Download as
Browse Code »

Commit 11c4e7b80b78d3b9b52aa67ef4e1045e7549933f

Authored by Edmar Moretti
1 parent c7d6f8c8
Exists in master and in 7 other branches composer, doc-root, docker, guia, licenca, readme, unmaintened

Incorporação das regras de segurança sugeridas em http://shiflett.org/articles/t… 

…he-truth-about-sessions
Showing 2 changed files with 12 additions and 5 deletions   Show diff stats
classesphp/mapa_controle.php
  Diff comments   View file @11c4e7b
... ... @@ -79,7 +79,7 @@ Include:
79 79 <pega_variaveis.php>, <carrega_ext.php>, <cpaint2.inc.php>, <classe_vermultilayer.php>, <classe_estatistica.php>, <funcoes_gerais.php>
80 80  
81 81 */
82   -error_reporting(0);
  82 +error_reporting(E_ALL);
83 83  
84 84 //sleep(5);
85 85  
... ... @@ -95,16 +95,20 @@ if ($funcao != &quot;criaMapa&quot;)
95 95 {
96 96 session_name("i3GeoPHP");
97 97 if (isset($g_sid) && $g_sid != "")
98   - {session_id($g_sid);}
  98 + {
  99 + session_id($g_sid);
  100 + }
99 101 session_start();
100 102 foreach(array_keys($_SESSION) as $k)
101 103 {
102 104 eval("\$".$k."='".$_SESSION[$k]."';");
103 105 }
104   - //
105   - //verifica se deve ativar o debug
106   - //
  106 + if (md5('I3GEOSEC' . $_SERVER['HTTP_USER_AGENT'] . session_id()) != $fingerprint)
  107 + {exit;}
107 108 }
  109 +//
  110 +//verifica se deve ativar o debug
  111 +//
108 112 if (isset($debug) && $debug == "sim")
109 113 {error_reporting(E_ALL);}
110 114 //
... ...
ms_criamapa.php
  Diff comments   View file @11c4e7b
... ... @@ -199,6 +199,9 @@ $_SESSION[&quot;utilizacgi&quot;] = $utilizacgi_;
199 199 $_SESSION["tituloInstituicao"] = $tituloInstituicao_;
200 200 $_SESSION["atlasxml"] = $atlasxml;
201 201 $_SESSION["expoeMapfile"] = $expoeMapfile;
  202 +//rotina de segurança, ver http://shiflett.org/articles/the-truth-about-sessions
  203 +$fingerprint = 'I3GEOSEC' . $_SERVER['HTTP_USER_AGENT'];
  204 +$_SESSION['fingerprint'] = md5($fingerprint . session_id());
202 205 //
203 206 //pega todas as variáveis da sessão, mesmo as que foram definidas anteriormente
204 207 //
... ...