CVE-2023-1070 (PHP, published 2023-02-27T16:15Z)
Description: value: External Control of File Name or Path in GitHub repository nilsteampassnet/teampass prior to 3.0.0.22.
Severity: nan (CVSS v3 base score: 7.1)
Weakness: CWE-73 \u2014 External Control of File Name or Path
The product allows user input to control or influence paths or file names that are used in filesystem operations.
Repository: https://github.com/nilsteampassnet/teampass
Files changed:
api/Model/ItemModel.php
includes/config/include.php
includes/core/load.js.php
includes/core/login.js.php
includes/core/login.php
includes/core/logout.php
includes/core/otv.php
includes/language/arabic.php
includes/language/bulgarian.php
includes/language/catalan.php
includes/language/chinese.php
includes/language/czech.php
includes/language/dutch.php
includes/language/english.php
includes/language/estonian.php
includes/language/french.php
includes/language/german.php
includes/language/greek.php
includes/language/hungarian.php
includes/language/italian.php
includes/language/japanese.php
includes/language/norwegian.php
includes/language/polish.php
includes/language/portuguese.php
includes/language/portuguese_br.php
includes/language/romanian.php
includes/language/russian.php
includes/language/spanish.php
includes/language/swedish.php
includes/language/turkish.php
includes/language/ukrainian.php
includes/language/vietnamese.php
index.php
install/install.php
install/install.queries.php
install/migrate_users_to_v3.php
install/tp.functions.php
install/upgrade.php
install/upgrade_ajax.php
install/upgrade_run_3.0.0.php
install/upgrade_run_3.0.0_fields.php
install/upgrade_run_3.0.0_files.php
install/upgrade_run_3.0.0_logs.php
install/upgrade_run_3.0.0_passwords.php
install/upgrade_run_3.0.0_suggestions.php
install/upgrade_run_3.0.0_users.php
install/upgrade_scripts_manager.php
pages/2fa.js.php
pages/2fa.php
pages/actions.js.php
pages/actions.php
pages/admin.js.php
pages/admin.php
pages/api.js.php
pages/api.php
pages/backups.js.php
pages/backups.php
pages/emails.js.php
pages/emails.php
pages/export.js.php
pages/export.php
pages/favorites.js.php
pages/favourites.php
pages/fields.js.php
pages/fields.php
pages/folders.js.php
pages/folders.php
pages/import.js.php
pages/import.php
pages/items.js.php
pages/items.php
pages/kb.php
pages/ldap.js.php
pages/ldap.php
pages/offline.js.php
pages/offline.php
pages/options.js.php
pages/options.php
pages/profile.js.php
pages/profile.php
pages/roles.js.php
pages/roles.php
pages/search.js.php
pages/search.php
pages/special.php
pages/statistics.js.php
pages/statistics.php
pages/suggestion.php
pages/tasks.js.php
pages/tasks.php
pages/uploads.js.php
pages/uploads.php
pages/users.js.php
pages/users.php
pages/utilities.database.js.php
pages/utilities.database.php
pages/utilities.deletion.js.php
pages/utilities.deletion.php
pages/utilities.logs.js.php
pages/utilities.logs.php
pages/utilities.php
pages/utilities.renewal.js.php
pages/utilities.renewal.php
sources/admin.queries.php
sources/aes.functions.php
sources/background.php
sources/backups.queries.php
sources/checks.php
sources/core.php
sources/downloadFile.php
sources/expired.datatables.php
sources/export.queries.php
sources/favourites.queries.php
sources/fields.queries.php
sources/find.queries.php
sources/folders.datatable.php
sources/folders.queries.php
sources/identify.php
sources/import.queries.php
sources/items.logs.php
sources/items.queries.php
sources/ldap.queries.php
sources/logs.datatables.php
sources/main.functions.php
sources/main.queries.php
sources/roles.queries.php
sources/scheduler.php
sources/tree.php
sources/upload.attachments.php
sources/upload.files.php
sources/user.logs.datatables.php
sources/users.datatable.php
sources/users.queries.php
sources/utilities.queries.php
sources/utils.queries.php
Commit message: 3.0.0.23

