e63a14d32a
1. 增加了ADMIN_IP_CHECK_ENABLE与XFF_ENABLE两个选项，在有反代或负载均衡的情况下可开启XFF_ENABLE，关闭ADMIN_IP_CHECK_ENABLE 2. 修复一系列bug
36 lines
1.3 KiB
PHP
36 lines
1.3 KiB
PHP
<?php
|
||
if (!defined('IN_XSS_PLATFORM')) {
|
||
exit('Access Denied');
|
||
}
|
||
|
||
require_once("functions.php");
|
||
|
||
//设置httponly
|
||
ini_set("session.cookie_httponly", 1);
|
||
session_start();
|
||
|
||
//判断登陆情况，ip和useragent是否改变，改变则强制退出
|
||
if ( !(isset($_SESSION['isLogin']) && $_SESSION['isLogin'] === true && isset($_SESSION['user_agent']) && $_SESSION['user_agent'] != "" && $_SESSION['user_agent'] === $_SERVER['HTTP_USER_AGENT']) ) {
|
||
$_SESSION['isLogin'] = false;
|
||
$_SESSION['user_IP'] = "";
|
||
$_SESSION['user_agent'] = "";
|
||
session_unset();
|
||
session_destroy();
|
||
header("Location: login.php");
|
||
exit();
|
||
}
|
||
|
||
if ( ADMIN_IP_CHECK_ENABLE && !(isset($_SESSION['user_IP']) && $_SESSION['user_IP'] != "" && $_SESSION['user_IP'] === getRealIP()) ) {
|
||
$_SESSION['isLogin'] = false;
|
||
$_SESSION['user_IP'] = "";
|
||
$_SESSION['user_agent'] = "";
|
||
session_unset();
|
||
session_destroy();
|
||
header("Location: login.php");
|
||
exit();
|
||
}
|
||
|
||
//开启CSP
|
||
header("Content-Security-Policy: default-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; frame-src 'none'");
|
||
header("X-Content-Security-Policy: default-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; frame-src 'none'");
|
||
header("X-WebKit-CSP: default-src 'self'; style-src 'self' 'unsafe-inline';img-src 'self' data:; frame-src 'none'"); |