Changeset 1853 in ExiteCMS for trunk/includes/session_functions.php

Timestamp:

10/16/08 11:37:18 (4 years ago)

Author:

hverton

Message:

fixed session issue in the albums module
blog previous now breaks after a complete paragraph
fixed PHP notice in feeds.php when using PHP5
fixed MySQL error in viewforum.php/viewposts.php when using MySQL v5.x
fixed PHP warning in calls.httpdownload.php when using PHP5
added locale direction (ltr/rtl) to hoteditor
fixed issue with ocassional empty [URL] tags in hoteditor
fixed wrong returncode from sendemail() in sendmail_include.php
fixed issues in session management when behind loadbalanced proxies or ISP links (changing public IP address)
fixed typo in the album gallery edit template
fixed mismatched quotes in pm post causing hoteditor message retrieval to fail
fixed versioning issue in the menu, user info and welcome panel module installers
fixed PHP notice in setuser.php

File:

• trunk/includes/session_functions.php (modified) (2 diffs)

trunk/includes/session_functions.php

@@ -36 +36 @@
 // to stay in the same session when uploading file(s)
 // (session hijacking is mitigated by the session_ua function)
-if (isset($_POST['SWFSESSIONID']) && !empty($_POST['SWFSESSIONID'])) {
-    $_COOKIE['site_visited'] = $_POST['SWFSESSIONID'];
-}
 if (isset($_POST[$settings['session_name']]) && !empty($_POST[$settings['session_name']])) {
     session_id($_POST[$settings['session_name']]);
@@ -207 +204 @@
 
     $session_ua = "";
-//  $session_ua .= isset($_SERVER['HTTP_USER_AGENT']) ? $_SERVER['HTTP_USER_AGENT'] : "";
-    $session_ua .= isset($_SERVER['REMOTE_ADDR']) ? $_SERVER['REMOTE_ADDR'] : "";
-    $session_ua .= isset($_SERVER['HTTP_VIA']) ? $_SERVER['HTTP_VIA'] : "";
-    $session_ua .= isset($_SERVER['HTTP_X_FORWARDED_FOR']) ? $_SERVER['HTTP_X_FORWARDED_FOR'] : "";
+
+    // when called from SWFUpload, set the session cookies from the post variable
+    // to stay in the same session when uploading file(s)
+    // (session hijacking is mitigated by the session_ua function)
+    if (isset($_POST['SWFSESSIONID']) && !empty($_POST['SWFSESSIONID']) && strlen($_POST['SWFSESSIONID'])==32) {
+        return $_POST['SWFSESSIONID'];
+    }
+    $session_ua .= isset($_SERVER['HTTP_USER_AGENT']) ? $_SERVER['HTTP_USER_AGENT'] : "";
+//  $session_ua .= isset($_SERVER['REMOTE_ADDR']) ? $_SERVER['REMOTE_ADDR'] : "";
     $session_ua .= isset($_COOKIE['site_visited']) ? $_COOKIE['site_visited'] : "";