fanbinit/rhymix
1
0
Fork 0
mirror of https://github.com/Lastorder-DC/rhymix.git synced 2026-05-09 03:52:15 +09:00
Code Issues Projects Releases Packages Wiki Activity

Use local variable instead of class property to handle member info

Browse source 
회원정보를 다룰 때 너도나도 $this->memberInfo를 덮어쓰기 때문에
이게 도대체 어디서 온 변수인지 신뢰할 수가 없음.
심지어 로그인에 실패해도 $this->memberInfo는 그대로 남아 있음.

잘못 사용할 경우 심각한 보안 문제가 발생할 수 있으므로
클래스 속성을 공유하지 않고 각 메소드에서 로컬 변수만 사용하도록 변경함.
회원정보를 반드시 서로 공유해야 하는 경우 Context::get('logged_info')를 사용함.
This commit is contained in:
Kijin Sung 2017-03-03 00:59:42 +09:00
parent 90590829d6
commit a67a78ebba
1 changed files with 47 additions and 93 deletions
Download patch file Download diff file Expand all files Collapse all files

128
modules/member/member.controller.php
View file

@ -7,13 +7,6 @@
*/ */
class memberController extends member class memberController extends member
{ {
/**
* Info of selected member
*
* @var object
*/
var $memberInfo;
/** /**
* Initialization * Initialization
* *
@ -57,6 +50,7 @@ class memberController extends member
$oModuleModel = getModel('module'); $oModuleModel = getModel('module');
$config = $oModuleModel->getModuleConfig('member'); $config = $oModuleModel->getModuleConfig('member');
$member_info = Context::get('logged_info');
// Check change_password_date // Check change_password_date
$limit_date = $config->change_password_date; $limit_date = $config->change_password_date;
@ -65,7 +59,7 @@ class memberController extends member
if($limit_date > 0) if($limit_date > 0)
{ {
$oMemberModel = getModel('member'); $oMemberModel = getModel('member');
if($this->memberInfo->change_password_date < date ('YmdHis', strtotime ('-' . $limit_date . ' day'))) if($member_info->change_password_date < date ('YmdHis', strtotime ('-' . $limit_date . ' day')))
{ {
$msg = sprintf(lang('msg_change_password_date'), $limit_date); $msg = sprintf(lang('msg_change_password_date'), $limit_date);
return $this->setRedirectUrl(getNotEncodedUrl('','vid',Context::get('vid'),'mid',Context::get('mid'),'act','dispMemberModifyPassword'), new Object(-1, $msg)); return $this->setRedirectUrl(getNotEncodedUrl('','vid',Context::get('vid'),'mid',Context::get('mid'),'act','dispMemberModifyPassword'), new Object(-1, $msg));
@ -74,7 +68,7 @@ class memberController extends member
// Delete all previous authmail if login is successful // Delete all previous authmail if login is successful
$args = new stdClass(); $args = new stdClass();
$args->member_srl = $this->memberInfo->member_srl; $args->member_srl = $member_info->member_srl;
executeQuery('member.deleteAuthMail', $args); executeQuery('member.deleteAuthMail', $args);
if(!$config->after_login_url) if(!$config->after_login_url)
@ -545,18 +539,14 @@ class memberController extends member
$oMemberModel = getModel('member'); $oMemberModel = getModel('member');
if(!$this->memberInfo->password)
{
// Get information of logged-in user // Get information of logged-in user
$logged_info = Context::get('logged_info'); $logged_info = Context::get('logged_info');
$member_srl = $logged_info->member_srl; $member_srl = $logged_info->member_srl;
$columnList = array('member_srl', 'password'); $columnList = array('member_srl', 'password');
$memberInfo = $oMemberModel->getMemberInfoByMemberSrl($member_srl, 0, $columnList); $member_info = $oMemberModel->getMemberInfoByMemberSrl($member_srl, 0, $columnList);
$this->memberInfo->password = $memberInfo->password;
}
// Verify the current password // Verify the current password
if(!$oMemberModel->isValidPassword($this->memberInfo->password, $password)) if(!$oMemberModel->isValidPassword($member_info->password, $password))
{ {
return new Object(-1, 'invalid_password'); return new Object(-1, 'invalid_password');
} }
@ -698,10 +688,10 @@ class memberController extends member
