Update class.security.php

aj-techsoul · web-flow · commit 8e07bb8c03b0 · 2024-05-07T15:59:06.000+05:30
diff --git a/ELI/classes/class.security.php b/ELI/classes/class.security.php
@@ -27,7 +27,7 @@ function encrypt($text,$return=true){
 
   function decrypt($token,$return=true){
 
-      if(strlen(trim($token)) > 0){
+      if(isset($token) && strlen(trim($token)) > 0){
           $sn = -1;  
           $splitnumber = substr($token,-32);
           if(strlen($splitnumber)==32){
@@ -87,7 +87,7 @@ function csrf()
 
   function check_csrf($csrf_got)
     {
-        if ($_SESSION['token'] == self::decrypt($csrf_got))
+        if($_SESSION['token'] == self::decrypt($csrf_got) OR $_SESSION['token'] == $csrf_got)
         {
             return TRUE;
         }

Original file line number	Diff line number	Diff line change
`@@ -27,7 +27,7 @@ function encrypt($text,$return=true){`
`27`	`27`
`28`	`28`	`function decrypt($token,$return=true){`
`29`	`29`
`30`		`- if(strlen(trim($token)) > 0){`
	`30`	`+ if(isset($token) && strlen(trim($token)) > 0){`
`31`	`31`	`$sn = -1;`
`32`	`32`	`$splitnumber = substr($token,-32);`
`33`	`33`	`if(strlen($splitnumber)==32){`
`@@ -87,7 +87,7 @@ function csrf()`
`87`	`87`
`88`	`88`	`function check_csrf($csrf_got)`
`89`	`89`	`{`
`90`		`- if ($_SESSION['token'] == self::decrypt($csrf_got))`
	`90`	`+ if($_SESSION['token'] == self::decrypt($csrf_got) OR $_SESSION['token'] == $csrf_got)`
`91`	`91`	`{`
`92`	`92`	`return TRUE;`
`93`	`93`	`}`