Fix for #3520
Fix vulnerability related to teampass-seckey.txt file


Vulnerable code:
                    $path .= '>' . htmlspecialchars(stripslashes(htmlspecialchars_decode($elem->title, ENT_QUOTES)), ENT_QUOTES);
 * @version   3.0.0.22
define('TP_VERSION_FULL', TP_VERSION.'.22');
 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22
    'email_share_item_mail' => 'Hello,<br><br>This is a generated email from Teampass passwords manager.<br><br>#tp_user# has shared with you the password item #tp_item#.<br><br><a href=\'#tp_link#\'>Click this link</a> to access the item.<br><br><br>Greetings',
 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22
    'username' => 'Username',
    'settings_ldap_password_tip' => 'The password of the user specified above.',
    'undefined' => 'Undefined',
    'error_cannot_open_file' => 'File cannot be opened',
    'start' => 'Start',
    'current_password' => 'Current password',
    'password_is_not_correct' => 'This password is not correct',
    'personal_items' => 'Personal items',
    'please_select_a_folder' => 'Please select a folder',
    'in_progress' => 'In progress',
    'all_fields_mandatory' => 'All fields are mandatory',
    'filename' => 'Filename',
    'exported_to_file' => 'Exported to file',
    'operation_progress' => 'Operation is in progress',
    'exporting_items' => 'Exporting items',
    'select_folders_to_export' => 'Select folders to export',
    'export_format_type' => 'Select the export format type',
    'export_items' => 'Export items',
    'loading_item' => 'Loading item',
    'admin_action_check_pf' => 'Criar pastas pessoas para todos os utilizadores que não têm',
    'max_last_items' => 'Maximo de últimos itens visto por um usuários (Padrão é 10)',
    'number_of_used_pw' => 'Número de novas senhas que o usuário precisa ingressar antes de usar uma senha antiga',
    'pw_life_duration' => 'Vida útil da senha de um usuário para expirar (em dia, 0 para desativar)',
    'settings_log_connections' => 'Guarda todos os inícios de sessão',
 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22
    'email_share_item_mail' => 'Hola,&lt;br&gt;&lt;br&gt;&lt;u&gt;#tp_user#&lt;/u&gt; ha compartido con usted el elemento &lt;b&gt;#tp_item#&lt;/b&gt;&lt;br&gt;Pulse &lt;a href=\'#tp_link#\'&gt;aquí&lt;/a&gt; para acceder.&lt;br&gt;&lt;br&gt;Saludos.',
 * @version   3.0.0.22
    'email_share_item_mail' => 'Hello,<br><br>This is a generated email from Teampass passwords manager.<br><br>#tp_user# has shared with you the password item #tp_item#.<br><br><a href=\'#tp_link#\'>Click this link</a> to access the item.<br><br><br>Greetings',
 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22
							The SaltKey is stored in a file called teampass-seckey.txt. For security reasons, this file should be stored in a folder outside the WWW folder of your server (example: /var/teampass/). This key will be used to encrypt data when sharing information with users without any Teampass account. If this field remains empty, this file will be stored in folder <path to Teampass>/includes/.
 * @version   3.0.0.22
                    $filename_seckey = $securePath . '/teampass-seckey.txt';
 * @version   3.0.0.22
        $ascii_key = file_get_contents(SECUREPATH.'/teampass-seckey.txt');
 * @version   3.0.0.22
 * @version   3.0.0.22
                /*
                $filename = (empty($post_sk_path) === false ? $post_sk_path : SECUREPATH).'/teampass-seckey.txt';
                if (file_exists($filename)) {
                    $newfile = str_replace('teampass-seckey.txt', time());
                    rename($filename, $newfile);
                    unlink($filename);
                    echo '$("#step5_saltkeyFile").html("<i class=\"fa-solid fa-circle-check fa-lg text-success ml-2 mr-2\"></i><span class=\"text-info font-italic\">You can remove file '.$newfile.'</span>");';
                } else {
                    echo '$("#step5_saltkeyFile").html("<i class=\"fa-solid fa-circle-check fa-lg text-success ml-2 mr-2\"></i><span class=\"text-info font-italic\">Nothing done</span>");';
                }
                */
 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22
            // load PhpEncryption library
            /*include_once $SETTINGS['cpassman_dir'].'/includes/libraries/Encryption/Encryption/'.'Crypto.php';
            include_once $SETTINGS['cpassman_dir'].'/includes/libraries/Encryption/Encryption/'.'Encoding.php';
            include_once $SETTINGS['cpassman_dir'].'/includes/libraries/Encryption/Encryption/'.'DerivedKeys.php';
            include_once $SETTINGS['cpassman_dir'].'/includes/libraries/Encryption/Encryption/'.'Key.php';
            include_once $SETTINGS['cpassman_dir'].'/includes/libraries/Encryption/Encryption/'.'KeyOrPassword.php';
            include_once $SETTINGS['cpassman_dir'].'/includes/libraries/Encryption/Encryption/'.'File.php';
            include_once $SETTINGS['cpassman_dir'].'/includes/libraries/Encryption/Encryption/'.'RuntimeTests.php';
            include_once $SETTINGS['cpassman_dir'].'/includes/libraries/Encryption/Encryption/'.'KeyProtectedByPassword.php';
            include_once $SETTINGS['cpassman_dir'].'/includes/libraries/Encryption/Encryption/'.'Core.php';*/

