From e91dfdbc7549b60a6bc2decff885a26f7fbb365f Mon Sep 17 00:00:00 2001
From: vincent-peugnet <v.peugnet@free.fr>
Date: Thu, 9 Apr 2020 00:36:37 +0200
Subject: remember me with hash comparaison close #68

---
 app/class/Application.php | 32 +++++++++++++++++++++-----------
 1 file changed, 21 insertions(+), 11 deletions(-)

(limited to 'app/class/Application.php')

diff --git a/app/class/Application.php b/app/class/Application.php
index 70c899f..4ddf37e 100644
--- a/app/class/Application.php
+++ b/app/class/Application.php
@@ -41,7 +41,7 @@ class Application
 
         } else {
             if(Config::readconfig()) {
-                if(!Config::checkbasepath() || empty(Config::pagetable()) || !is_dir(Model::RENDER_DIR) || !Config::checkdomain()) {
+                if(!Config::checkbasepath() || empty(Config::pagetable()) || !is_dir(Model::RENDER_DIR) || !Config::checkdomain() || empty(Config::secretkey())) {
                     echo '<ul>';
                     if(!Config::checkbasepath()) {
                         echo '<li>Wrong path</li>';
@@ -55,6 +55,9 @@ class Application
                     if(!is_dir(Model::RENDER_DIR)) {
                         echo '<li>Render path not existing</li>';
                     }
+                    if(!is_dir(Model::RENDER_DIR)) {
+                        echo '<li>Secret Key not set or not valid</li>';
+                    }
                     echo '</ul>';
                     $this->configform();
                     exit;
@@ -84,18 +87,25 @@ class Application
         
         <form action="" method="post">
         <div>
-        <h2>
-        <label for="basepath">Path to W-CMS</label>
-        </h2>
-        <input type="text" name="configinit[basepath]"  value="<?= Config::basepath() ?>" id="basepath">
-        <p><i>Leave it empty if W-CMS is in your root folder, otherwise, indicate the subfolder(s) in witch you installed the CMS</i></p>
+            <h2>
+                <label for="basepath">Path to W-CMS</label>
+            </h2>
+            <input type="text" name="configinit[basepath]"  value="<?= Config::basepath() ?>" id="basepath">
+            <p><i>Leave it empty if W-CMS is in your root folder, otherwise, indicate the subfolder(s) in witch you installed the CMS</i></p>
         </div>
         <div>
-        <h2>
-        <label for="pagetable">Name of your database table</label>
-        </h2>
-        <input type="text" name="configinit[pagetable]"  value="<?= Config::pagetable() ?>" id="pagetable">
-        <p><i>Set the name of the first folder that is going to store all your work</i></p>
+            <h2>
+                <label for="pagetable">Name of your database table</label>
+            </h2>
+            <input type="text" name="configinit[pagetable]"  value="<?= Config::pagetable() ?>" id="pagetable">
+            <p><i>Set the name of the first folder that is going to store all your work</i></p>
+        </div>
+        <div>
+            <h2>
+                <label for="secretkey">Secret Key</label>
+            </h2>
+            <input type="text" name="configinit[secretkey]"  value="<?= bin2hex(random_bytes(10)) ?>" id="secretkey" minlength="16" maxlength="128" required>
+            <p><i>The secret key is used to secure cookies. There are no need to remind it. (16 to 128 characters)</i></p>
         </div>
         <input type="submit" value="set">
         </form>
-- 
cgit v1.2.3