stephan/ms1inscription-v5
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Implement invitation handling for account switching in mobile interface. Introduce signature validation for invite links to prevent spoofing and enhance security. Update logout redirection to support both reset and invite links. Increment version code to 4.72.803 to reflect these changes.

Browse Source
This commit is contained in:
stephan
2026-07-13 16:55:47 -04:00
parent b948f401d1
commit 8191970086
4 changed files with 133 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

91
mobile.php
View File

@ -8,6 +8,7 @@ require_once('php/inc_fx_messages.php');
require_once('php/inc_fx_compte.php');
require_once('php/inc_fx_promoteur.php');
require_once('php/inc_fx_inscriptions_gestion.php');
require_once('php/inc_fx_eve_acces_promoteur.php');
require_once('php/inc_v2_assets.php');
global $objDatabase, $vDomaine, $vPage, $vtexte_page;
@ -61,6 +62,96 @@ if (!isset($_SESSION['com_id'])) {
exit;
}
// MSIN-4401 — Lien d'invite destiné à un autre compte : forcer déconnexion.
$intInviteCom = intval($_GET['invite_com'] ?? 0);
$strInviteSig = (string)($_GET['invite_sig'] ?? '');
$intEveForInvite = 0;
if (!empty($_GET['promoteur_eve_id'])) {
$intEveForInvite = fxInscrGestionParseEveId($_GET['promoteur_eve_id']);
}
if ($intInviteCom > 0 && $intEveForInvite > 0
&& function_exists('fxEveAccesPromoteurInviteSigValid')
&& fxEveAccesPromoteurInviteSigValid($intInviteCom, $intEveForInvite, $strInviteSig)
&& intval($_SESSION['com_id']) !== $intInviteCom) {
global $objDatabase;
$arrInviteCompte = $objDatabase->fxGetRow(
'SELECT com_id, com_prenom, com_nom, com_courriel, com_login FROM inscriptions_comptes WHERE com_id = '
. $intInviteCom . ' AND com_actif = 1 LIMIT 1'
);
$strSessionLabel = trim(
(string)($_SESSION['com_info']['com_prenom'] ?? $_SESSION['com_prenom'] ?? '')
. ' '
. (string)($_SESSION['com_info']['com_nom'] ?? '')
);
if ($strSessionLabel === '') {
$strSessionLabel = (string)($_SESSION['com_info']['com_courriel'] ?? ('#' . intval($_SESSION['com_id'])));
}
$strTargetLabel = $arrInviteCompte
? trim(($arrInviteCompte['com_prenom'] ?? '') . ' ' . ($arrInviteCompte['com_nom'] ?? ''))
: '';
if ($strTargetLabel === '' && $arrInviteCompte) {
$strTargetLabel = (string)($arrInviteCompte['com_courriel'] ?? $arrInviteCompte['com_login'] ?? ('#' . $intInviteCom));
}
if ($strTargetLabel === '') {
$strTargetLabel = '#' . $intInviteCom;
}
$strTargetMail = $arrInviteCompte ? (string)($arrInviteCompte['com_courriel'] ?? '') : '';
$strReturnPath = (string)(parse_url($_SERVER['REQUEST_URI'], PHP_URL_PATH) ?: '/mobile');
$strQs = (string)(parse_url($_SERVER['REQUEST_URI'], PHP_URL_QUERY) ?: '');
if ($strQs !== '') {
$strReturnPath .= '?' . $strQs;
}
$strLogoutUrl = $vDomaine . '/logout.php?lang=' . urlencode($strLangue)
. '&return=' . rawurlencode($strReturnPath);
$strStayUrl = $vDomaine . ($strLangue === 'en' ? '/account' : '/compte');
$strMetaTitle = ($strLangue === 'fr') ? 'Inscriptions mobile' : 'Mobile registrations';
$strMetaDescription = '';
$strMetaKeywords = '';
$blnBoutonRetour = false;
$footer_script = false;
require_once('inc_header.php');
?>
<div id="page">
<div id="main">
<div class="container bg-white p-3 p-xl-4">
<div class="alert alert-warning" role="alert">
<?php if ($strLangue === 'en') { ?>
<p class="mb-2">You are currently signed in as
<strong><?php echo htmlspecialchars($strSessionLabel, ENT_QUOTES, 'UTF-8'); ?></strong>.</p>
<p class="mb-3">This invitation is for
<strong><?php echo htmlspecialchars($strTargetLabel, ENT_QUOTES, 'UTF-8'); ?></strong><?php
echo $strTargetMail !== '' ? ' (' . htmlspecialchars($strTargetMail, ENT_QUOTES, 'UTF-8') . ')' : '';
?>.
Sign out first, then sign in with that account.</p>
<?php } else { ?>
<p class="mb-2">Vous êtes actuellement connecté en tant que
<strong><?php echo htmlspecialchars($strSessionLabel, ENT_QUOTES, 'UTF-8'); ?></strong>.</p>
<p class="mb-3">Cette invitation concerne le compte
<strong><?php echo htmlspecialchars($strTargetLabel, ENT_QUOTES, 'UTF-8'); ?></strong><?php
echo $strTargetMail !== '' ? ' (' . htmlspecialchars($strTargetMail, ENT_QUOTES, 'UTF-8') . ')' : '';
?>.
Déconnectez-vous d&rsquo;abord, puis reconnectez-vous avec ce compte.</p>
<?php } ?>
<a class="btn btn-primary rounded-0 mr-2" href="<?php echo htmlspecialchars($strLogoutUrl, ENT_QUOTES, 'UTF-8'); ?>">
<?php echo ($strLangue === 'en') ? 'Sign out and continue' : 'Se déconnecter et continuer'; ?>
</a>
<a class="btn btn-outline-secondary rounded-0" href="<?php echo htmlspecialchars($strStayUrl, ENT_QUOTES, 'UTF-8'); ?>">
<?php echo ($strLangue === 'en') ? 'Stay on my current account' : 'Rester sur mon compte actuel'; ?>
</a>
</div>
</div>
</div>
</div>
<?php
require_once('inc_footer.php');
exit;
}
unset($_SESSION['affiche_pas_connexion']);
$intEveId = 0;