diff --git a/docs/img/device_details.png b/docs/img/device_details.png index 6c4308fd..167a4005 100755 Binary files a/docs/img/device_details.png and b/docs/img/device_details.png differ diff --git a/front/index.php b/front/index.php index 2e347326..c64b8d1a 100755 --- a/front/index.php +++ b/front/index.php @@ -10,11 +10,24 @@ require_once $_SERVER['DOCUMENT_ROOT'] . '/php/server/db.php'; require_once $_SERVER['DOCUMENT_ROOT'] . '/php/templates/language/lang.php'; require_once $_SERVER['DOCUMENT_ROOT'] . '/php/templates/security.php'; +// capture the redirect to after log in query string if available +$redirectTo = 'devices.php'; // Default destination +if (!empty($_GET['next'])) { + $decoded = base64_decode($_GET['next']); + // Validate that it's a local path to prevent Open Redirect vulnerabilities + if (strpos($decoded, '/') === 0 && strpos($decoded, '//') !== 0) { + $redirectTo = $decoded; + } +} + $CookieSaveLoginName = 'NetAlertX_SaveLogin'; if ($nax_WebProtection != 'true') { - header('Location: devices.php'); + if (!empty($_POST['url_hash'])) { + $redirectTo .= $_POST['url_hash']; + } + header("Location: $redirectTo"); $_SESSION["login"] = 1; exit; } @@ -31,17 +44,25 @@ if (isset ($_GET["action"]) && $_GET["action"] == 'logout') // Password without Cookie check -> pass and set initial cookie if (isset ($_POST["loginpassword"]) && $nax_Password === hash('sha256',$_POST["loginpassword"])) { - header('Location: devices.php'); + if (!empty($_POST['url_hash'])) { + $redirectTo .= $_POST['url_hash']; + } + header("Location: $redirectTo"); $_SESSION["login"] = 1; if (isset($_POST['PWRemember'])) {setcookie($CookieSaveLoginName, hash('sha256',$_POST["loginpassword"]), time()+604800);} + exit; } // active Session or valid cookie (cookie not extends) if (( isset ($_SESSION["login"]) && ($_SESSION["login"] == 1)) || (isset ($_COOKIE[$CookieSaveLoginName]) && $nax_Password === $_COOKIE[$CookieSaveLoginName])) { - header('Location: devices.php'); + if (!empty($_POST['url_hash'])) { + $redirectTo .= $_POST['url_hash']; + } + header("Location: $redirectTo"); $_SESSION["login"] = 1; if (isset($_POST['PWRemember'])) {setcookie($CookieSaveLoginName, hash('sha256',$_POST["loginpassword"]), time()+604800);} + exit; } $login_headline = lang('Login_Toggle_Info_headline'); @@ -53,15 +74,15 @@ $login_icon = 'fa-info'; // no active session, cookie not checked if (isset ($_SESSION["login"]) == FALSE || $_SESSION["login"] != 1) { - if ($nax_Password === '8d969eef6ecad3c29a3a629280e686cf0c3f5d5a86aff3ca12020c923adc6c92') + if ($nax_Password === '8d969eef6ecad3c29a3a629280e686cf0c3f5d5a86aff3ca12020c923adc6c92') { $login_info = lang('Login_Default_PWD'); $login_mode = 'danger'; $login_display_mode = 'display: block;'; $login_headline = lang('Login_Toggle_Alert_headline'); $login_icon = 'fa-ban'; - } - else + } + else { $login_mode = 'info'; $login_display_mode = 'display: none;'; @@ -109,8 +130,9 @@ if (isset ($_SESSION["login"]) == FALSE || $_SESSION["login"] != 1)
= lang('Login_Box');?>
-