fanbinit/rhymix
1
0
Fork 0
mirror of https://github.com/Lastorder-DC/rhymix.git synced 2026-01-08 19:21:40 +09:00
Code Issues Projects Releases Packages Wiki Activity

Move session and cookie security settings to "Security" tab

Browse source 
세션 및 쿠키 보안과 관련된 옵션은 "보안 설정" 탭으로 옮김
This commit is contained in:
Kijin Sung 2018-08-06 01:06:03 +09:00
parent 45851744c1
commit e58214d13a
7 changed files with 43 additions and 24 deletions
Download patch file Download diff file Expand all files Collapse all files

1
common/defaults/config.php
View file

@ -56,6 +56,7 @@ return array(
'use_db' => false,
'use_keys' => false,
'use_ssl' => false,
'use_ssl_cookies' => false,
'domain' => null,
'path' => null,
'lifetime' => 0,

5
modules/admin/admin.admin.controller.php
View file

@ -726,6 +726,9 @@ class adminAdminController extends admin
Rhymix\Framework\Config::set('admin.allow', array_values($allowed_ip));
Rhymix\Framework\Config::set('admin.deny', array_values($denied_ip));
Rhymix\Framework\Config::set('session.use_keys', $vars->use_session_keys === 'Y');
Rhymix\Framework\Config::set('session.use_ssl', $vars->use_session_ssl === 'Y');
Rhymix\Framework\Config::set('session.use_ssl_cookies', $vars->use_cookies_ssl === 'Y');
// Save
if (!Rhymix\Framework\Config::save())
@ -824,8 +827,6 @@ class adminAdminController extends admin
Rhymix\Framework\Config::set('use_rewrite', $vars->use_rewrite === 'Y');
Rhymix\Framework\Config::set('session.delay', $vars->delay_session === 'Y');
Rhymix\Framework\Config::set('session.use_db', $vars->use_db_session === 'Y');
Rhymix\Framework\Config::set('session.use_keys', $vars->use_session_keys === 'Y');
Rhymix\Framework\Config::set('session.use_ssl', $vars->use_session_ssl === 'Y');
Rhymix\Framework\Config::set('view.minify_scripts', $vars->minify_scripts ?: 'common');
Rhymix\Framework\Config::set('view.concat_scripts', $vars->concat_scripts ?: 'none');
Rhymix\Framework\Config::set('view.server_push', $vars->use_server_push === 'Y');

8
modules/admin/admin.admin.view.php
View file

@ -450,6 +450,11 @@ class adminAdminView extends admin
Context::set('admin_denied_ip', implode(PHP_EOL, $denied_ip));
Context::set('remote_addr', RX_CLIENT_IP);
// Session and cookie security settings
Context::set('use_session_keys', Rhymix\Framework\Config::get('session.use_keys'));
Context::set('use_session_ssl', Rhymix\Framework\Config::get('session.use_ssl'));
Context::set('use_cookies_ssl', Rhymix\Framework\Config::get('session.use_ssl_cookies'));
$this->setTemplateFile('config_security');
}
@ -538,8 +543,6 @@ class adminAdminView extends admin
Context::set('mobile_viewport', config('mobile.viewport') ?: 'width=device-width, initial-scale=1.0, user-scalable=yes');
Context::set('use_ssl', Rhymix\Framework\Config::get('url.ssl'));
Context::set('delay_session', Rhymix\Framework\Config::get('session.delay'));
Context::set('use_session_keys', Rhymix\Framework\Config::get('session.use_keys'));
Context::set('use_session_ssl', Rhymix\Framework\Config::get('session.use_ssl'));
Context::set('use_db_session', Rhymix\Framework\Config::get('session.use_db'));
Context::set('minify_scripts', Rhymix\Framework\Config::get('view.minify_scripts'));
Context::set('concat_scripts', Rhymix\Framework\Config::get('view.concat_scripts'));
@ -779,6 +782,7 @@ class adminAdminView extends admin
$info['session.use_db'] = config('session.use_db') ? 'true' : 'false';
$info['session.use_keys'] = config('session.use_keys') ? 'true' : 'false';
$info['session.use_ssl'] = config('session.use_ssl') ? 'true' : 'false';
$info['session.use_ssl_cookies'] = config('session.use_ssl_cookies') ? 'true' : 'false';
$info['view.concat_scripts'] = config('view.concat_scripts');
$info['view.minify_scripts'] = config('view.minify_scripts');
$info['use_rewrite'] = config('use_rewrite') ? 'true' : 'false';