$this->putSignature($args->member_srl, $signature); $this->putSignature($args->member_srl, $signature);
// Get user_id information // Get user_id information
$this->memberInfo = $oMemberModel->getMemberInfoByMemberSrl($args->member_srl); $member_info = $oMemberModel->getMemberInfoByMemberSrl($args->member_srl);
// Call a trigger after successfully modified (after) // Call a trigger after successfully modified (after)
ModuleHandler::triggerCall('member.procMemberModifyInfo', 'after', $this->memberInfo); ModuleHandler::triggerCall('member.procMemberModifyInfo', 'after', $member_info);
$this->setSessionInfo(); $this->setSessionInfo();
// Return result // Return result
@ -779,14 +769,10 @@ class memberController extends member
// Create a member model object // Create a member model object
$oMemberModel = getModel('member'); $oMemberModel = getModel('member');
// Get information of member_srl // Get information of member_srl
if(!$this->memberInfo->password)
{
$columnList = array('member_srl', 'password'); $columnList = array('member_srl', 'password');
$memberInfo = $oMemberModel->getMemberInfoByMemberSrl($member_srl, 0, $columnList); $member_info = $oMemberModel->getMemberInfoByMemberSrl($member_srl, 0, $columnList);
$this->memberInfo->password = $memberInfo->password;
}
// Verify the cuttent password // Verify the cuttent password
if(!$oMemberModel->isValidPassword($this->memberInfo->password, $password)) return new Object(-1, 'invalid_password'); if(!$oMemberModel->isValidPassword($member_info->password, $password)) return new Object(-1, 'invalid_password');
$output = $this->deleteMember($member_srl); $output = $this->deleteMember($member_srl);
if(!$output->toBool()) return $output; if(!$output->toBool()) return $output;
@ -1781,17 +1767,17 @@ class memberController extends member
if($config->identifier == 'email_address' || strpos($user_id, '@') !== false) if($config->identifier == 'email_address' || strpos($user_id, '@') !== false)
{ {
// Get user_id information // Get user_id information
$this->memberInfo = $oMemberModel->getMemberInfoByEmailAddress($user_id); $member_info = $oMemberModel->getMemberInfoByEmailAddress($user_id);
// Set an invalid user if no value returned // Set an invalid user if no value returned
if(!$user_id || strtolower($this->memberInfo->email_address) != strtolower($user_id)) return $this->recordLoginError(-1, 'invalid_email_address'); if(!$user_id || strtolower($member_info->email_address) != strtolower($user_id)) return $this->recordLoginError(-1, 'invalid_email_address');
} }
else else
{ {
// Get user_id information // Get user_id information
$this->memberInfo = $oMemberModel->getMemberInfoByUserID($user_id); $member_info = $oMemberModel->getMemberInfoByUserID($user_id);
// Set an invalid user if no value returned // Set an invalid user if no value returned
if(!$user_id || strtolower($this->memberInfo->user_id) != strtolower($user_id)) return $this->recordLoginError(-1, 'invalid_user_id'); if(!$user_id || strtolower($member_info->user_id) != strtolower($user_id)) return $this->recordLoginError(-1, 'invalid_user_id');
} }
$output = executeQuery('member.getLoginCountByIp', $args); $output = executeQuery('member.getLoginCountByIp', $args);
@ -1818,36 +1804,36 @@ class memberController extends member
} }
// Password Check // Password Check
if($password && !$oMemberModel->isValidPassword($this->memberInfo->password, $password, $this->memberInfo->member_srl)) if($password && !$oMemberModel->isValidPassword($member_info->password, $password, $member_info->member_srl))
{ {
return $this->recordMemberLoginError(-1, 'invalid_password',$this->memberInfo); return $this->recordMemberLoginError(-1, 'invalid_password', $member_info);
} }
// If denied == 'Y', notify // If denied == 'Y', notify
if($this->memberInfo->denied == 'Y') if($member_info->denied == 'Y')
