diff --git a/htdocs/includes/cryptographp/cryptographp.inc.php b/htdocs/includes/cryptographp/cryptographp.inc.php
index d83ae2ddcee..b5b680e1634 100644
--- a/htdocs/includes/cryptographp/cryptographp.inc.php
+++ b/htdocs/includes/cryptographp/cryptographp.inc.php
@@ -252,6 +252,7 @@ $_SESSION['cryptcptuse']++;
// Envoi de l'image finale au navigateur
+header('Cache-Control: Public, must-revalidate');
switch (strtoupper($cryptformat)) {
case "JPG" :
case "JPEG" : if (imagetypes() & IMG_JPG) {
diff --git a/htdocs/includes/cryptographp/cryptographp.php b/htdocs/includes/cryptographp/cryptographp.php
index 89978a089c3..12758fecb9b 100644
--- a/htdocs/includes/cryptographp/cryptographp.php
+++ b/htdocs/includes/cryptographp/cryptographp.php
@@ -17,5 +17,6 @@ session_name($_GET['sn']);
session_start();
error_reporting(E_ALL ^ E_NOTICE);
SetCookie("cryptcookietest", "1");
+header('Cache-Control: Public, must-revalidate');
Header("Location: cryptographp.inc.php?cfg=".$_GET['cfg']."&sn=".session_name()."&".SID);
?>
diff --git a/htdocs/langs/en_US/other.lang b/htdocs/langs/en_US/other.lang
index c117899b8f9..d6bb98687ec 100644
--- a/htdocs/langs/en_US/other.lang
+++ b/htdocs/langs/en_US/other.lang
@@ -14,6 +14,7 @@ ErrorFailedToRunExternalCommand=Failed to run external command. Check it is avai
ErrorFailedToChangePassword=Failed to change password
ErrorLoginDoesNotExists=User with login %s could not be found.
ErrorLoginHasNoEmail=This user has no email address. Process aborted.
+SecurityCode=Security code
Calendar=Calendar
AddTrip=Add trip
Tools=Tools
diff --git a/htdocs/langs/fr_FR/other.lang b/htdocs/langs/fr_FR/other.lang
index c3de8cc4123..d34563c6883 100644
--- a/htdocs/langs/fr_FR/other.lang
+++ b/htdocs/langs/fr_FR/other.lang
@@ -14,6 +14,7 @@ ErrorFailedToRunExternalCommand=Echec de l'ex
ErrorFailedToChangePassword=Echec de modification du mot de passe
ErrorLoginDoesNotExists=Le compte utilisateur de login %s n'a pu être trouvé.
ErrorLoginHasNoEmail=Cet utilisateur n'a pas d'email. Impossible de continuer.
+SecurityCode=Code sécurité
Calendar=Calendrier
AddTrip=Créer déplacement
Tools=Outils
diff --git a/htdocs/lib/functions.inc.php b/htdocs/lib/functions.inc.php
index ceb5e141988..9ef03e25e48 100644
--- a/htdocs/lib/functions.inc.php
+++ b/htdocs/lib/functions.inc.php
@@ -1274,6 +1274,8 @@ function dol_loginfunction($notused,$pearstatus)
// Si feuille de style en php existe
if (file_exists(DOL_DOCUMENT_ROOT.'/'.$conf->css.".php")) $conf->css.=".php";
+ header('Cache-Control: Public, must-revalidate');
+
// Ce DTD est KO car inhibe document.body.scrollTop
//print '';
// Ce DTD est OK
diff --git a/htdocs/main.inc.php b/htdocs/main.inc.php
index 6ecabf039f3..a8691fcf790 100644
--- a/htdocs/main.inc.php
+++ b/htdocs/main.inc.php
@@ -203,7 +203,7 @@ if (! session_id() || ! isset($_SESSION["dol_login"]))
{
// Echec authentification
dolibarr_syslog("Authentification ko (en mode Pear Base Dolibarr) pour '".$_POST["username"]."'");
- sleep(2);
+ sleep(1);
}
else
{
@@ -257,6 +257,7 @@ if (! session_id() || ! isset($_SESSION["dol_login"]))
{
// Echec authentification
dolibarr_syslog("Authentification ko (en mode Pear Base Dolibarr_mdb2) pour '".$_POST["username"]."'");
+ sleep(1);
}
else
{
@@ -343,7 +344,28 @@ if (! session_id() || ! isset($_SESSION["dol_login"]))
}
}
+ // Verification du code
+ if ($conf->global->MAIN_SECURITY_ENABLECAPTCHA)
+ {
+ include_once(DOL_DOCUMENT_ROOT.'/includes/cryptographp/cryptographp.fct.php');
+ //print "Info session: ".session_name().session_id();print_r($_SESSION);
+ if (! chk_crypt($_POST['code']))
+ {
+ session_destroy();
+ dolibarr_syslog('Bad value for code, connexion refused');
+
+ // On repart sur page accueil
+ session_name($sessionname);
+ session_start();
+ $langs->load('main');
+ $_SESSION["loginmesg"]=$langs->trans("ErrorBadValueForCode");
+ header('Location: '.DOL_URL_ROOT.'/index.php');
+ exit;
+ }
+ }
+
// Charge l'objet user depuis son login ou son SID
+ $result=0;
if ($conf->ldap->enabled && $conf->global->LDAP_SYNCHRO_ACTIVE == 'ldap2dolibarr')
{
require_once(DOL_DOCUMENT_ROOT."/lib/ldap.class.php");
@@ -413,7 +435,7 @@ if (! session_id() || ! isset($_SESSION["dol_login"]))
{
$result=$user->fetch($login);
}
-
+
if ($result <= 0)
{
session_destroy();
@@ -431,11 +453,11 @@ if (! session_id() || ! isset($_SESSION["dol_login"]))
else
{
// On est déjà en session qui a sauvegardé login
- // Remarks: On ne sauvegarde pas objet user car pose pb dans certains cas mal idnetifiés
+ // Remarks: On ne sauvegarde pas objet user car pose pb dans certains cas mal identifiés
$login=$_SESSION["dol_login"];
- dolibarr_syslog("This is an already user logged session. _SESSION['dol_login']=".$login);
+ dolibarr_syslog("This is an already user logged session. _SESSION['dol_login']=".$login);
$user->fetch($login);
- $login=$user->login;
+ $login=$user->login;
}
// Est-ce une nouvelle session