4
modules/admin/lang/en.php
View file

@ -162,7 +162,9 @@ $lang->about_delay_session = 'To improve performance when using a caching proxy
$lang->use_session_keys = 'Use session security keys';
$lang->about_use_session_keys = 'Use additional security keys to guard against session theft. This setting is highly recommended if you don\'t use SSL-only sessions.<br>This setting may cause some users to become logged out.';
$lang->use_session_ssl = 'Use SSL-only session';
$lang->about_use_session_ssl = 'Prevent the session from being used on non-SSL pages.<br>This helps improve security if your site always uses SSL and your server is configured to redirect all non-SSL pages to SSL.';
$lang->about_use_session_ssl = 'Force the session to be SSL-only.<br>This helps improve security if your site always uses SSL.';
$lang->use_cookies_ssl = 'Use SSL-only cookies';
$lang->about_use_cookies_ssl = 'Force all cookies to be SSL-only.';
$lang->use_object_cache = 'Use Cache';
$lang->cache_default_ttl = 'Cache default TTL';
$lang->cache_host = 'Host';

4
modules/admin/lang/ko.php
View file

@ -163,7 +163,9 @@ $lang->about_delay_session = 'Varnish 등의 프록시 캐싱 서버 사용시
$lang->use_session_keys = '세션 보안키 사용';
$lang->about_use_session_keys = '세션 탈취를 방지하기 위한 보안키를 사용합니다. SSL 전용 세션을 사용하지 않을 경우 반드시 보안키를 사용하시기를 권장합니다.<br>사용자 환경에 따라 로그인이 풀리는 문제가 발생할 수 있습니다.';
$lang->use_session_ssl = 'SSL 전용 세션 사용';
$lang->about_use_session_ssl = '세션을 SSL 전용으로 지정하여 SSL이 아닌 페이지에서 사용할 수 없도록 합니다.<br>SSL을 항상 사용하고, SSL이 아닌 페이지 방문시 자동으로 SSL 페이지로 리다이렉트되도록 서버가 설정되어 있는 경우<br>이 옵션을 사용하면 보안이 향상됩니다. (애드온 등을 사용하여 리다이렉트하는 경우 제외)';
$lang->about_use_session_ssl = '세션을 SSL 전용으로 지정하여 SSL이 아닌 페이지에서는 사용할 수 없도록 합니다.<br>SSL을 항상 사용하도록 설정되어 있는 경우에만 활성화됩니다.';
$lang->use_cookies_ssl = 'SSL 전용 쿠키 사용';
$lang->about_use_cookies_ssl = '세션뿐 아니라 모든 쿠키를 SSL 전용으로 지정합니다.<br>SSL을 항상 사용하도록 설정되어 있는 경우에만 활성화됩니다.';
$lang->use_object_cache = '캐시 사용';
$lang->cache_default_ttl = '캐시 기본 TTL';
$lang->cache_host = '호스트';

