Merge pull request #426 from nanasess/improve-admin

ADMIN_DIR のチェック強化
EC-CUBE · Feb 16, 2021 · 3695516 · 3695516
2 parents 392ecb8 + 3f873df
commit 3695516
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/data/class/pages/admin/LC_Page_Admin.php b/data/class/pages/admin/LC_Page_Admin.php
@@ -46,6 +46,11 @@ public function init()
         $this->sendAdditionalHeader();
         $this->template = MAIN_FRAME;
 
+        if (stripos($_SERVER['REQUEST_URI'], rtrim(ROOT_URLPATH.ADMIN_DIR, '/')) === false) {
+            // ADMIN_DIR 以外からのリクエストは認証を要求する
+            SC_Utils_Ex::sfIsSuccess(new SC_Session_Ex());
+        }
+
         //IP制限チェック
         $allow_hosts = unserialize(ADMIN_ALLOW_HOSTS);
         if (is_array($allow_hosts) && count($allow_hosts) > 0) {