adam/Piwigo
1
0
Fork 0
mirror of https://github.com/Piwigo/Piwigo.git synced 2026-08-07 17:23:04 +02:00
Code Issues Packages Projects Releases Wiki Activity

- security paranoia: protect session/remember me cookies from XSS attacks (works only if php>=5.2 and with IE/FF maybe others)

Browse Source 
git-svn-id: http://piwigo.org/svn/branches/2.0@2756 68402e56-0260-453c-a942-63ccdbb3a9ee
This commit is contained in:
rvelices
2008-10-16 00:35:30 +00:00
parent 7807d6586a
commit f7f8c1688e
4 changed files with 40 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files
include/functions_user.inc.php
+30 -4
View File
@@ -1013,16 +1013,28 @@ function log_user($user_id, $remember_me)
if ($key!==false)
{
$cookie = $user_id.'-'.$now.'-'.$key;
setcookie($conf['remember_me_name'],
if (version_compare(PHP_VERSION, '5.2', '>=') )
{
setcookie($conf['remember_me_name'],
$cookie,
time()+$conf['remember_me_length'],
cookie_path()
cookie_path(),ini_get('session.cookie_domain'),ini_get('session.cookie_secure'),
ini_get('session.cookie_httponly')
);
}
else
{
setcookie($conf['remember_me_name'],
$cookie,
time()+$conf['remember_me_length'],
cookie_path(),ini_get('session.cookie_domain'),ini_get('session.cookie_secure')
);
}
}
}
else
{ // make sure we clean any remember me ...
setcookie($conf['remember_me_name'], '', 0, cookie_path());
setcookie($conf['remember_me_name'], '', 0, cookie_path(),ini_get('session.cookie_domain'));
}
if ( session_id()!="" )
{ // we regenerate the session for security reasons
@@ -1062,7 +1074,7 @@ function auto_login() {
return true;
}
}
setcookie($conf['remember_me_name'], '', 0, cookie_path());
setcookie($conf['remember_me_name'], '', 0, cookie_path(),ini_get('session.cookie_domain'));
}
return false;
}
@@ -1092,6 +1104,20 @@ SELECT '.$conf['user_fields']['id'].' AS id,
return false;
}
/** Performs all the cleanup on user logout */
function logout_user()
{
global $conf;
$_SESSION = array();
session_unset();
session_destroy();
setcookie(session_name(),'',0,
ini_get('session.cookie_path'),
ini_get('session.cookie_domain')
);
setcookie($conf['remember_me_name'], '', 0, cookie_path(),ini_get('session.cookie_domain'));
}
/*
* Return user status used in this library
* @return string