Security fix - improved access checks for task edit and deletes.

diff --git a/WEB-INF/templates/footer.tpl b/WEB-INF/templates/footer.tpl
index 2aa36a25b20965b69db654a7452415400238bb25..b9939f90ed74394ae213773bdd74bc5c06165881 100644 (file)
--- a/WEB-INF/templates/footer.tpl
+++ b/WEB-INF/templates/footer.tpl
@@ -12,7 +12,7 @@
       <br>
       <table cellspacing="0" cellpadding="4" width="100%" border="0">
         <tr>
-          <td align="center">&nbsp;Anuko Time Tracker 1.17.73.4178 | Copyright &copy; <a href="https://www.anuko.com/lp/tt_3.htm" target="_blank">Anuko</a> |
+          <td align="center">&nbsp;Anuko Time Tracker 1.17.74.4179 | Copyright &copy; <a href="https://www.anuko.com/lp/tt_3.htm" target="_blank">Anuko</a> |
             <a href="https://www.anuko.com/lp/tt_4.htm" target="_blank">{$i18n.footer.credits}</a> |
             <a href="https://www.anuko.com/lp/tt_5.htm" target="_blank">{$i18n.footer.license}</a> |
             <a href="https://www.anuko.com/lp/tt_7.htm" target="_blank">{$i18n.footer.improve}</a>

diff --git a/mobile/task_add.php b/mobile/task_add.php
index a976ac5c9217186c3a1b1ae126a08eb8041301f2..fd1fb46493df9fea6620d1c981e34ed6fe22edee 100644 (file)
--- a/mobile/task_add.php
+++ b/mobile/task_add.php
@@ -41,6 +41,7 @@ if (MODE_PROJECTS_AND_TASKS != $user->tracking_mode) {
   header('Location: feature_disabled.php');
   exit();
 }
+// End of access checks.
 
 $projects = ttTeamHelper::getActiveProjects($user->team_id);
 

diff --git a/mobile/task_delete.php b/mobile/task_delete.php
index 1146a2ac2ad3aaa4839888d7d7c53a6889b01af3..153f3a2d876af2ece3f14b350b4057e36b0e70ae 100644 (file)
--- a/mobile/task_delete.php
+++ b/mobile/task_delete.php
@@ -39,9 +39,14 @@ if (MODE_PROJECTS_AND_TASKS != $user->tracking_mode) {
   header('Location: feature_disabled.php');
   exit();
 }
-
 $cl_task_id = (int)$request->getParameter('id');
 $task = ttTaskHelper::get($cl_task_id);
+if (!$task) {
+  header('Location: access_denied.php');
+  exit();
+}
+// End of access checks.
+
 $task_to_delete = $task['name'];
 
 $form = new Form('taskDeleteForm');

diff --git a/mobile/task_edit.php b/mobile/task_edit.php
index 346899dcebe9346aec699370aff54ccccdb49d5e..f1748c7e9c36404f8775713388679f3f74c3c6db 100644 (file)
--- a/mobile/task_edit.php
+++ b/mobile/task_edit.php
@@ -40,8 +40,14 @@ if (MODE_PROJECTS_AND_TASKS != $user->tracking_mode) {
   header('Location: feature_disabled.php');
   exit();
 }
-
 $cl_task_id = (int)$request->getParameter('id');
+$task = ttTaskHelper::get($cl_task_id);
+if (!$task) {
+  header('Location: access_denied.php');
+  exit();
+}
+// End of access checks.
+
 $projects = ttTeamHelper::getActiveProjects($user->team_id);
 
 if ($request->isPost()) {
@@ -50,11 +56,9 @@ if ($request->isPost()) {
   $cl_status = $request->getParameter('status');
   $cl_projects = $request->getParameter('projects');
 } else {
-  $task = ttTaskHelper::get($cl_task_id);
   $cl_name = $task['name'];
   $cl_description = $task['description'];
   $cl_status = $task['status'];
-
   $assigned_projects = ttTaskHelper::getAssignedProjects($cl_task_id);
   foreach ($assigned_projects as $project_item)
     $cl_projects[] = $project_item['id'];

diff --git a/mobile/tasks.php b/mobile/tasks.php
index edb57089ebe81168d839331e75cf1eb236f183a3..e49498c4c25985e2b1d84ce7d5a6485669e36514 100644 (file)
--- a/mobile/tasks.php
+++ b/mobile/tasks.php
@@ -39,6 +39,7 @@ if (MODE_PROJECTS_AND_TASKS != $user->tracking_mode) {
   header('Location: feature_disabled.php');
   exit();
 }
+// End of access checks.
 
