fixing some security issues and harderning service

2026-05-06 08:51:51 +02:00
parent 4d8ce1da43
commit 7ae7df0a11
30 changed files with 328 additions and 124 deletions
@@ -1,3 +1,7 @@
+<?php
+include "../api/utils/security.php";
+secure_session_start();
+?>
 <!DOCTYPE html>
 <html lang="en" data-bs-theme="dark">
 <head>
@@ -6,7 +10,6 @@
  <title>Jakach Login</title>
  <?php
 	include "../assets/components.php";
-	session_start();
  ?>
 </head>
 <body>
@@ -22,8 +25,8 @@
              <!-- Submit Button -->
 		<div class="d-grid gap-2">
 		  <!-- Login Button -->
-		  <a href="/login/" class="btn btn-primary btn-lg" id="continueLink">Continue as <?php echo($_SESSION["username"]); ?></a>
-		  <a class="btn btn-outline-primary btn-lg" href="/?donotsend&send_to=<?php echo($_SESSION["end_url"]); ?>">Use another account</a>
+		  <a href="/login/" class="btn btn-primary btn-lg" id="continueLink">Continue as <?php echo(htmlspecialchars($_SESSION["username"] ?? "", ENT_QUOTES, "UTF-8")); ?></a>
+		  <a class="btn btn-outline-primary btn-lg" href="/?donotsend&send_to=<?php echo(rawurlencode($_SESSION["end_url"] ?? "/account/")); ?>">Use another account</a>
 		</div>
            </form>
          </div>
@@ -43,4 +46,3 @@ document.addEventListener("keydown", function(event) {
 </script>
 </body>
 </html>
-