{ {
$args->member_srl = $this->memberInfo->member_srl; $args->member_srl = $member_info->member_srl;
$output = executeQuery('member.chkAuthMail', $args); $output = executeQuery('member.chkAuthMail', $args);
if ($output->toBool() && $output->data->count != '0') if ($output->toBool() && $output->data->count != '0')
{ {
$_SESSION['auth_member_srl'] = $this->memberInfo->member_srl; $_SESSION['auth_member_srl'] = $member_info->member_srl;
$redirectUrl = getUrl('', 'act', 'dispMemberResendAuthMail'); $redirectUrl = getUrl('', 'act', 'dispMemberResendAuthMail');
return $this->setRedirectUrl($redirectUrl, new Object(-1,'msg_user_not_confirmed')); return $this->setRedirectUrl($redirectUrl, new Object(-1,'msg_user_not_confirmed'));
} }
$refused_reason = $this->memberInfo->refused_reason ? ('<br>' . lang('refused_reason') . ': ' . $this->memberInfo->refused_reason) : ''; $refused_reason = $member_info->refused_reason ? ('<br>' . lang('refused_reason') . ': ' . $member_info->refused_reason) : '';
return new Object(-1, lang('msg_user_denied') . $refused_reason); return new Object(-1, lang('msg_user_denied') . $refused_reason);
} }
// Notify if user is limited // Notify if user is limited
if($this->memberInfo->limit_date && substr($this->memberInfo->limit_date,0,8) >= date("Ymd")) if($member_info->limit_date && substr($member_info->limit_date,0,8) >= date("Ymd"))
{ {
$limited_reason = $this->memberInfo->limited_reason ? ('<br>' . lang('refused_reason') . ': ' . $this->memberInfo->limited_reason) : ''; $limited_reason = $member_info->limited_reason ? ('<br>' . lang('refused_reason') . ': ' . $member_info->limited_reason) : '';
return new Object(-9, sprintf(lang('msg_user_limited'), zdate($this->memberInfo->limit_date,"Y-m-d")) . $limited_reason); return new Object(-9, sprintf(lang('msg_user_limited'), zdate($member_info->limit_date,"Y-m-d")) . $limited_reason);
} }
// Do not allow login as admin if not in allowed IP list // Do not allow login as admin if not in allowed IP list
if($this->memberInfo->is_admin === 'Y' && $this->act === 'procMemberLogin') if($member_info->is_admin === 'Y' && $this->act === 'procMemberLogin')
{ {
$oMemberAdminModel = getAdminModel('member'); $oMemberAdminModel = getAdminModel('member');
if(!$oMemberAdminModel->getMemberAdminIPCheck()) if(!$oMemberAdminModel->getMemberAdminIPCheck())
@ -1857,7 +1843,7 @@ class memberController extends member
} }
// Update the latest login time // Update the latest login time
$args->member_srl = $this->memberInfo->member_srl; $args->member_srl = $member_info->member_srl;
$output = executeQuery('member.updateLastLogin', $args); $output = executeQuery('member.updateLastLogin', $args);
$site_module_info = Context::get('site_module_info'); $site_module_info = Context::get('site_module_info');
@ -1887,15 +1873,15 @@ class memberController extends member
$oCommunicationController = getController('communication'); $oCommunicationController = getController('communication');
$oCommunicationController->sendMessage($args->member_srl, $args->member_srl, $title, $content, true); $oCommunicationController->sendMessage($args->member_srl, $args->member_srl, $title, $content, true);
if($this->memberInfo->email_address && $this->memberInfo->allow_mailing == 'Y') if($member_info->email_address && $member_info->allow_mailing == 'Y')
{ {
$view_url = Context::getRequestUri(); $view_url = Context::getRequestUri();
$content = sprintf("%s<hr /><p>From: <a href=\"%s\" target=\"_blank\">%s</a><br />To: %s(%s)</p>",$content, $view_url, $view_url, $this->memberInfo->nick_name, $this->memberInfo->email_id); $content = sprintf("%s<hr /><p>From: <a href=\"%s\" target=\"_blank\">%s</a><br />To: %s(%s)</p>",$content, $view_url, $view_url, $member_info->nick_name, $member_info->email_id);
$oMail = new Mail(); $oMail = new Mail();