            $ascii_key = file_get_contents(SECUREPATH.'/teampass-seckey.txt');
 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22
        // Store current view
        savePreviousView();
        
        if (debugJavascript === true) console.log("Request is running: " + requestRunning)

        // Store status query running
        requestRunning = true;

 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22
    $SETTINGS['cpassman_dir'],
    $SETTINGS['cpassman_dir'],
        $_SESSION['reencrypt_old_salt'] = file_get_contents(SECUREPATH . '/teampass-seckey.txt');
        $old_sk_filename = SECUREPATH . '/teampass-seckey.txt.' . date('Y_m_d', mktime(0, 0, 0, (int) date('m'), (int) date('d'), (int) date('y'))) . '.' . time();
            SECUREPATH . '/teampass-seckey.txt',
            SECUREPATH . '/teampass-seckey.txt',
        $_SESSION['reencrypt_new_salt'] = file_get_contents(SECUREPATH . '/teampass-seckey.txt');
    $SETTINGS['cpassman_dir'],
    $SETTINGS['cpassman_dir'],
    $SETTINGS['cpassman_dir'],
            unlink(SECUREPATH . '/teampass-seckey.txt');
                SECUREPATH . '/teampass-seckey.txt'
    $SETTINGS['cpassman_dir'],
 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22
                                    'folder' => implode(' > ', $arr_trees),
 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22
    $ascii_key = empty($ascii_key) === true ? file_get_contents(SECUREPATH . '/teampass-seckey.txt') : $ascii_key;
            array_push($foldersLimitedFull, $record['item_id']);
        $restrictedFoldersForItems,
                ]),

        $ascii_key = file_get_contents(SECUREPATH . '/teampass-seckey.txt');
 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22
    $big_array = array_diff(array_unique(array_merge($session_groupes_visibles, $listFoldersLimitedKeys, $listRestrictedFoldersForItemsKeys), SORT_NUMERIC), $session_forbiden_pfs);
    //print_r($session_groupes_visibles);
 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22
 * @version   3.0.0.22

