RanchiMall/php-mpos
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
3,075 Commits 4 Branches 11 Tags 14 MiB
963b76ed80
Commit Graph

19 Commits

Author SHA1 Message Date
rog1121
93981f6044 Various Fixes 2014-03-01 17:57:43 -07:00
rog1121
7e3623d659 Various Fixes 2014-03-01 17:56:23 -07:00
iAmShorty
7b86293278 [UPDATE] notifications for pages 2014-02-27 22:16:26 +01:00
Sebastian Grewe
6509cc6039 [ADDE] CSRF validation for Worker Deletion 
* [ADDED] CSRF token checks to worker page
* [CHANGED] Check for both _GET and _POST ctokens
* [ADDED] CSRF token to each delete call URL

Fixes #1702 once merged
 2014-02-07 12:24:48 +01:00
xisi
ae47437ab7 fixed worker delete csrf thing I stubbed earlier 
took to field out of the rest of the login forms
 2014-01-29 09:41:50 -05:00
Joey
63c3b96a29 now enforce client & server validity on login with strict on 
fixed csrf token check for a few pages where it mightve been broken
session manager now can be bound to base user class and used, like in login
logout now pushes you to login regardless, no longer has param to push to custom url
fixed validate client, hijacking sessions no longer works
 2014-01-28 07:26:32 -05:00
xisi
b728b680ca blah blah 2014-01-28 07:26:08 -05:00
xisi
3006cb544f Reworked csrf tokens, now enabled globally 
The way this now works is, if csrf is enabled:
 * Any new or existing template can have csrf protection by adding the hidden input ctoken that's in this batch to its form, removes any logic in templates
 * Page controllers that already exist have been updated, new ones only require checking if csrf is enabled and valid
 2014-01-24 13:00:24 -05:00
xisi
a3314fa81e Cleaned up login page logic a bit more 
Fixed up CSRF tokens so rollover minutes/hours are now checked and valid
 2014-01-23 11:01:30 -05:00
xisi
76a67cb71a Changed the config options for CSRF/disabling forms 
* Now an array to disable with granularity
 * Fixed all CSRF tokens back to 1 min
 * Added CSRF protection for unlock account
 * Unified error message for all csrf tokens
 * Fixed a few issues with last commit
 2014-01-20 04:41:13 -05:00
xisi
15eca659b9 fixed a bug in edit account template 
moved csrf token to above template in smarty assigns
fixed a bug in user class
remove small login/fix header to catch up
 2014-01-20 04:30:17 -05:00
xisi
8756036646 cleaned up account edit csrf slightly 
added csrf protection to workers under sitewide config
added csrf protection to notifications under sitewide config
added csrf protection to invitations under sitewide config
cleaned up login page csrf
cleaned up contactform/contactform page
cleaned up register/register page
moved config->csrf->forms->register to sitewide
added login ip/user/time to notification on login
 2014-01-20 04:29:45 -05:00
Neozonz
1be228812d [FIX] Type Success on notifications 2014-01-13 17:27:50 -05:00
Sebastian Grewe
591fc3733b removing error reporting for debugging 2013-07-02 21:10:12 +02:00
Sebastian Grewe
7e4938f279 Fixing PHP warnings on account workers page 
* Fixes PHP Warning if no workers are updated
* Fixes PHP Warning in worker class if data is empty

Fixes #339
 2013-07-02 21:08:26 +02:00
Sebastian Grewe
0817befaaa Further cleanup to reduce PHP notice warnings 2013-06-14 13:51:06 +02:00
Sebastian Grewe
42b6d4b3b2 Adding support for user locking 
* Currently no GUI, use DB access to change the row entry
* Upgraded Database table `accounts` with upgrade SQL
* Updated `admin` field to `is_admin` as boolean
* Modified pages, classes, templates to support is_admin and is_locked

Addresses #147
 2013-06-13 11:36:28 +02:00
Sebastian Grewe
187fb92272 further cleaned up user class, created worker class, removed ledger and paid calls from user 2013-05-12 11:39:22 +02:00
Sebastian Grewe
1b50f76f72 initial import of file base of my WIP 2013-05-06 14:11:38 +02:00