Bludit Community Support Forum

arfa

Update...
The version fix worked but the following – set at the head of an ajax or similar page – seems a much tidier approach; a fix.
// where are we coming from???
$secure = (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off');

if ($secure && isset($_COOKIE['__Secure-BLUDIT-KEY ...

arfa

same things with new look in admin panel.

Writing and maintaining code sets is a complex business. Keeping it lean and clean is not easy. Have a look through here...
Bludit version details
and have a poke about in bl-kernel – pretty neat and tidy.

– kusalo

arfa

Thank you Edi.
I have a version-fix in place and that works but it feels more like a patch than a fix. I will find a better solution (in time).

And good to have the 'releases' link. I looked all over gitHub but couldn't find a link-path to that.

go well – kusalo

arfa

I read in bl-kernel/helpers/session.class.php [Bludit ver 3.22]
private static $sessionName = 'BLUDIT-KEY';
Yes.
Then a bit further down...
public static function start($path, $secure) { ....
// Sets the session name to the one set above.
// [b]Use the __Secure- prefix[/b] when served over HTTPS ...

arfa

@Surreal9951

>> You need to add rules to the .htaccess file.
I wonder if you would mind sharing what you have done? Both the htaccess mods and which locations.

thx

arfa

I am trying to get my head around Bludit security. There seem to be two primary elements.
1 - session_name('BLUDIT-KEY');
2 - $_SESSION['adminToken'] = $tokenCSRF;

The first question is around versions.
In plugin.php (I tried a few plugins) setting: public function adminSidebar()
{ $html = session ...

arfa

@ lastpictures
Thanks for the response. I imagine we all make assumptions about each other. I assumed that your detailed, technical first-reply had you resting in the very-clever-techie Bludit echelon. but...
>> people who don't have much technical or programming knowledge
kind of suggesting that ...

arfa

@lastpictures
Wow, what an incredibly generous reply. Thank you. I have downloaded the zip and will go through that thoroughly.

>> The plugin folder is named ImageManager
Yes, spotted that. New zip up.

>> Many URLs are hardcoded
Yes. You make several references to Bludit constants and I have been ...

arfa

I have been kicking this sucker around for quite some hours – back and forth, dump() logs ... blah blah and it comes down to token testing.

session_name('BLUDIT-KEY'); // THIS is (no pun) the key element.
session_start();

$sessionToken = $_SESSION['s_tokenCSRF'] ?? null;
$getToken = $_GET ...

arfa

This is an adjunct to issues regarding my NEW Image Manager plugin and I hope one/some of you might be able to help.

The key issue now is regarding ajax. I thought I had it sorted ... see:
https://forum.bludit.org/viewtopic.php?t=3077
but, when I have a sub-directory install – ....example.net ...

Bludit Community Support Forum

Search found 187 matches

Re: bl-kernel session bug/fix

Re: Disappointed...

Re: bl-kernel session bug/fix

bl-kernel session bug/fix

Re: Security

basic Bludit security Q.s

Re: ajax – not sorted :( – HELP

Re: ajax – not sorted :( – HELP

Re: NEW Image Manager

ajax – not sorted :( – HELP