$oMail->setTitle($title); $oMail->setTitle($title);
$oMail->setContent($content); $oMail->setContent($content);
$oMail->setSender($config->webmaster_name?$config->webmaster_name:'webmaster', $config->webmaster_email); $oMail->setSender($config->webmaster_name?$config->webmaster_name:'webmaster', $config->webmaster_email);
$oMail->setReceiptor($this->memberInfo->email_id.'('.$this->memberInfo->nick_name.')', $this->memberInfo->email_address); $oMail->setReceiptor($member_info->email_id.'('.$member_info->nick_name.')', $member_info->email_address);
$oMail->send(); $oMail->send();
} }
$output = executeQuery('member.deleteLoginCountHistoryByMemberSrl', $args); $output = executeQuery('member.deleteLoginCountHistoryByMemberSrl', $args);
@ -1904,7 +1890,7 @@ class memberController extends member
} }
// Call a trigger after successfully log-in (after) // Call a trigger after successfully log-in (after)
ModuleHandler::triggerCall('member.doLogin', 'after', $this->memberInfo); ModuleHandler::triggerCall('member.doLogin', 'after', $member_info);
// When user checked to use auto-login // When user checked to use auto-login
if($keep_signed) if($keep_signed)
@ -1913,7 +1899,7 @@ class memberController extends member
$autologin_args = new stdClass; $autologin_args = new stdClass;
$autologin_args->autologin_key = substr($random_key, 0, 24); $autologin_args->autologin_key = substr($random_key, 0, 24);
$autologin_args->security_key = base64_encode(hash_hmac('sha256', substr($random_key, 24, 24), $autologin_args->autologin_key, true)); $autologin_args->security_key = base64_encode(hash_hmac('sha256', substr($random_key, 24, 24), $autologin_args->autologin_key, true));
$autologin_args->member_srl = $this->memberInfo->member_srl; $autologin_args->member_srl = $member_info->member_srl;
$autologin_args->user_agent = json_encode(Rhymix\Framework\UA::getBrowserInfo()); $autologin_args->user_agent = json_encode(Rhymix\Framework\UA::getBrowserInfo());
$autologin_output = executeQuery('member.insertAutologin', $autologin_args); $autologin_output = executeQuery('member.insertAutologin', $autologin_args);
if ($autologin_output->toBool()) if ($autologin_output->toBool())
@ -1922,7 +1908,7 @@ class memberController extends member
} }
} }
Rhymix\Framework\Session::login($this->memberInfo->member_srl); Rhymix\Framework\Session::login($member_info->member_srl);
$this->setSessionInfo(); $this->setSessionInfo();
return $output; return $output;
} }
@ -1933,38 +1919,15 @@ class memberController extends member
function setSessionInfo() function setSessionInfo()
{ {
// If your information came through the current session information to extract information from the users // If your information came through the current session information to extract information from the users
if(!$this->memberInfo && Rhymix\Framework\Session::getMemberSrl()) $member_info = Rhymix\Framework\Session::getMemberInfo();
{ if (!$member_info->member_srl)
$this->memberInfo = Rhymix\Framework\Session::getMemberInfo();
}
if(!$this->memberInfo->member_srl)
{ {
return; return;
} }
// Log in for treatment sessions set
/*
$_SESSION['is_logged'] = true;
$_SESSION['member_srl'] = $_SESSION['RHYMIX']['login'] = $this->memberInfo->member_srl;
$_SESSION['is_admin'] = '';
*/
// Do not save your password in the session jiwojum;;
//unset($this->memberInfo->password);
// User Group Settings
/*
if($this->memberInfo->group_list) {
$group_srl_list = array_keys($this->memberInfo->group_list);
$_SESSION['group_srls'] = $group_srl_list;
// If the group is designated as an administrator administrator
$oMemberModel = getModel('member');
$admin_group = $oMemberModel->getAdminGroup();
if($admin_group->group_srl && in_array($admin_group->group_srl, $group_srl_list)) $_SESSION['is_admin'] = 'Y';
}
*/
