From 186d770741fa0a969b640da5728043a8d25f4f4a Mon Sep 17 00:00:00 2001 From: Fabian de Boer Date: Sun, 19 Jul 2026 20:17:37 +0200 Subject: [PATCH 1/2] session directory prefix; reset.php made saver. (isues #17 and #16) --- cli_scripts/reset.php | 100 +++++++++++++++++++++++++++++---------- cli_scripts/test.php | 5 +- lib/ZAPDisplay.class.php | 5 +- 3 files changed, 82 insertions(+), 28 deletions(-) diff --git a/cli_scripts/reset.php b/cli_scripts/reset.php index 6cd3f1f..2cc6f1c 100755 --- a/cli_scripts/reset.php +++ b/cli_scripts/reset.php @@ -1,28 +1,80 @@ +#!/usr/bin/env php session reset

'; - -if ($_GET['allcollages'] == 'clear') { - $sessions = glob('./Sessions/*'); - foreach($sessions as $folder){ - $files = glob($folder.'/*'); - foreach($files as $fileToDelete){ - echo "$fileToDelete deleted
"; - unlink($fileToDelete); - } - echo "$folder deleted
"; - rmdir($folder); - } +if (php_sapi_name() !== 'cli') { + die('This script can only be run from the command line.' . PHP_EOL); } -echo '

'; -session_destroy(); -?> \ No newline at end of file +// Make sure relative paths in init.php resolve against the project root +chdir(__DIR__); + +require_once __DIR__ . '/../conf/init.php'; + +// Start a session so reset/destroy have something to work with +if (session_status() === PHP_SESSION_NONE) { + session_start(); +} + +// --- Session reset --- +Session::reset(); + +echo 'Session reset.' . PHP_EOL; + +// --- Optional: purge all session folders --- +$purgeAll = in_array('--all', $argv); + +if ($purgeAll) { + $force = in_array('-f', $argv); + + if (!$force) { + echo 'WARNING: This will permanently delete ALL session folders.' . PHP_EOL; + echo 'Are you sure? (type "yes" to confirm): '; + $handle = fopen('php://stdin', 'r'); + $input = trim(fgets($handle)); + fclose($handle); + + if (strtolower($input) !== 'yes') { + echo 'Aborted.' . PHP_EOL; + exit(0); + } + } + + $sessionsDir = ZAP_APP_BASE_DIR . DIRECTORY_SEPARATOR . ZAP_SESSIONS_DIR; + $folders = glob($sessionsDir . DIRECTORY_SEPARATOR . '*'); + $count = 0; + + foreach ($folders as $folder) { + if (!is_dir($folder)) { + continue; + } + $files = glob($folder . DIRECTORY_SEPARATOR . '*'); + foreach ($files as $file) { + if (is_file($file)) { + unlink($file); + } + } + rmdir($folder); + $count++; + } + + echo "Purged $count session folder(s)." . PHP_EOL; +} + +// Only destroy if a session was actually started +if (session_status() === PHP_SESSION_ACTIVE) { + Session::destroy(); + echo 'Session destroyed.' . PHP_EOL; +} + +exit(0); \ No newline at end of file diff --git a/cli_scripts/test.php b/cli_scripts/test.php index 3a618cd..bb1b29b 100755 --- a/cli_scripts/test.php +++ b/cli_scripts/test.php @@ -85,9 +85,10 @@ function testImgSearch() { return; } - $folder = ZAP_APP_BASE_DIR . DIRECTORY_SEPARATOR . ZAP_SESSIONS_DIR . DIRECTORY_SEPARATOR . 'search_test_' . ZAP_MOMENT; + $suffix = bin2hex(random_bytes(4)); + $folder = ZAP_APP_BASE_DIR . DIRECTORY_SEPARATOR . ZAP_SESSIONS_DIR . DIRECTORY_SEPARATOR . 'search_test_' . ZAP_MOMENT . '_' . $suffix; if (!is_dir($folder)) { - @mkdir($folder, 0777, true); + mkdir($folder, 0777, true); } echo "\nQuery: '$word'\n\n"; diff --git a/lib/ZAPDisplay.class.php b/lib/ZAPDisplay.class.php index 2d1ef71..9cfe2c2 100755 --- a/lib/ZAPDisplay.class.php +++ b/lib/ZAPDisplay.class.php @@ -49,9 +49,10 @@ class ZAPDisplay implements ZAPHandler { */ private function createFolder() { try { + $suffix = bin2hex(random_bytes(4)); $folder = ZAP_APP_BASE_DIR . DIRECTORY_SEPARATOR - . ZAP_SESSIONS_DIR . DIRECTORY_SEPARATOR . 'zap_' . ZAP_MOMENT; - if (!@mkdir($folder, 0777)) { + . ZAP_SESSIONS_DIR . DIRECTORY_SEPARATOR . 'zap_' . ZAP_MOMENT . '_' . $suffix; + if (!mkdir($folder, 0777, true)) { throw new Exception('

' . ERROR_PREFIX . 'Unable to create base dir: ' . $folder . '

'); } return $folder; From ab0ac454151798bdd09d77df43e2088cd4d10f27 Mon Sep 17 00:00:00 2001 From: Fabian de Boer Date: Sun, 19 Jul 2026 21:27:13 +0200 Subject: [PATCH 2/2] wrong mode in index.php now gives a 404 error (#15); anti cross-site-request token --- lib/ZAPController.class.php | 4 +++- lib/ZAPDisplay.class.php | 12 ++++++++++++ tpl/404.tpl | 29 +++++++++++++++++++++++++++++ tpl/index.tpl | 4 ++++ 4 files changed, 48 insertions(+), 1 deletion(-) create mode 100644 tpl/404.tpl diff --git a/lib/ZAPController.class.php b/lib/ZAPController.class.php index 115b416..29df4c8 100755 --- a/lib/ZAPController.class.php +++ b/lib/ZAPController.class.php @@ -26,7 +26,9 @@ class ZAPController { $this->mode = ucfirst($mode); $clazz = $this->prefix . $this->mode; if (!class_exists($clazz)) { - die('Wrong parameter'); + http_response_code(404); + include getZAPTemplate('404'); + die(); } $this->action = new $clazz(); } diff --git a/lib/ZAPDisplay.class.php b/lib/ZAPDisplay.class.php index 9cfe2c2..65656e9 100755 --- a/lib/ZAPDisplay.class.php +++ b/lib/ZAPDisplay.class.php @@ -28,6 +28,18 @@ class ZAPDisplay implements ZAPHandler { */ public function __construct() { ob_start(); + + // Validate CSRF token + if ( + empty($_POST['csrf_token']) + || empty($_SESSION['csrf_token']) + || !hash_equals($_SESSION['csrf_token'], $_POST['csrf_token']) + ) { + http_response_code(400); + echo '

Invalid or missing security token. Please go back and try again.

'; + die(); + } + $this->folder = $this->createFolder(); $this->words = $this->handleWords(); diff --git a/tpl/404.tpl b/tpl/404.tpl new file mode 100644 index 0000000..68649d5 --- /dev/null +++ b/tpl/404.tpl @@ -0,0 +1,29 @@ + + + + + 404 - ZapMachine + + + + +
error 404
+ + diff --git a/tpl/index.tpl b/tpl/index.tpl index a5fc6f4..249b112 100755 --- a/tpl/index.tpl +++ b/tpl/index.tpl @@ -12,7 +12,11 @@

Input words

+
+