@ -20,6 +20,8 @@ // Save authentication token in cookie $httpHost = $_SERVER['HTTP_HOST']; $cookieDomain = array_values(array_filter($settings->Session['CookieDomains'], function ($value) use ($httpHost) { + // Check if $_SERVER['HTTP_HOST'] matches any of the configured domains (either explicitly or as a subdomain) + // This might seem backwards, but relying on $_SERVER directly allows spoofed values with potential security risks return (strlen($value) > strlen($httpHost)) ? false : (0 === substr_compare($httpHost, $value, -strlen($value))); }))[0]; setcookie('JWT', $result['token'], (time() + $settings->Session['Duration']), '/', '.' . $cookieDomain); diff --git a/public/lucidAuth.validateRequest.php b/public/lucidAuth.validateRequest.php index 41ac22e..ee300df 100644 --- a/public/lucidAuth.validateRequest.php +++ b/public/lucidAuth.validateRequest.php @@ -20,7 +20,7 @@ file_put_contents('../requestHeaders.log', (new DateTime())->format('Y-m-d\TH:i:s.u') . ' --- ' . (json_encode($proxyHeaders, JSON_FORCE_OBJECT)) . PHP_EOL, FILE_APPEND); } - if (sizeof($proxyHeaders) == 0) { + if (sizeof($proxyHeaders) === 0) { // Non-proxied request; this is senseless, go fetch! header("HTTP/1.1 403 Forbidden"); exit;