Discussion :

[nazoreen]

Bonjour à tous,

Je vous soumets ici un formulaire multi-pages très sécurisé, données de session cryptées, retour impossible etc...

J'aimerais avoir vos avis, nottamment sur d'éventuels trous de sécurités.

A bientôt et merci pour les critiques et conseils.

Code :

Sélectionner tout - Visualiser dans une fenêtre à part

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
<?php
$key	= "motdepasse";
 
function generate_iv()
{
	$length = 8;
	$gen_pass = "";
	$gen_vars = array("0","1","2","3","4","5","6","7","8","9","A","B","C","D","E","F","G","H","I","J","K","L","M","N","O","P","Q","R","S","T","U","V","W","X","Y","Z","a","b","c","d","e","f","g","h","i","j","k","l","m","n","o","p","q","r","s","t","u","v","w","x","y","z");
 
	$gen_numb = count($gen_vars) - 1;
 
	for ($i = 0; $i < $length; $i++)
	{
		$gen_pass .= $gen_vars[rand(0, $gen_numb)];
	}
 
	$iv = substr($gen_pass, 0, $length);
 
	return $iv ;
}
 
function val_encrypt($value,$key,$iv)
{
	$td = mcrypt_module_open(MCRYPT_BLOWFISH,"",MCRYPT_MODE_CFB,"");
 
	mcrypt_generic_init($td, $key, $iv);
	$value_encrypt = mcrypt_generic($td,$value);
	mcrypt_generic_deinit($td);
 
	return $value_encrypt;
}
 
function val_decrypt($value,$key,$iv)
{
	$td = mcrypt_module_open(MCRYPT_BLOWFISH,"",MCRYPT_MODE_CFB,"");
 
	mcrypt_generic_init($td, $key, $iv);
	$value_encrypt = mdecrypt_generic($td,$value);
	mcrypt_generic_deinit($td);
 
	return $value_encrypt;
}
 
session_start();
 
if(empty($_SESSION['forms']))
{
    $_SESSION['forms'] = array();
}
 
if (empty($_POST))
{
	if(empty($_SESSION['forms']))
	{
		$iv = generate_iv();
		$_SESSION['forms'] = array('steps' => '1','step1' => $iv,'step2' => '','step3' => '','step4' => '');
	}
 
	$security = $_SESSION['forms']['steps'];
 
	if ($security == "2" || $security == "3" || $security == "4")
	{
		echo "Retour Interdit !";
	} else {
		//echo $_SESSION['forms']['steps'];
		?>
		<form method="post" action="form.php">
			<fieldset>
				<legend>Identifiant</legend>
				<label><input type="text" name="step2" value="" /><label>
			</fieldset>
			<input type="submit" name="login0" value=">>>" /><br />
		</form>
		<?php
	}
} else if (!empty ($_POST['login0'])) {
	$security = $_SESSION['forms']['steps'];
 
	if ($security == "3" || $security == "4")
	{
		echo "Retour Interdit !";
	} else {
		$aes_step2 = val_encrypt($_POST['step2'],$key,$_SESSION['forms']['step1']);
 
		$_SESSION['forms'] = array('steps' => '2','step1' => $_SESSION['forms']['step1'],'step2' => $aes_step2,'step3' => '','step4' => '');
 
		//echo $_SESSION['forms']['steps'];
		?>
		<form method="post" action="form.php">
			<fieldset>
				<legend>Nom</legend>
				<label><input type="text" name="step3" value="" /><label>
			</fieldset>
			<input type="submit" name="login1" value=">>>" /><br />
		</form>
		<?php
	}
} else if (!empty ($_POST['login1'])) {
	$security = $_SESSION['forms']['steps'];
 
	if ($security == "4")
	{
		echo "Retour Interdit !";
	} else {
		$aes_step3 = val_encrypt($_POST['step3'],$key,$_SESSION['forms']['step1']);
 
		$_SESSION['forms'] = array('steps' => '3','step1' => $_SESSION['forms']['step1'],'step2' => $_SESSION['forms']['step2'],'step3' => $aes_step3,'step4' => '');
 
		//echo $_SESSION['forms']['steps'];
		?>
		<form method="post" action="form.php">
			<fieldset>
				<legend>Prénom</legend>
				<label><input type="text" name="step4" value="" /><label>
			</fieldset>
			<input type="submit" name="login2" value=">>>" /><br />
		</form>
		<?php
	}
} else if (!empty ($_POST['login2'])) {
	$aes_step4 = val_encrypt($_POST['step4'],$key,$_SESSION['forms']['step1']);
 
	$_SESSION['forms'] = array('steps' => '4','step1' => $_SESSION['forms']['step1'],'step2' => $_SESSION['forms']['step2'],'step3' => $_SESSION['forms']['step3'],'step4' => $aes_step4);
 
	//echo $_SESSION['forms']['steps'];
	?>
	<fieldset>
		<legend>Résumé</legend>
		<label>Identifiant : <?php echo val_decrypt($_SESSION['forms']['step2'],$key,$_SESSION['forms']['step1']); ?><label><br />
		<label>Nom : <?php echo val_decrypt($_SESSION['forms']['step3'],$key,$_SESSION['forms']['step1']); ?><label><br />
		<label>Prénom : <?php echo val_decrypt($_SESSION['forms']['step4'],$key,$_SESSION['forms']['step1']); ?><label><br />
	</fieldset>
	<?php
}
?>