 $smarty->assign('active_tasks', ttTeamHelper::getActiveTasks($user->team_id));
 $smarty->assign('inactive_tasks', ttTeamHelper::getInactiveTasks($user->team_id));

diff --git a/mobile/time.php b/mobile/time.php
index abde5e01dc901a3b32d6f54be7c75cfbb7e525bb..8c6721d49ac5d8f2b137249fd03edd1b88c0f097 100644 (file)
--- a/mobile/time.php
+++ b/mobile/time.php
@@ -34,11 +34,12 @@ import('ttClientHelper');
 import('ttTimeHelper');
 import('DateAndTime');
 
-// Access check.
+// Access checks.
 if (!ttAccessAllowed('track_own_time')) {
   header('Location: access_denied.php');
   exit();
 }
+// End of access checks.
 
 // Initialize and store date in session.
 $cl_date = $request->getParameter('date', @$_SESSION['date']);

diff --git a/mobile/time_delete.php b/mobile/time_delete.php
index 5d6918c592c3b5b76117ffbcbd8d4e657ceb769c..399895c7a8eac84ce47c4c4b9a519ecb900feab1 100644 (file)
--- a/mobile/time_delete.php
+++ b/mobile/time_delete.php
@@ -38,13 +38,13 @@ if (!ttAccessAllowed('track_own_time')) {
   exit();
 }
 $cl_id = (int)$request->getParameter('id');
-// Get the time record we are deleting.
 $time_rec = ttTimeHelper::getRecord($cl_id, $user->getActiveUser());
 if (!$time_rec || $time_rec['invoice_id']) {
   // Prohibit deleting not ours or invoiced records.
   header('Location: access_denied.php');
   exit();
 }
+// End of access checks.
 
 // Escape comment for presentation.
 $time_rec['comment'] = htmlspecialchars($time_rec['comment']);

diff --git a/mobile/time_edit.php b/mobile/time_edit.php
index eff9b3358bc8fc971cb73ae5694b5994f5a33a49..a1a56e37ce22375bf112c55c554c38d936c648d2 100644 (file)
--- a/mobile/time_edit.php
+++ b/mobile/time_edit.php
@@ -34,19 +34,19 @@ import('ttClientHelper');
 import('ttTimeHelper');
 import('DateAndTime');
 
-// Access check.
+// Access checks.
 if (!ttAccessAllowed('track_own_time')) {
   header('Location: access_denied.php');
   exit();
 }
 $cl_id = (int)$request->getParameter('id');
-// Get the time record we are editing.
 $time_rec = ttTimeHelper::getRecord($cl_id, $user->getActiveUser());
 if (!$time_rec || $time_rec['invoice_id']) {
   // Prohibit editing not ours or invoiced records.
   header('Location: access_denied.php');
   exit();
 }
+// End of access checks.
 
 // Use custom fields plugin if it is enabled.
 if ($user->isPluginEnabled('cf')) {

diff --git a/mobile/user_add.php b/mobile/user_add.php
index 838981de4786c0f838be225d313f824c77c10810..53b9842fabd31693a6f6c70186fede0ef9e9d346 100644 (file)
--- a/mobile/user_add.php
+++ b/mobile/user_add.php
@@ -33,11 +33,12 @@ import('ttUserHelper');
 import('form.Table');
 import('form.TableColumn');
 
-// Access check.
+// Access checks.
 if (!ttAccessAllowed('manage_users')) {
   header('Location: access_denied.php');
   exit();
 }
+// End of access checks.
 
