From 888ea5150d6110e69e16156a8740c4407a478bfc Mon Sep 17 00:00:00 2001
From: ja <ja@verag.ag>
Date: Thu, 14 Oct 2021 11:14:04 +0200
Subject: [PATCH] =?UTF-8?q?=C3=84nderungen=20algorithmus=20verschl=C3=BCss?=
 =?UTF-8?q?elung=20session=20key=20email=20pw=20reset?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 Web.config             | 2 +-
 login/ChangePW.aspx.vb | 4 ++--
 login/ForgotPW.aspx.vb | 6 +++---
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/Web.config b/Web.config
index 204a863..e8be221 100644
--- a/Web.config
+++ b/Web.config
@@ -27,7 +27,7 @@
     <authentication mode="Forms">
       <forms defaultUrl="/Customers/CustomsAviso.aspx" loginUrl="login/Login_FLEX.aspx" slidingExpiration="true" timeout="2880"/>
     </authentication>
-    <sessionState mode="InProc" timeout="1800" cookieless="false"  regenerateExpiredSessionId="true" compressionEnabled="false"/>
+    <sessionState mode="InProc" timeout="1800" cookieless="false"  regenerateExpiredSessionId="false" compressionEnabled="false" useHostingIdentity="true" />
     <httpRuntime requestValidationMode="2.0" targetFramework="4.7"/>
     <pages validateRequest="false" controlRenderingCompatibilityVersion="4.0"/>
     <!--<securityPolicy>
diff --git a/login/ChangePW.aspx.vb b/login/ChangePW.aspx.vb
index 3e47722..00f9586 100644
--- a/login/ChangePW.aspx.vb
+++ b/login/ChangePW.aspx.vb
@@ -100,9 +100,9 @@ Partial Class login_ChangePW
     End Sub
 
     Function getDateoftoken(tokenname As String) As Boolean
-        Dim data() As Byte = Convert.FromBase64String(VERAG_PROG_ALLGEMEIN.cCryptography.Decrypt(tokenname))
+        Dim data() As Byte = Convert.FromBase64String(VERAG_PROG_ALLGEMEIN.cCryptography2.Decrypt(tokenname))
         Dim wenn As DateTime = DateTime.FromBinary(BitConverter.ToInt64(data, 0))
-        Dim nameoftoken = VERAG_PROG_ALLGEMEIN.cCryptography.Decrypt(tokenname)
+        Dim nameoftoken = VERAG_PROG_ALLGEMEIN.cCryptography2.Decrypt(tokenname)
         If wenn < DateTime.UtcNow.AddMinutes(-30) Then
             nameoftoken = String.Empty
             'MsgBox("Token has not been found or is too old!" + Environment.NewLine + "Please send a new E-mail!")
diff --git a/login/ForgotPW.aspx.vb b/login/ForgotPW.aspx.vb
index c205014..553d859 100644
--- a/login/ForgotPW.aspx.vb
+++ b/login/ForgotPW.aspx.vb
@@ -96,6 +96,7 @@ Partial Class login_ForgotPW
             If Session.Item("TokenforEmail") = Nothing Then
                 tokenname = genToken(username, password, email)
                 Session.Add("TokenforEmail", tokenname)
+                Session.Add("SessID", VERAG_PROG_ALLGEMEIN.cCryptography.Encrypt(Session.SessionID))
             Else
                 tokenname = Session.Item("TokenforEmail")
             End If
@@ -157,7 +158,6 @@ Partial Class login_ForgotPW
         Dim getdomianenvironment As String = String.Empty
         Dim pagename As String = String.Empty
         Dim ServPort As String = String.Empty
-
         Dim mailto As String = String.Empty
         Dim Betreff As String = String.Empty
         Dim htmlbody As String = String.Empty
@@ -167,14 +167,14 @@ Partial Class login_ForgotPW
             'pagename = Request.ServerVariables("SCRIPT_NAME")
             mailto = email
             Betreff = "Passwort reset"
-            htmlbody = String.Format("Dear, {0},<br /><br /> Please follow the Link to reset your password:<br /><br />" + Environment.NewLine + "<a runat=" + "server" + " href=http://" + getdomianenvironment + ServPort + "/login/ChangePW.aspx?Par1=" + tokenname + ">Link</a>" + Environment.NewLine + "<br />Kind regards, <br />VERAG | EDV Support<br />support@verag.ag,", username, password)
+            htmlbody = String.Format("Dear, {0},<br /><br /> Please follow the Link to reset your password:<br /><br />" + Environment.NewLine + "<a runat=" + "server" + " href=http://" + getdomianenvironment + ServPort + "/login/ChangePW.aspx?Par1=" + VERAG_PROG_ALLGEMEIN.cCryptography.Encrypt(tokenname) + ">Link</a>" + Environment.NewLine + "<br />Kind regards, <br />VERAG | EDV Support<br />support@verag.ag,", username, password)
         ElseIf String.IsNullOrWhiteSpace(HttpContext.Current.Request.ServerVariables("SERVER_NAME")) = False Then
             getdomianenvironment = HttpContext.Current.Request.ServerVariables("SERVER_NAME")
             ServPort = String.Empty
             'pagename = Request.ServerVariables("SCRIPT_NAME")
             mailto = email
             Betreff = "Passwort reset"
-            htmlbody = String.Format("Dear, {0},<br /><br /> Please follow the Link to reset your password:<br /><br />" + Environment.NewLine + "<a runat=" + "server" + " href=http://" + getdomianenvironment + "/login/ChangePW.aspx?Par1=" + tokenname + ">Link</a>" + Environment.NewLine + "<br />Kind regards, <br />VERAG | EDV Support<br />support@verag.ag,", username, password)
+            htmlbody = String.Format("Dear, {0},<br /><br /> Please follow the Link to reset your password:<br /><br />" + Environment.NewLine + "<a runat=" + "server" + " href=http://" + getdomianenvironment + "/login/ChangePW.aspx?Par1=" + VERAG_PROG_ALLGEMEIN.cCryptography.Encrypt(tokenname) + ">Link</a>" + Environment.NewLine + "<br />Kind regards, <br />VERAG | EDV Support<br />support@verag.ag,", username, password)
         ElseIf String.IsNullOrWhiteSpace(HttpContext.Current.Request.ServerVariables("SERVER_NAME")) = True Then
             'MsgBox("Error09:" + Environment.NewLine + "The Domain could not be vaildated. Check Link please or contact the Administrator of the program.")
             lblMessage.ForeColor = Color.OrangeRed