Access errors and session's "exit" fixes

src/Glpi/Controller/ErrorController.php

@@ -36,6 +36,7 @@
 
 use Glpi\Application\ErrorHandler;
 use Glpi\Application\View\TemplateRenderer;
+use Glpi\Exception\Access\AbstractHttpException;
 use Symfony\Component\ErrorHandler\Error\OutOfMemoryError;
 use Symfony\Component\ErrorHandler\Exception\FlattenException;
 use Symfony\Component\HttpFoundation\Request;
@@ -53,6 +54,12 @@ public function __invoke(Request $request, ?\Throwable $exception = null): Respo
 
         ErrorHandler::getInstance()->handleException($exception, true);
 
+        if ($exception instanceof AbstractHttpException) {
+            $exception->setRequest($request);
+
+            return $exception->asResponse();
+        }
+
         $status_code = $exception instanceof HttpExceptionInterface ? $exception->getStatusCode() : 500;
 
         return new StreamedResponse(fn() => $this->renderErrorPage($exception), $status_code);

src/Glpi/Exception/Access/AbstractHttpException.php

@@ -0,0 +1,62 @@
+<?php
+
+/**
+ * ---------------------------------------------------------------------
+ *
+ * GLPI - Gestionnaire Libre de Parc Informatique
+ *
+ * http://glpi-project.org
+ *
+ * @copyright 2015-2024 Teclib' and contributors.
+ * @licence   https://www.gnu.org/licenses/gpl-3.0.html
+ *
+ * ---------------------------------------------------------------------
+ *
+ * LICENSE
+ *
+ * This file is part of GLPI.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ *
+ * ---------------------------------------------------------------------
+ */
+
+namespace Glpi\Exception\Access;
+
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpFoundation\Response;
+
+abstract class AbstractHttpException extends \RuntimeException
+{
+    private ?Request $request = null;
+
+    public function setRequest(Request $request): void
+    {
+        $this->request = $request;
+    }
+
+    public function getRequest(): Request
+    {
+        if (!$this->request) {
+            throw new \RuntimeException(\sprintf(
+                'Request not set in "%s" exception class. Access error listener might be wrongly configured.',
+                static::class,
+            ));
+        }
+
+        return $this->request;
+    }
+
+    abstract public function asResponse(): Response;
+}

src/Glpi/Exception/Access/InvalidCsrfException.php

@@ -0,0 +1,58 @@
+<?php
+
+/**
+ * ---------------------------------------------------------------------
+ *
+ * GLPI - Gestionnaire Libre de Parc Informatique
+ *
+ * http://glpi-project.org
+ *
+ * @copyright 2015-2024 Teclib' and contributors.
+ * @licence   https://www.gnu.org/licenses/gpl-3.0.html
+ *
+ * ---------------------------------------------------------------------
+ *
+ * LICENSE
+ *
+ * This file is part of GLPI.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ *
+ * ---------------------------------------------------------------------
+ */
+
+namespace Glpi\Exception\Access;
+
+use Symfony\Component\HttpFoundation\JsonResponse;
+use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\HttpFoundation\StreamedResponse;
+
+class InvalidCsrfException extends AbstractHttpException
+{
+    public function asResponse(): Response
+    {
+        $message = __("The action you have requested is not allowed.");
+
+        $request = $this->getRequest();
+
+        // Output JSON if requested by client
+        if (str_contains($request->getAcceptableContentTypes()['HTTP_ACCEPT'] ?? '', 'application/json')) {
+            return new JsonResponse(['message' => $this->message], 403);
+        }
+
+        return new StreamedResponse(function () use ($message) {
+            \Html::displayError($message, true);
+        }, 403);
+    }
+}

src/Glpi/Exception/Access/RequiresHttpsException.php

@@ -0,0 +1,55 @@
+<?php
+
+/**
+ * ---------------------------------------------------------------------
+ *
+ * GLPI - Gestionnaire Libre de Parc Informatique
+ *
+ * http://glpi-project.org
+ *
+ * @copyright 2015-2024 Teclib' and contributors.
+ * @licence   https://www.gnu.org/licenses/gpl-3.0.html
+ *
+ * ---------------------------------------------------------------------
+ *
+ * LICENSE
+ *
+ * This file is part of GLPI.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ *
+ * ---------------------------------------------------------------------
+ */
+
+namespace Glpi\Exception\Access;
+
+use Glpi\Application\View\TemplateRenderer;
+use Symfony\Component\HttpFoundation\Response;
+
+class RequiresHttpsException extends AbstractHttpException
+{
+    public function asResponse(): Response
+    {
+        $request = $this->getRequest();
+
+        $cnt = TemplateRenderer::getInstance()->render(
+            'pages/https_only.html.twig',
+            [
+                'secured_url' => 'https://' . $request->getHost() . $request->getRequestUri(),
+            ]
+        );
+
+        return new Response($cnt, 400);
+    }
+}