 // Use the "limit" plugin if we have one. Ignore include errors.
 // The "limit" plugin is not required for normal operation of the Time Tracker.

diff --git a/mobile/user_delete.php b/mobile/user_delete.php
index 4c9aad878cc3cab3b5aea5b36d9620da25e27f11..b5c8dae120bf0be631f4d9c380a8aca32f42128e 100644 (file)
--- a/mobile/user_delete.php
+++ b/mobile/user_delete.php
@@ -30,12 +30,12 @@ require_once('../initialize.php');
 import('form.Form');
 import('ttUserHelper');
 
-// Access check.
+// Access checks.
 if (!ttAccessAllowed('manage_users')) {
   header('Location: access_denied.php');
   exit();
 }
-$user_id = (int) $request->getParameter('id');
+$user_id = (int)$request->getParameter('id');
 $user_details = $user->getUser($user_id);
 if (!$user_details) {
   header('Location: access_denied.php');

diff --git a/mobile/user_edit.php b/mobile/user_edit.php
index 3baaf1e93dd0c4f893aa71bced5859f65d3540e7..f82d9314ad35c92e8626f1f72d62bb0d1a52431c 100644 (file)
--- a/mobile/user_edit.php
+++ b/mobile/user_edit.php
@@ -34,12 +34,12 @@ import('ttUserHelper');
 import('form.Table');
 import('form.TableColumn');
 
-// Access check.
+// Access checks.
 if (!ttAccessAllowed('manage_users')) {
   header('Location: access_denied.php');
   exit();
 }
-$user_id = (int) $request->getParameter('id');
+$user_id = (int)$request->getParameter('id');
 $user_details = $user->getUser($user_id);
 if (!$user_details) {
   header('Location: access_denied.php');

diff --git a/mobile/users.php b/mobile/users.php
index 67654376e3b12926fd2e9c62565d59b5d6804a3c..18ad2e5fa3f2fc55c67ebd8d46aad6da5c26faed 100644 (file)
--- a/mobile/users.php
+++ b/mobile/users.php
@@ -31,11 +31,12 @@ import('form.Form');
 import('ttTeamHelper');
 import('ttTimeHelper');
 
-// Access check.
+// Access checks.
 if (!(ttAccessAllowed('view_users') || ttAccessAllowed('manage_users'))) {
   header('Location: access_denied.php');
   exit();
 }
+// End of access checks.
 
 // Get users.
 $active_users = ttTeamHelper::getActiveUsers(array('getAllFields'=>true));

diff --git a/task_add.php b/task_add.php
index a5149e8407ae31a80bc8742d44ab108a98bb09db..eaaba5e8d27d2c22633bdb539a5c9d45a883e5a0 100644 (file)
--- a/task_add.php
+++ b/task_add.php
@@ -41,6 +41,7 @@ if (MODE_PROJECTS_AND_TASKS != $user->tracking_mode) {
   header('Location: feature_disabled.php');
   exit();
 }
+// End of access checks.
 
 $projects = ttTeamHelper::getActiveProjects($user->team_id);
 

diff --git a/task_delete.php b/task_delete.php
index 0e9f40cfe5e790bb64a653b36b5bd518b07684a9..d8e14399fc58b3b49bd9e84a40fe56ad5ffaf5c5 100644 (file)
--- a/task_delete.php
+++ b/task_delete.php
@@ -39,9 +39,14 @@ if (MODE_PROJECTS_AND_TASKS != $user->tracking_mode) {
   header('Location: feature_disabled.php');
   exit();
 }
-
 $cl_task_id = (int)$request->getParameter('id');
 $task = ttTaskHelper::get($cl_task_id);
+if (!$task) {
+  header('Location: access_denied.php');
+  exit();
+}
+// End of access checks.
+
 $task_to_delete = $task['name'];
 
 $form = new Form('taskDeleteForm');

diff --git a/task_edit.php b/task_edit.php
index bba89bebdb91ff1fa4341f9e66964b1b2004d65d..324f1dbb8e3068215169c26e3cdd870a40c5355c 100644 (file)
--- a/task_edit.php
+++ b/task_edit.php
@@ -40,8 +40,14 @@ if (MODE_PROJECTS_AND_TASKS != $user->tracking_mode) {
   header('Location: feature_disabled.php');
   exit();
 }
-
 $cl_task_id = (int)$request->getParameter('id');
+$task = ttTaskHelper::get($cl_task_id);
+if (!$task) {
+  header('Location: access_denied.php');
+  exit();
+}
+// End of access checks.
+
 $projects = ttTeamHelper::getActiveProjects($user->team_id);
 