Fixed code:
                    $path .= '/' . htmlspecialchars(stripslashes(htmlspecialchars_decode($elem->title, ENT_QUOTES)), ENT_QUOTES);
 * @version   3.0.0.23
define('TP_VERSION_FULL', TP_VERSION.'.23');
 * @version   3.0.0.23
 * @version   3.0.0.23
 * @version   3.0.0.23
 * @version   3.0.0.23
 * @version   3.0.0.23
 * @version   3.0.0.23
 * @version   3.0.0.23
 * @version   3.0.0.23
 * @version   3.0.0.23
 * @version   3.0.0.23
 * @version   3.0.0.23
 * @version   3.0.0.23
    'email_share_item_mail' => 'Hello,<br><br>This is a generated email from Teampass passwords manager.<br><br>#tp_user# has shared with you the password item #tp_item#.<br><br><a href="#tp_link#">Click this link</a> to access the item.<br><br><br>Greetings',
 * @version   3.0.0.23
 * @version   3.0.0.23
 * @version   3.0.0.23
 * @version   3.0.0.23
 * @version   3.0.0.23
 * @version   3.0.0.23
 * @version   3.0.0.23
 * @version   3.0.0.23
 * @version   3.0.0.23
 * @version   3.0.0.23
    'username' => 'Utilizador',
    'settings_ldap_password_tip' => 'A palavra-passe do utilizador especificado acima.',
    'undefined' => 'Indefinido',
    'error_cannot_open_file' => 'O ficheiro não pode ser aberto',
    'start' => 'Iniciar',
    'current_password' => 'Palavra-passe atual',
    'password_is_not_correct' => 'Esta palavra-passe não é a correta',
    'personal_items' => 'Itens pessoais',
    'please_select_a_folder' => 'Por favor seleccione uma pasta',
    'in_progress' => 'Em progresso',
    'all_fields_mandatory' => 'Todos os campos são obrigatórios',
    'filename' => 'Nome do ficheiro',
    'exported_to_file' => 'Exportado para ficheiro',
    'operation_progress' => 'A operação está em progresso',
    'exporting_items' => 'A exportar itens',
    'select_folders_to_export' => 'Seleccione pastas para exportar',
    'export_format_type' => 'Seleccione o formato de exportação',
    'export_items' => 'Exportar itens',
    'loading_item' => 'A carregar item',
    'admin_action_check_pf' => 'Criar pastas pessoas para todos os utilizadores que não as têm',
    'max_last_items' => 'Tamanho da lista dos últimos itens vistos (padrão é 10)',
    'number_of_used_pw' => 'Número de palavras-passe antigas guardadas para evitar reutilização (0 para desativar)',
    'pw_life_duration' => 'Palavras-passe de sessão expiram ao fim de xx dias (0 para desativar)',
    'settings_log_connections' => 'Guarda registo de todos os inícios de sessão',
 * @version   3.0.0.23
 * @version   3.0.0.23
 * @version   3.0.0.23
 * @version   3.0.0.23
    'email_share_item_mail' => 'Hola,&lt;br&gt;&lt;br&gt;&lt;u&gt;#tp_user#&lt;/u&gt; ha compartido con usted el elemento &lt;b&gt;#tp_item#&lt;/b&gt;&lt;br&gt;Pulse &lt;a href="#tp_link#"&gt;aquí&lt;/a&gt; para acceder.&lt;br&gt;&lt;br&gt;Saludos.',
 * @version   3.0.0.23
    'email_share_item_mail' => 'Hello,<br><br>This is a generated email from Teampass passwords manager.<br><br>#tp_user# has shared with you the password item #tp_item#.<br><br><a href="#tp_link#">Click this link</a> to access the item.<br><br><br>Greetings',
 * @version   3.0.0.23
 * @version   3.0.0.23
 * @version   3.0.0.23
 * @version   3.0.0.23
 * @version   3.0.0.23
							The SaltKey is stored in a file called teampass-seckey.txt and hashed for security purpose. For security reasons, this file should be stored in a folder outside the WWW folder of your server (example: /var/teampass/). This key will be used to encrypt data when sharing information with users without any Teampass account. If this field remains empty, this file will be stored in folder <path to Teampass>/includes/.
 * @version   3.0.0.23
                    define('SECUREFILE', generateRandomKey(25));
                    $filename_seckey = $securePath . '/' . SECUREFILE;
define("SECUREFILE", "' . SECUREFILE. '");
 * @version   3.0.0.23
// new SECUREFILE - 3.0.0.23
function handleSecurefileConstant()
{
    if (defined('SECUREFILE') === false) {
        define('SECUREFILE', generateRandomKey(25));
        
        // manage the file itself by renaming it
        if (rename(SECUREPATH.'/teampass-seckey.txt', SECUREPATH.'/'.SECUREFILE) === false) {
            echo '[{
                "error" : "File `'.SECUREPATH.'/teampass-seckey.txt` could not be renamed. Please do it by yourself and click on button Launch.",
                "index" : ""
            }]';
            exit;
        }

