diff --git a/src/etc/inc/authgui.inc b/src/etc/inc/authgui.inc index 1976ac5b6..4d3277875 100644 --- a/src/etc/inc/authgui.inc +++ b/src/etc/inc/authgui.inc @@ -56,90 +56,88 @@ if (!isAllowedPage($_SERVER['REQUEST_URI'])) { pfSenseHeader("/{$page}"); $username = empty($_SESSION["Username"]) ? "(system)" : $_SESSION['Username']; - if (!empty($_SERVER['REMOTE_ADDR'])) + if (!empty($_SERVER['REMOTE_ADDR'])) { $username .= '@' . $_SERVER['REMOTE_ADDR']; + } log_error("{$username} attempted to access {$_SERVER['SCRIPT_NAME']} but does not have access to that page. Redirecting to {$page}."); exit; - } else { - display_error_form("201", gettext("No page assigned to this user! Click here to logout.")); - exit; - } -} else - $_SESSION['Post_Login'] = true; - - /* - * redirect browsers post-login to avoid pages - * taking action in reponse to a POST request - */ - if (!$_SESSION['Post_Login']) { - $_SESSION['Post_Login'] = true; - require_once("functions.inc"); - pfSenseHeader($_SERVER['REQUEST_URI']); + } else { + display_error_form("201", gettext("No page assigned to this user! Click here to logout.")); exit; } +} else { + $_SESSION['Post_Login'] = true; +} - /* - * Close session data to allow other scripts from same host to come in. - * A session can be reactivated from calling session_start again - */ - session_commit(); +/* + * redirect browsers post-login to avoid pages + * taking action in reponse to a POST request + */ +if (!$_SESSION['Post_Login']) { + $_SESSION['Post_Login'] = true; + require_once("functions.inc"); + pfSenseHeader($_SERVER['REQUEST_URI']); + exit; +} - /* - * determine if the user is allowed access to the requested page - */ - function display_error_form($http_code, $desc) { - global $config, $g; - $g['theme'] = get_current_theme(); - if(isAjax()) { - printf(gettext('Error: %1$s Description: %2$s'), $http_code, $desc); - return; - } +/* + * Close session data to allow other scripts from same host to come in. + * A session can be reactivated from calling session_start again + */ +session_commit(); - ?> +/* + * determine if the user is allowed access to the requested page + */ +function display_error_form($http_code, $desc) +{ + global $config, $g; + $g['theme'] = get_current_theme(); + if(isAjax()) { + printf(gettext('Error: %1$s Description: %2$s'), $http_code, $desc); + return; + } - - - - - +?> + + + + - - + + - - - - - + + + + + - <?=$http_code?> + <?=$http_code?> - - + + - - - -
-

 

- -

- - - -

-
- - - - - + + +
+

 

+ +

+ + + +

+
+ + +?> + + + + - - - - - + + - - + + + + + - - - - - + <?=gettext("Login"); ?> - <?=gettext("Login"); ?> + + - - + - + + - - - -
-
If you did not setup this forwarding, you may be the target of a man-in-the-middle attack.")); - } - $loginautocomplete = isset($config['system']['webgui']['loginautocomplete']) ? '' : 'autocomplete="off"'; - ?> +
+
If you did not setup this forwarding, you may be the target of a man-in-the-middle attack.")); + } + $loginautocomplete = isset($config['system']['webgui']['loginautocomplete']) ? '' : 'autocomplete="off"'; + ?> -
- +
+ - -
+
-
+
- + - + - - - + + +