NAK-Reinickendorf/intranet
2
0
Fork 0
Code Issues 2 Pull Requests Actions Projects 1 Wiki Activity

web - refactor core modules, harden authorization, simplify endpoints

Browse Source
This commit is contained in:
samuelbias
2026-08-29 11:15:54 +02:00
parent e1109a07ef
commit 79d857d686
71 changed files with 8269 additions and 9119 deletions
Download Patch File Download Diff File Expand all files Collapse all files
web/intranet_repo/general_files/initialise.php
+33 -25
View File
@@ -2,41 +2,49 @@
Beschreibung: Initialisierung der grundlegenden Verarbeitungen
für die Seiten des Intranets (1. Aufruf)
(Ausgenommen davon sind die An-/Abmeldung und Registrierung)
Ladung: Session, Parameter, Funktionen,
Datenbankverbindung und Authentifizierung des Nutzers */
// Session
if (session_status() == PHP_SESSION_NONE) {
session_start();
}
// Parameter und Funktionen
require_once $_SERVER['DOCUMENT_ROOT'].'/intranet_repo/general_files/ini/parameters.php';
require_once $_SERVER['DOCUMENT_ROOT'].'/intranet_repo/general_files/ini/functions.php';
// Datenbankverbindung
if (isset($_SESSION["user_id"])) {
// Include database connection file
$pdo = require_once($_SERVER['DOCUMENT_ROOT']."/intranet_repo/general_files/ini/database.php");
$stmt = $pdo->prepare("SELECT * FROM user_general_information WHERE user_id = ?");
$stmt->execute([$_SESSION["user_id"]]);
$user = $stmt->fetch();
// Authentication
if (isset($user["mail"])) {
$stmt_groups = $pdo->prepare("SELECT * FROM user_permissions WHERE user_id = ?");
$stmt_groups->execute([$_SESSION["user_id"]]);
$groups = $stmt_groups->fetch();
}
} else {
if (!isset($_SESSION['user_id']) || (int) $_SESSION['user_id'] <= 0) {
header("Location: {$g_httpLoginPath}");
exit();
}
?>
$pdo = require_once($_SERVER['DOCUMENT_ROOT']."/intranet_repo/general_files/ini/database.php");
$userId = (int) $_SESSION['user_id'];
// Eine Session ist nur gültig, solange Nutzer UND Login-Datensatz weiterhin existieren.
$stmt = $pdo->prepare(
"SELECT u.* FROM user_general_information u "
. "INNER JOIN user_login l ON l.user_id = u.user_id "
. "WHERE u.user_id = ?"
);
$stmt->execute([$userId]);
$user = $stmt->fetch();
if (!$user || empty($user['mail'])) {
$_SESSION = [];
session_destroy();
header("Location: {$g_httpLoginPath}");
exit();
}
$stmt_groups = $pdo->prepare("SELECT * FROM user_permissions WHERE user_id = ?");
$stmt_groups->execute([$userId]);
$groups = $stmt_groups->fetch();
if (!$groups) {
$_SESSION = [];
session_destroy();
header("Location: {$g_httpLoginPath}");
exit();
}
?>