        // Ensure DB is read as UTF8
        if (defined('DB_ENCODING') === false) {
            define('DB_ENCODING', "utf8");
        }

        // Now create new file
        $file_handled = fopen('../includes/config/settings.php', 'w');
        
        $settingsTxt = '<?php
// DATABASE connexion parameters
define("DB_HOST", "' . DB_HOST . '");
define("DB_USER", "' . DB_USER . '");
define("DB_PASSWD", "' . DB_PASSWD . '");
define("DB_NAME", "' . DB_NAME . '");
define("DB_PREFIX", "' . DB_PREFIX . '");
define("DB_PORT", "' . DB_PORT . '");
define("DB_ENCODING", "' . DB_ENCODING . '");
define("DB_SSL", array(
    "key" => "'.DB_SSL['key'].'",
    "cert" => "'.DB_SSL['cert'].'",
    "ca_cert" => ""'.DB_SSL['ca_cert'].',
    "ca_path" => "'.DB_SSL['ca_path'].'",
    "cipher" => "'.DB_SSL['cipher'].'"
));
define("DB_CONNECT_OPTIONS", array(
    MYSQLI_OPT_CONNECT_TIMEOUT => 10
));
define("SECUREPATH", "' . str_replace('\\', '\\\\', SECUREPATH) . '");
define("SECUREFILE", "' . SECUREFILE. '");';

        if (defined('IKEY') === true) $settingsTxt .= '
define("IKEY", "' . IKEY . '");';
        else $settingsTxt .= '
define("IKEY", "");';
        if (defined('SKEY') === true) $settingsTxt .= '
define("SKEY", "' . SKEY . '");';
        else $settingsTxt .= '
define("SKEY", "");';
        if (defined('HOST') === true) $settingsTxt .= '
define("HOST", "' . HOST . '");';
        else $settingsTxt .= '
define("HOST", "");';


        $settingsTxt .= '

if (isset($_SESSION[\'settings\'][\'timezone\']) === true) {
    date_default_timezone_set($_SESSION[\'settings\'][\'timezone\']);
}
';

        $fileCreation = fwrite(
            $file_handled,
            utf8_encode($settingsTxt)
        );

        fclose($file_handled);
        sleep(3);
        if ($fileCreation === false) {
            return [
                'error' => true,
                'message' => 'Setting.php file could not be created in /includes/config/ folder. Please check the path and the rights.',
            ];
        }

        return [
            'error' => false,
            'message' => ''
        ];
    }
}
        // new check - 3.0.0.23
        $ascii_key = file_get_contents(SECUREPATH.'/'.SECUREFILE);
 * @version   3.0.0.23
 * @version   3.0.0.23
define("SECUREFILE", "' . SECUREFILE. '");

 * @version   3.0.0.23

// 3.0.0.23
$ret = handleSecurefileConstant();
if ($ret['error'] === true) {
    echo '[{"finish":"1", "msg":"", "error":"'.$ret['message'].'"}]';
    exit();
}

// Get the encrypted password


 * @version   3.0.0.23
 * @version   3.0.0.23
            $ascii_key = file_get_contents(SECUREPATH.'/'.SECUREFILE);
 * @version   3.0.0.23
 * @version   3.0.0.23
 * @version   3.0.0.23
 * @version   3.0.0.23
 * @version   3.0.0.23
 * @version   3.0.0.23
 * @version   3.0.0.23
 * @version   3.0.0.23
 * @version   3.0.0.23
 * @version   3.0.0.23
 * @version   3.0.0.23
 * @version   3.0.0.23
 * @version   3.0.0.23
 * @version   3.0.0.23
 * @version   3.0.0.23
 * @version   3.0.0.23
 * @version   3.0.0.23
 * @version   3.0.0.23
 * @version   3.0.0.23
 * @version   3.0.0.23
 * @version   3.0.0.23
 * @version   3.0.0.23
 * @version   3.0.0.23
 * @version   3.0.0.23
 * @version   3.0.0.23
 * @version   3.0.0.23
 * @version   3.0.0.23
 * @version   3.0.0.23
    function checkAccess(itemId, treeId, userId)
    {
        var data = {
            'itemId': parseInt(itemId),
            'treeId': parseInt(treeId),
            'userId': parseInt(userId),
        };

