RanchiMall/php-mpos
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

cleaned up & updated config options

Browse Source
This commit is contained in:
xisi 2014-01-18 17:20:36 -05:00
parent 5e5e751271
commit 163e5de1f0
2 changed files with 6 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
public/include/classes/csrftoken.class.php
View File

@ -18,7 +18,7 @@ class CSRFToken Extends Base {
$month = $data[0]; $day = $data[1]; $year = $data[2]; $month = $data[0]; $day = $data[1]; $year = $data[2];
$hour = $data[3]; $minute = $data[4]; $second = $data[5]; $hour = $data[3]; $minute = $data[4]; $second = $data[5];
$salt1 = $this->salt; $salt2 = $this->salty; $seed = $salt1; $salt1 = $this->salt; $salt2 = $this->salty; $seed = $salt1;
$lead = $this->config['csrf']['options']['leadtime']; $lead = $this->config['csrf']['leadtime'];
if ($lead >= 11) { $lead = 10; } if ($lead >= 11) { $lead = 10; }
if ($lead <= 0) { $lead = 3; } if ($lead <= 0) { $lead = 3; }
if ($minute == 59 && $second > (60-$lead)) { if ($minute == 59 && $second > (60-$lead)) {

9
public/include/config/global.inc.dist.php
View File

@ -136,20 +136,21 @@ $config['twofactor']['options']['changepw'] = true;
* Options: * Options:
* enabled = Whether or not we will generate/check for valid CSRF tokens * enabled = Whether or not we will generate/check for valid CSRF tokens
* sitewide = Require a valid CSRF token for most* forms, does not override form specific settings * sitewide = Require a valid CSRF token for most* forms, does not override form specific settings
* * contact, account edit, workers, notifications, invites, registration * * contact, account edit, workers, notifications, invites, registration, passsword resets
* leadtime = Length of time in seconds to give as leeway between minute switches
* login = Use and check login-specific CSRF token * login = Use and check login-specific CSRF token
* leadtime = Length of time in seconds to give as leeway between minute switches
* * Don't change this unless you know why you're changing it
* *
* Default: * Default:
* enabled = true * enabled = true
* sitewide = true * sitewide = true
* leadtime = 3
* login = true * login = true
* leadtime = 3
*/ */
$config['csrf']['enabled'] = true; $config['csrf']['enabled'] = true;
$config['csrf']['options']['sitewide'] = true; $config['csrf']['options']['sitewide'] = true;
$config['csrf']['options']['leadtime'] = 3;
$config['csrf']['forms']['login'] = true; $config['csrf']['forms']['login'] = true;
$config['csrf']['leadtime'] = 3;
/** /**
* Lock account after maximum failed logins * Lock account after maximum failed logins