src/Glpi/Exception/Access/SessionExpiredException.php

@@ -0,0 +1,49 @@
+<?php
+
+/**
+ * ---------------------------------------------------------------------
+ *
+ * GLPI - Gestionnaire Libre de Parc Informatique
+ *
+ * http://glpi-project.org
+ *
+ * @copyright 2015-2024 Teclib' and contributors.
+ * @licence   https://www.gnu.org/licenses/gpl-3.0.html
+ *
+ * ---------------------------------------------------------------------
+ *
+ * LICENSE
+ *
+ * This file is part of GLPI.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ *
+ * ---------------------------------------------------------------------
+ */
+
+namespace Glpi\Exception\Access;
+
+use Symfony\Component\HttpFoundation\RedirectResponse;
+use Symfony\Component\HttpFoundation\Response;
+
+/**
+ * Used when there is no session, or session cookies have expired.
+ */
+class SessionExpiredException extends AbstractHttpException
+{
+    public function asResponse(): Response
+    {
+        return new RedirectResponse('/front/login.php');
+    }
+}

src/Html.php

@@ -732,7 +732,13 @@ public static function getRefererUrl(): ?string
      *
      * @return void
      **/
-    public static function displayErrorAndDie($message, $minimal = false)
+    public static function displayErrorAndDie($message, $minimal = false): void
+    {
+        self::displayError($message, $minimal);
+        exit();
+    }
+
+    public static function displayError($message, $minimal = false): void
     {
         /** @var bool $HEADER_LOADED */
         global $HEADER_LOADED;
@@ -754,10 +760,8 @@ public static function displayErrorAndDie($message, $minimal = false)
         ]);
 
         self::nullFooter();
-        exit();
     }
 
-
     /**
      * Add confirmation on button or link before action
      *

src/Session.php

@@ -33,10 +33,12 @@
  * ---------------------------------------------------------------------
  */
 
-use Glpi\Application\View\TemplateRenderer;
 use Glpi\Cache\CacheManager;
 use Glpi\Cache\I18nCache;
 use Glpi\Event;
+use Glpi\Exception\Access\InvalidCsrfException;
+use Glpi\Exception\Access\RequiresHttpsException;
+use Glpi\Exception\Access\SessionExpiredException;
 use Glpi\Plugin\Hooks;
 use Glpi\Session\SessionInfo;
 
@@ -1019,13 +1021,7 @@ public static function checkCookieSecureConfig(): void
         $cookie_secure = filter_var(ini_get('session.cookie_secure'), FILTER_VALIDATE_BOOLEAN);
         $is_https_request = ($_SERVER['HTTPS'] ?? 'off') === 'on' || (int)($_SERVER['SERVER_PORT'] ?? null) == 443;
         if ($is_https_request === false && $cookie_secure === true) {
-            TemplateRenderer::getInstance()->display(
-                'pages/https_only.html.twig',
-                [
-                    'secured_url' => 'https://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'],
-                ]
-            );
-            exit();
+            throw new RequiresHttpsException();
         }
     }
 
@@ -1047,7 +1043,7 @@ public static function checkValidSessionId()
             !isset($_SESSION['valid_id'])
             || ($_SESSION['valid_id'] !== session_id())
         ) {
-            Html::redirectToLogin('error=3');
+            throw new SessionExpiredException();
         }
 
         $user_id    = self::getLoginUserID();
@@ -1784,15 +1780,7 @@ public static function checkCSRF($data)
             $user_id = self::getLoginUserID() ?? 'Anonymous';
             Toolbox::logInFile('access-errors', "CSRF check failed for User ID: $user_id at $requested_url\n");
 
-            $message = __("The action you have requested is not allowed.");
-
-            // Output JSON if requested by client
-            if (strpos($_SERVER['HTTP_ACCEPT'] ?? '', 'application/json') !== false) {
-                http_response_code(403);
-                die(json_encode(["message" => $message]));
-            }
-
-            Html::displayErrorAndDie($message, true);
+            throw new InvalidCsrfException();
         }
     }