Added site and date key for improved security

diff --git a/inc/functions.php b/inc/functions.php
index d69c1abdd066a742f6ed1a9188be63ec04e3d6b6..1c555e08ac7d220e1e076cfc340b4c8968d09f65 100644 (file)
--- a/inc/functions.php
+++ b/inc/functions.php
@@ -339,7 +339,7 @@ function generateDereferrerUrl ($url) {
                //* DEBUG: */ logDebugMessage(__FUNCTION__, __LINE__, 'url=' . $url);
 
                // De-refer this URL
-               $url = '{%url=modules.php?module=loader&url=' . $encodedUrl . '&hash=' . encodeHashForCookie(generateHash($url)) . '%}';
+               $url = '{%url=modules.php?module=loader&url=' . $encodedUrl . '&hash=' . encodeHashForCookie(generateHash($url . getSiteKey() . getDateKey())) . '%}';
        } // END - if
 
        // Return link

diff --git a/inc/modules/loader.php b/inc/modules/loader.php
index b3395fa389c8fa4f82982332c506967a2009f5aa..006559f5eb95342caa6660fbf7c78440f68e635a 100644 (file)
--- a/inc/modules/loader.php
+++ b/inc/modules/loader.php
@@ -45,8 +45,14 @@ if ((isGetRequestElementSet('url')) && (isGetRequestElementSet('hash'))) {
        // Decode URL
        $decodedUrl = decodeString(str_replace(' ', '+', compileUriCode(urldecode(getRequestElement('url')))));
 
+       // Debug message
+       //* DEBUG: */ logDebugMessage(__FUNCTION__, __LINE__, 'decodedUrl=' . $decodedUrl . ',hash=' . getRequestElement('hash'));
+
        // Generate hash for comparing it
-       $hash = encodeHashForCookie(generateHash($decodedUrl, getRequestElement('hash')));
+       $hash = encodeHashForCookie(generateHash($decodedUrl . getSiteKey() . getDateKey(), getRequestElement('hash')));
+
+       // Debug message
+       //* DEBUG: */ logDebugMessage(__FUNCTION__, __LINE__, 'decodedUrl=' . $decodedUrl . ',hash=' . $hash);
 
        // Validate the URL and hash
        if ($hash != getRequestElement('hash')) {