 if ($request->isPost()) {
@@ -50,11 +56,9 @@ if ($request->isPost()) {
   $cl_status = $request->getParameter('status');
   $cl_projects = $request->getParameter('projects');
 } else {
-  $task = ttTaskHelper::get($cl_task_id);
   $cl_name = $task['name'];
   $cl_description = $task['description'];
   $cl_status = $task['status'];
-
   $assigned_projects = ttTaskHelper::getAssignedProjects($cl_task_id);
   foreach ($assigned_projects as $project_item)
     $cl_projects[] = $project_item['id'];

diff --git a/tasks.php b/tasks.php
index 5505e6dddab5d3e7abc19272a39d7d07441089c7..2d310d0114e219b20c0f460910b24c353b068648 100644 (file)
--- a/tasks.php
+++ b/tasks.php
@@ -39,6 +39,7 @@ if (MODE_PROJECTS_AND_TASKS != $user->tracking_mode) {
   header('Location: feature_disabled.php');
   exit();
 }
+// End of access checks.
 
 $smarty->assign('active_tasks', ttTeamHelper::getActiveTasks($user->team_id));
 $smarty->assign('inactive_tasks', ttTeamHelper::getInactiveTasks($user->team_id));

diff --git a/time.php b/time.php
index 98a383fdd8d1533d158debc820c2c9c91970260b..d75854c831e7bb2ea80da92aa82b116a00a1cbd3 100644 (file)
--- a/time.php
+++ b/time.php
@@ -34,13 +34,6 @@ import('ttClientHelper');
 import('ttTimeHelper');
 import('DateAndTime');
 
-// This is a now removed check whether user browser supports cookies.
-// if (!isset($_COOKIE['tt_PHPSESSID'])) {
-  // This test gives a false-positive if user goes directly to this page
-  // as from a desktop shortcut (on first request only).
-  // die ("Your browser's cookie functionality is turned off. Please turn it on.");
-// }
-
 // Access checks.
 if (!(ttAccessAllowed('track_own_time') || ttAccessAllowed('track_time'))) {
   header('Location: access_denied.php');
@@ -54,6 +47,7 @@ if (!$user->behalf_id && !$user->can('track_own_time') && !$user->adjustBehalfId
   header('Location: access_denied.php'); // Trying as self, but no right for self, and noone to work on behalf.
   exit();
 }
+// End of access checks.
 
 // Initialize and store date in session.
 $cl_date = $request->getParameter('date', @$_SESSION['date']);

diff --git a/time_delete.php b/time_delete.php
index 060311e8776bdc09c1f5c846f9e2f53e2451e035..5d721ab1f4fd882a7eb599095c2297172959cf07 100644 (file)
--- a/time_delete.php
+++ b/time_delete.php
@@ -38,13 +38,13 @@ if (!(ttAccessAllowed('track_own_time') || ttAccessAllowed('track_time'))) {
   exit();
 }
 $cl_id = (int)$request->getParameter('id');
-// Get the time record we are deleting.
 $time_rec = ttTimeHelper::getRecord($cl_id, $user->getActiveUser());
 if (!$time_rec || $time_rec['invoice_id']) {
   // Prohibit deleting not ours or invoiced records.
   header('Location: access_denied.php');
   exit();
 }
+// End of access checks.
 
 // Escape comment for presentation.
 $time_rec['comment'] = htmlspecialchars($time_rec['comment']);

diff --git a/time_edit.php b/time_edit.php
index 05db97c02f76a51f16d449cffffeb1b654201f8c..507f28abb7848292ee1962d0154dc1dd7194bb1f 100644 (file)
--- a/time_edit.php
+++ b/time_edit.php
@@ -40,13 +40,13 @@ if (!(ttAccessAllowed('track_own_time') || ttAccessAllowed('track_time'))) {
   exit();
 }
 $cl_id = (int)$request->getParameter('id');
-// Get the time record we are editing.
 $time_rec = ttTimeHelper::getRecord($cl_id, $user->getActiveUser());
 if (!$time_rec || $time_rec['invoice_id']) {
   // Prohibit editing not ours or invoiced records.
   header('Location: access_denied.php');
   exit();
 }
+// End of access checks.
 
 // Use custom fields plugin if it is enabled.
 if ($user->isPluginEnabled('cf')) {

diff --git a/tofile.php b/tofile.php
index abd1f278bd855ea0ed87479f690c53fb17da2cd4..e7b9ed963b4fbab166135ae48d15c52395f3f7a4 100644 (file)
--- a/tofile.php
+++ b/tofile.php
@@ -31,11 +31,12 @@ import('form.Form');
 import('form.ActionForm');
 import('ttReportHelper');
 
-// Access check.
+// Access checks.
 if (!(ttAccessAllowed('view_own_reports') || ttAccessAllowed('view_reports'))) {
   header('Location: access_denied.php');
   exit();
 }
+// End of access checks.
 
