From af53ec7a01517daa7aed4eba6771c67db0f2c3ad Mon Sep 17 00:00:00 2001 From: Mojtaba Date: Sat, 2 Oct 2021 12:39:42 +0200 Subject: [PATCH] Solved the security bug after login! --- nodcms-core/Config/Filters.php | 2 +- nodcms-core/Filters/IdentityVerification.php | 4 +- nodcms-layout/Views/nodcms_admin_login.php | 59 -------------------- nodcms-users/Config/Routes.php | 2 +- 4 files changed, 5 insertions(+), 62 deletions(-) delete mode 100644 nodcms-layout/Views/nodcms_admin_login.php diff --git a/nodcms-core/Config/Filters.php b/nodcms-core/Config/Filters.php index 5e3d3da3..52ce3d4e 100644 --- a/nodcms-core/Config/Filters.php +++ b/nodcms-core/Config/Filters.php @@ -38,6 +38,6 @@ class Filters extends BaseConfig // 'isLoggedIn' => ['before' => ['account/*', 'profiles/*']], public $filters = [ 'urlLocale' => ['before' => ['[a-z]{2}', '[a-z]{2}/*'], 'after' => []], - 'identityVerification' => ['before' => ['admin/*', 'user/*'], 'after' => []], + 'identityVerification' => ['before' => ['admin', 'admin/*', 'admin-*', 'user/*'], 'after' => []], ]; } diff --git a/nodcms-core/Filters/IdentityVerification.php b/nodcms-core/Filters/IdentityVerification.php index 7b8b67ad..204b48bd 100644 --- a/nodcms-core/Filters/IdentityVerification.php +++ b/nodcms-core/Filters/IdentityVerification.php @@ -37,8 +37,10 @@ public function before(RequestInterface $request, $arguments = null) { $response = Services::quickResponse(); + $lang = Services::language()->getLocale(); + if(!Services::identity()->isValid()){ - return $response->getError(lang("Please login to access this page."), "/admin-sign"); + return $response->getError(lang("Please login to access this page."), "/{$lang}/login"); } if(!Services::identity()->isActive()) { diff --git a/nodcms-layout/Views/nodcms_admin_login.php b/nodcms-layout/Views/nodcms_admin_login.php deleted file mode 100644 index cb118030..00000000 --- a/nodcms-layout/Views/nodcms_admin_login.php +++ /dev/null @@ -1,59 +0,0 @@ - -"> - - - - - - "> - - <?=_l('Administration',$this)?> <?=isset($settings["company"])?$settings["company"]:""?> - - - " rel="stylesheet"> - " rel="stylesheet"> - - " rel="stylesheet" /> - - " rel="stylesheet"> - - " rel="stylesheet"> - - " rel="stylesheet"> - " rel="stylesheet" /> - - - - - - - -
- - -
- - - - - - - - - - - - diff --git a/nodcms-users/Config/Routes.php b/nodcms-users/Config/Routes.php index 4099bebe..6acecbab 100644 --- a/nodcms-users/Config/Routes.php +++ b/nodcms-users/Config/Routes.php @@ -23,7 +23,7 @@ $namespace = "\NodCMS\Users\Controllers\\"; -$routes->match(['post', 'get'],'{locale}/(admin-sign|login)', "{$namespace}Users::login"); +$routes->match(['post', 'get'],'{locale}/login', "{$namespace}Users::login"); $routes->get('account-locked', "{$namespace}Users::accountLocked"); $routes->get('{locale}/account-locked', "{$namespace}Users::accountLocked"); $routes->get('logout', "{$namespace}Users::logout");