        //Send query
        $.post(
            'sources/items.queries.php', {
                type: 'check_current_access_rights',
                data: prepareExchangedData(JSON.stringify(data), 'encode', '<?php echo $_SESSION['key']; ?>'),
                key: '<?php echo $_SESSION['key']; ?>'
            },
            function(data) {
                //decrypt data
                data = decodeQueryReturn(data, '<?php echo $_SESSION['key']; ?>', 'items.queries.php', 'show_details_item');
                requestRunning = true;
                if (debugJavascript === true) {
                    console.log("DEBUG: checkAccess");
                    console.log(data);
                }


                return false;
            }
        );
    }
        // check if user still has access
        if (checkAccess(itemId, itemTreeId, <?php echo $_SESSION['user_id']; ?>) === false) {
            toastr.remove();
            toastr.warning(
                '<?php echo langHdl('no_item_to_display'); ?>',
                '', {
                    timeOut: 5000,
                    progressBar: true
                }
            );

            // Finished
            return false;
        }

        // Store current view
        savePreviousView();
        
        if (debugJavascript === true) console.log("Request is running: " + requestRunning)

        // Store status query running
        requestRunning = true;
 * @version   3.0.0.23
 * @version   3.0.0.23
 * @version   3.0.0.23
 * @version   3.0.0.23
 * @version   3.0.0.23
 * @version   3.0.0.23
 * @version   3.0.0.23
 * @version   3.0.0.23
 * @version   3.0.0.23
 * @version   3.0.0.23
 * @version   3.0.0.23
 * @version   3.0.0.23
 * @version   3.0.0.23
 * @version   3.0.0.23
 * @version   3.0.0.23
 * @version   3.0.0.23
 * @version   3.0.0.23
 * @version   3.0.0.23
 * @version   3.0.0.23
 * @version   3.0.0.23
 * @version   3.0.0.23
 * @version   3.0.0.23
 * @version   3.0.0.23
 * @version   3.0.0.23
 * @version   3.0.0.23
 * @version   3.0.0.23
 * @version   3.0.0.23
 * @version   3.0.0.23
 * @version   3.0.0.23
 * @version   3.0.0.23
 * @version   3.0.0.23
 * @version   3.0.0.23
 * @version   3.0.0.23
 * @version   3.0.0.23
                $SETTINGS['cpassman_dir'],
                $SETTINGS['cpassman_dir'],
        $_SESSION['reencrypt_old_salt'] = file_get_contents(SECUREPATH.'/'.SECUREFILE);
        $old_sk_filename = SECUREPATH.'/'.SECUREFILE . date('Y_m_d', mktime(0, 0, 0, (int) date('m'), (int) date('d'), (int) date('y'))) . '.' . time();
            SECUREPATH.'/'.SECUREFILE,
            SECUREPATH.'/'.SECUREFILE,
        $_SESSION['reencrypt_new_salt'] = file_get_contents(SECUREPATH.'/'.SECUREFILE);
            $SETTINGS['cpassman_dir'],
                $SETTINGS['cpassman_dir'],
                $SETTINGS['cpassman_dir'],
            unlink(SECUREPATH.'/'.SECUREFILE);
                SECUREPATH.'/'.SECUREFILE
            $SETTINGS['cpassman_dir'],
 * @version   3.0.0.23
 * @version   3.0.0.23
 * @version   3.0.0.23
 * @version   3.0.0.23
 * @version   3.0.0.23
 * @version   3.0.0.23
 * @version   3.0.0.23
 * @version   3.0.0.23
                                    'folder' => implode('/', $arr_trees),
 * @version   3.0.0.23
 * @version   3.0.0.23
 * @version   3.0.0.23
 * @version   3.0.0.23
 * @version   3.0.0.23
 * @version   3.0.0.23
 * @version   3.0.0.23
 * @version   3.0.0.23
 * @version   3.0.0.23
            $arr_folders = [];
                        //array_push($arr_folders, (int) $folder->id);
            /*