 // Use custom fields plugin if it is enabled.
 if ($user->isPluginEnabled('cf')) {

diff --git a/topdf.php b/topdf.php
index 3177d155973b8e67c6c7845858e97c3948a3fb96..475522ef9ca87cb6dbe121929f48cabf3d583268 100644 (file)
--- a/topdf.php
+++ b/topdf.php
@@ -35,11 +35,12 @@ import('form.Form');
 import('form.ActionForm');
 import('ttReportHelper');
 
-// Access check.
+// Access checks.
 if (!(ttAccessAllowed('view_own_reports') || ttAccessAllowed('view_reports'))) {
   header('Location: access_denied.php');
   exit();
 }
+// End of access checks.
 
 // Check whether TCPDF library is available.
 if (!file_exists('WEB-INF/lib/tcpdf/'))

diff --git a/user_add.php b/user_add.php
index 91286537d534e2191c7eb27d0df03c174272705b..b235cbd17eb81817da85f686b63af2dfbd380319 100644 (file)
--- a/user_add.php
+++ b/user_add.php
@@ -34,11 +34,12 @@ import('form.Table');
 import('form.TableColumn');
 import('ttRoleHelper');
 
-// Access check.
+// Access checks.
 if (!ttAccessAllowed('manage_users')) {
   header('Location: access_denied.php');
   exit();
 }
+// End of access checks.
 
 // Use the "limit" plugin if we have one. Ignore include errors.
 // The "limit" plugin is not required for normal operation of the Time Tracker.

diff --git a/user_delete.php b/user_delete.php
index d06463b8a68fd24d980be546e5a2c190d0ddea5b..647f21728b8df17c03be161edcb981e8f2bf229a 100644 (file)
--- a/user_delete.php
+++ b/user_delete.php
@@ -35,7 +35,7 @@ if (!ttAccessAllowed('manage_users')) {
   header('Location: access_denied.php');
   exit();
 }
-$user_id = (int) $request->getParameter('id');
+$user_id = (int)$request->getParameter('id');
 $user_details = $user->getUser($user_id);
 if (!$user_details) {
   header('Location: access_denied.php');

diff --git a/user_edit.php b/user_edit.php
index 8f588db97594d19c98305e72bec90bba7b4890f6..95ed29e796686800c6e9f88de3e0af11fba59bf0 100644 (file)
--- a/user_edit.php
+++ b/user_edit.php
@@ -40,7 +40,7 @@ if (!ttAccessAllowed('manage_users')) {
   header('Location: access_denied.php');
   exit();
 }
-$user_id = (int) $request->getParameter('id');
+$user_id = (int)$request->getParameter('id');
 $user_details = $user->getUser($user_id);
 if (!$user_details) {
   header('Location: access_denied.php');

diff --git a/users.php b/users.php
index 8787844b45c970a92b572c73efa983bb90549010..af5389021e53487906edd52b40d94a9da217e35f 100644 (file)
--- a/users.php
+++ b/users.php
@@ -32,11 +32,12 @@ import('ttTeamHelper');
 import('ttTimeHelper');
 import('ttRoleHelper');
 
-// Access check.
+// Access checks.
 if (!(ttAccessAllowed('view_users') || ttAccessAllowed('manage_users'))) {
   header('Location: access_denied.php');
   exit();
 }
+// End of access checks.
 
 // Prepare a list of active users.
 if ($user->can('view_users'))

diff --git a/week.php b/week.php
index 741a2bb4e28c901a89c2817908a081fa2a18e33e..1d72ce400a14426bb0c3be7a31621c12d41b8cc9 100644 (file)
--- a/week.php
+++ b/week.php
@@ -55,6 +55,7 @@ if (!$user->behalf_id && !$user->can('track_own_time') && !$user->adjustBehalfId
   header('Location: access_denied.php'); // Trying as self, but no right for self, and noone to work on behalf.
   exit();
 }
+// End of access checks.
 
 // Initialize and store date in session.
 $cl_date = $request->getParameter('date', @$_SESSION['date']);