firesunCN/BlueLotus_XSSReceiver
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Version 3.3.0

Browse Source 
添加安装脚本install.php
This commit is contained in:
firesun
2016-01-28 02:19:09 +08:00
parent ba12756105
commit 03a2e79acf
18 changed files with 2116 additions and 1334 deletions
Download Patch File Download Diff File Expand all files Collapse all files

27
auth.php
View File

@@ -1,27 +1,24 @@
<?php
if(!defined('IN_XSS_PLATFORM')) {
exit('Access Denied');
if (!defined('IN_XSS_PLATFORM')) {
exit('Access Denied');
}
//设置httponly
ini_set("session.cookie_httponly", 1);
ini_set("session.cookie_httponly", 1);
session_start();
//判断登陆情况，ip和useragent是否改变，改变则强制退出
if(!(isset($_SESSION['isLogin']) && $_SESSION['isLogin']===true && isset($_SESSION['user_IP']) &&$_SESSION['user_IP']!="" &&$_SESSION['user_IP']=== $_SERVER['REMOTE_ADDR'] &&isset($_SESSION['user_agent']) &&$_SESSION['user_agent']!="" &&$_SESSION['user_agent']=== $_SERVER['HTTP_USER_AGENT'] ))
{
$_SESSION['isLogin']=false;
$_SESSION['user_IP']="";
$_SESSION['user_agent']="";
session_unset();
session_destroy();
header("Location: login.php");
exit();
if (!(isset($_SESSION['isLogin']) && $_SESSION['isLogin'] === true && isset($_SESSION['user_IP']) && $_SESSION['user_IP'] != "" && $_SESSION['user_IP'] === $_SERVER['REMOTE_ADDR'] && isset($_SESSION['user_agent']) && $_SESSION['user_agent'] != "" && $_SESSION['user_agent'] === $_SERVER['HTTP_USER_AGENT'])) {
$_SESSION['isLogin'] = false;
$_SESSION['user_IP'] = "";
$_SESSION['user_agent'] = "";
session_unset();
session_destroy();
header("Location: login.php");
exit();
}
//开启CSP
header("Content-Security-Policy: default-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; frame-src 'none'");
header("X-Content-Security-Policy: default-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; frame-src 'none'");
header("X-WebKit-CSP: default-src 'self'; style-src 'self' 'unsafe-inline';img-src 'self' data:; frame-src 'none'");
?>
header("X-WebKit-CSP: default-src 'self'; style-src 'self' 'unsafe-inline';img-src 'self' data:; frame-src 'none'");