// Information stored in the session login user // Information stored in the session login user
Context::set('is_logged', true); Context::set('is_logged', true);
Context::set('logged_info', $this->memberInfo); Context::set('logged_info', $member_info);
// Only the menu configuration of the user (such as an add-on to the menu can be changed) // Only the menu configuration of the user (such as an add-on to the menu can be changed)
$config = getModel('member')->getMemberConfig(); $config = getModel('member')->getMemberConfig();
@ -2297,8 +2260,10 @@ class memberController extends member
$config = $oMemberModel->getMemberConfig(); $config = $oMemberModel->getMemberConfig();
$logged_info = Context::get('logged_info'); $logged_info = Context::get('logged_info');
// Get what you want to modify the original information // Get what you want to modify the original information
if(!$this->memberInfo) $this->memberInfo = $oMemberModel->getMemberInfoByMemberSrl($args->member_srl); $orgMemberInfo = $oMemberModel->getMemberInfoByMemberSrl($args->member_srl);
// Control of essential parameters // Control of essential parameters
if($args->allow_mailing!='Y') $args->allow_mailing = 'N'; if($args->allow_mailing!='Y') $args->allow_mailing = 'N';
if($args->allow_message && !in_array($args->allow_message, array('Y','N','F'))) $args->allow_message = 'Y'; if($args->allow_message && !in_array($args->allow_message, array('Y','N','F'))) $args->allow_message = 'Y';
@ -2386,9 +2351,6 @@ class memberController extends member
} }
} }
$output = executeQuery('member.getMemberInfoByMemberSrl', $args);
$orgMemberInfo = $output->data;
// Check managed Email Host // Check managed Email Host
if($logged_info->is_admin !== 'Y' && $oMemberModel->isDeniedEmailHost($args->email_address)) if($logged_info->is_admin !== 'Y' && $oMemberModel->isDeniedEmailHost($args->email_address))
{ {
@ -2537,13 +2499,9 @@ class memberController extends member
$oDB->commit(); $oDB->commit();
//remove from cache // Remove from cache
$this->_clearMemberCache($args->member_srl, $args->site_srl); $this->_clearMemberCache($args->member_srl, $args->site_srl);
// Save Session
if(!$this->memberInfo) $this->memberInfo = $oMemberModel->getMemberInfoByMemberSrl($args->member_srl);
$logged_info = Context::get('logged_info');
$output->add('member_srl', $args->member_srl); $output->add('member_srl', $args->member_srl);
return $output; return $output;
} }
@ -2555,7 +2513,6 @@ class memberController extends member
{ {
if($args->password) if($args->password)
{ {
// check password strength // check password strength
$oMemberModel = getModel('member'); $oMemberModel = getModel('member');
$config = $oMemberModel->getMemberConfig(); $config = $oMemberModel->getMemberConfig();
@ -2597,14 +2554,11 @@ class memberController extends member
// Create a model object // Create a model object
$oMemberModel = getModel('member'); $oMemberModel = getModel('member');
// Bringing the user's information // Bringing the user's information
if(!$this->memberInfo || $this->memberInfo->member_srl != $member_srl || !isset($this->memberInfo->is_admin))
{
$columnList = array('member_srl', 'is_admin'); $columnList = array('member_srl', 'is_admin');
$this->memberInfo = $oMemberModel->getMemberInfoByMemberSrl($member_srl, 0, $columnList); $member_info = $oMemberModel->getMemberInfoByMemberSrl($member_srl, 0, $columnList);
} if(!$member_info) return new Object(-1, 'msg_not_exists_member');
if(!$this->memberInfo) return new Object(-1, 'msg_not_exists_member');
// If managers can not be deleted // If managers can not be deleted
if($this->memberInfo->is_admin == 'Y') return new Object(-1, 'msg_cannot_delete_admin'); if($member_info->is_admin == 'Y') return new Object(-1, 'msg_cannot_delete_admin');
$oDB = &DB::getInstance(); $oDB = &DB::getInstance();
$oDB->begin(); $oDB->begin();