18
modules/admin/tpl/config_advanced.html
View file

@ -105,24 +105,6 @@
<p class="x_help-block">{$lang->about_delay_session}</p>
</div>
</div>
<div class="x_control-group">
<label class="x_control-label">{$lang->use_session_keys}</label>
<div class="x_controls">
<label for="use_session_keys_y" class="x_inline"><input type="radio" name="use_session_keys" id="use_session_keys_y" value="Y" checked="checked"|cond="$use_session_keys !== false" /> {$lang->cmd_yes}</label>
<label for="use_session_keys_n" class="x_inline"><input type="radio" name="use_session_keys" id="use_session_keys_n" value="N" checked="checked"|cond="$use_session_keys === false" /> {$lang->cmd_no}</label>
<br />
<p class="x_help-block">{$lang->about_use_session_keys}</p>
</div>
</div>
<div class="x_control-group">
<label class="x_control-label">{$lang->use_session_ssl}</label>
<div class="x_controls">
<label for="use_session_ssl_y" class="x_inline"><input type="radio" name="use_session_ssl" id="use_session_ssl_y" value="Y" checked="checked"|cond="$use_session_ssl && $use_ssl === 'always'" disabled="disabled"|cond="$use_ssl !== 'always'" /> {$lang->cmd_yes}</label>
<label for="use_session_ssl_n" class="x_inline"><input type="radio" name="use_session_ssl" id="use_session_ssl_n" value="N" checked="checked"|cond="!$use_session_ssl || $use_ssl !== 'always'" disabled="disabled"|cond="$use_ssl !== 'always'" /> {$lang->cmd_no}</label>
<br />
<p class="x_help-block">{$lang->about_use_session_ssl}</p>
</div>
</div>
<div class="x_control-group">
<label class="x_control-label">{$lang->thumbnail_target}</label>
<div class="x_controls">

27
modules/admin/tpl/config_security.html
View file

@ -39,6 +39,33 @@
<p class="x_help-block">{$lang->about_admin_ip_deny}</p>
</div>
</div>
<div class="x_control-group">
<label class="x_control-label">{$lang->use_session_keys}</label>
<div class="x_controls">
<label for="use_session_keys_y" class="x_inline"><input type="radio" name="use_session_keys" id="use_session_keys_y" value="Y" checked="checked"|cond="$use_session_keys !== false" /> {$lang->cmd_yes}</label>
<label for="use_session_keys_n" class="x_inline"><input type="radio" name="use_session_keys" id="use_session_keys_n" value="N" checked="checked"|cond="$use_session_keys === false" /> {$lang->cmd_no}</label>
<br />
<p class="x_help-block">{$lang->about_use_session_keys}</p>
</div>
</div>
<div class="x_control-group">
<label class="x_control-label">{$lang->use_session_ssl}</label>
<div class="x_controls">
<label for="use_session_ssl_y" class="x_inline"><input type="radio" name="use_session_ssl" id="use_session_ssl_y" value="Y" checked="checked"|cond="$use_session_ssl && $use_ssl === 'always'" disabled="disabled"|cond="$use_ssl !== 'always'" /> {$lang->cmd_yes}</label>
<label for="use_session_ssl_n" class="x_inline"><input type="radio" name="use_session_ssl" id="use_session_ssl_n" value="N" checked="checked"|cond="!$use_session_ssl || $use_ssl !== 'always'" disabled="disabled"|cond="$use_ssl !== 'always'" /> {$lang->cmd_no}</label>
<br />
<p class="x_help-block">{$lang->about_use_session_ssl}</p>
</div>
</div>
<div class="x_control-group">
<label class="x_control-label">{$lang->use_cookies_ssl}</label>
<div class="x_controls">
<label for="use_cookies_ssl_y" class="x_inline"><input type="radio" name="use_cookies_ssl" id="use_cookies_ssl_y" value="Y" checked="checked"|cond="$use_cookies_ssl && $use_ssl === 'always'" disabled="disabled"|cond="$use_ssl !== 'always'" /> {$lang->cmd_yes}</label>
<label for="use_cookies_ssl_n" class="x_inline"><input type="radio" name="use_cookies_ssl" id="use_cookies_ssl_n" value="N" checked="checked"|cond="!$use_cookies_ssl || $use_ssl !== 'always'" disabled="disabled"|cond="$use_ssl !== 'always'" /> {$lang->cmd_no}</label>
<br />
<p class="x_help-block">{$lang->about_use_cookies_ssl}</p>
</div>
</div>
<div class="x_clearfix btnArea">
<div class="x_pull-right">
<button type="submit" class="x_btn x_btn-primary">{$lang->cmd_save}</button>