                // save to cache_tree
                cacheTreeUserHandler(
                    (int) $_SESSION['user_id'],
                    json_encode($arr_folders),
                    $SETTINGS,
                    'folders',
                );
            */
            break;

        /*
        * CASE
        * check_current_access_rights
        */
        case 'check_current_access_rights':
            // Check KEY
            if ($inputData['key'] !== $_SESSION['key']) {
                echo (string) prepareExchangedData(
                    $SETTINGS['cpassman_dir'],
                    array(
                        'error' => 'key_not_conform',
                        'message' => langHdl('key_is_not_correct'),
                    ),
                    'encode'
                );
                break;
            }
            // decrypt and retrieve data in JSON format
            $dataReceived = prepareExchangedData(
                $SETTINGS['cpassman_dir'],
                $inputData['data'],
                'decode'
            );

            // prepare variables
            $inputData['userId'] = (int) filter_var($dataReceived['userId'], FILTER_SANITIZE_NUMBER_INT);
            $inputData['itemId'] = (int) filter_var($dataReceived['itemId'], FILTER_SANITIZE_NUMBER_INT);
            $inputData['treeId'] = (int) filter_var($dataReceived['treeId'], FILTER_SANITIZE_NUMBER_INT);

            $data = DB::queryFirstRow(
                'SELECT visible_folders
                FROM ' . prefixTable('cache_tree') . ' WHERE user_id = %i',
                $inputData['userId']
            );
            // Check if tree ID is in visible folders.
            if (null !== $data['visible_folders']) {
                $arr = json_decode($data['visible_folders'], true);
                $ids = array_column($arr, 'id');
            }


            $data = array(
                'error' => false,
                'access' => isset($inputData['treeId']) === true && in_array($inputData['treeId'], $ids) === true ? true : false,
            );

            // send data
            echo (string) prepareExchangedData(
                $SETTINGS['cpassman_dir'],
                $data,
                'encode'
            );

 * @version   3.0.0.23
 * @version   3.0.0.23
 * @version   3.0.0.23
    $ascii_key = empty($ascii_key) === true ? file_get_contents(SECUREPATH.'/'.SECUREFILE) : $ascii_key;
            array_push($foldersLimitedFull, $record['id_tree']);
        array_keys($restrictedFoldersForItems),
                ], JSON_HEX_QUOT | JSON_HEX_TAG),
    
        $ascii_key = file_get_contents(SECUREPATH.'/'.SECUREFILE);
 * @version   3.0.0.23
 * @version   3.0.0.23
            /*
            // update folders rights for users in cache_tree
            // Requested for real-time changes
            $rows = DB::query(
                'SELECT increment_id, folders
                FROM ' . prefixTable('cache_tree'),
            );

            foreach($rows as $row) {
                if ($row['folders'] === '' || $post_selectedFolders === null) {
                    continue;
                }
                // get visible folders
                $arr = json_decode($row['folders'], true);
                
                foreach($arr as $folder) {
                    if (in_array($folder, $post_selectedFolders) === true) {
                        unset($arr[$folder]);
                    }
                }
                print_r($arr);

                // update
                /*DB::update(
                    prefixTable('cache_tree'),
                    array(
                        'folders' => json_encode($arr),
                    ),
                    'increment_id = %i',
                    $row['increment_id']
                );*/
            }
            */

 * @version   3.0.0.23
 * @version   3.0.0.23
    $big_array = array_diff(
        array_unique(
            array_merge(
                $session_groupes_visibles, 
                $listFoldersLimitedKeys, 
                $listRestrictedFoldersForItemsKeys
            ), 
            SORT_NUMERIC
        ), 
        $session_forbiden_pfs
    );
 * @version   3.0.0.23
 * @version   3.0.0.23
 * @version   3.0.0.23
 * @version   3.0.0.23
 * @version   3.0.0.23
 * @version   3.0.0.23
 * @version   3.0.0.23