moparisthebest/wallabag
1
0
Fork 0
mirror of https://github.com/moparisthebest/wallabag synced 2024-11-23 17:42:15 -05:00
Code Issues Releases Wiki Activity

Merge pull request #567 from mariroz/fix-session-livetime

Browse Source 
fix of #115 - stay connected and session livetime
This commit is contained in:
Nicolas Lœuillet 2014-03-17 21:49:42 +01:00
commit a7048bc45d
3 changed files with 27 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
inc/3rdparty/Session.class.php vendored
View File

@ -31,9 +31,9 @@ class Session
public static $sessionName = ''; public static $sessionName = '';
// If the user does not access any page within this time, // If the user does not access any page within this time,
// his/her session is considered expired (3600 sec. = 1 hour) // his/her session is considered expired (3600 sec. = 1 hour)
public static $inactivityTimeout = 86400; public static $inactivityTimeout = 3600;
// Extra timeout for long sessions (if enabled) (82800 sec. = 23 hours) // Extra timeout for long sessions (if enabled) (82800 sec. = 23 hours)
public static $longSessionTimeout = 604800; // 604800 = a week public static $longSessionTimeout = 7776000; // 7776000 = 90 days
// If you get disconnected often or if your IP address changes often. // If you get disconnected often or if your IP address changes often.
// Let you disable session cookie hijacking protection // Let you disable session cookie hijacking protection
public static $disableSessionProtection = false; public static $disableSessionProtection = false;
@ -48,8 +48,13 @@ class Session
/** /**
* Initialize session * Initialize session
*/ */
public static function init() public static function init($longlastingsession = false)
{ {
//check if session name is correct
if ( session_id() && session_id()!=self::$sessionName ) {
session_destroy();
}
// Force cookie path (but do not change lifetime) // Force cookie path (but do not change lifetime)
$cookie = session_get_cookie_params(); $cookie = session_get_cookie_params();
// Default cookie expiration and path. // Default cookie expiration and path.
@ -61,12 +66,19 @@ class Session
if (isset($_SERVER["HTTPS"]) && $_SERVER["HTTPS"] == "on") { if (isset($_SERVER["HTTPS"]) && $_SERVER["HTTPS"] == "on") {
$ssl = true; $ssl = true;
} }
session_set_cookie_params(self::$longSessionTimeout, $cookiedir, $_SERVER['HTTP_HOST'], $ssl);
if ( $longlastingsession ) {
session_set_cookie_params(self::$longSessionTimeout, $cookiedir, $_SERVER['HTTP_HOST'], $ssl, true);
}
else {
session_set_cookie_params('', $cookiedir, $_SERVER['HTTP_HOST'], $ssl, true);
}
// Use cookies to store session. // Use cookies to store session.
ini_set('session.use_cookies', 1); ini_set('session.use_cookies', 1);
// Force cookies for session (phpsessionID forbidden in URL) // Force cookies for session (phpsessionID forbidden in URL)
ini_set('session.use_only_cookies', 1); ini_set('session.use_only_cookies', 1);
if (!session_id()) { if ( !session_id() ) {
// Prevent php to use sessionID in URL if cookies are disabled. // Prevent php to use sessionID in URL if cookies are disabled.
ini_set('session.use_trans_sid', false); ini_set('session.use_trans_sid', false);
if (!empty(self::$sessionName)) { if (!empty(self::$sessionName)) {
@ -115,6 +127,9 @@ class Session
if (self::banCanLogin()) { if (self::banCanLogin()) {
if ($login === $loginTest && $password === $passwordTest) { if ($login === $loginTest && $password === $passwordTest) {
self::banLoginOk(); self::banLoginOk();
self::init($longlastingsession);
// Generate unique random number to sign forms (HMAC) // Generate unique random number to sign forms (HMAC)
$_SESSION['uid'] = sha1(uniqid('', true).'_'.mt_rand()); $_SESSION['uid'] = sha1(uniqid('', true).'_'.mt_rand());
$_SESSION['ip'] = self::_allIPs(); $_SESSION['ip'] = self::_allIPs();
@ -135,6 +150,7 @@ class Session
self::banLoginFailed(); self::banLoginFailed();
} }
self::init();
return false; return false;
} }

2
inc/poche/Poche.class.php
View File

@ -61,8 +61,6 @@ class Poche
private function init() private function init()
{ {
Tools::initPhp(); Tools::initPhp();
Session::$sessionName = 'poche';
Session::init();
if (isset($_SESSION['poche_user']) && $_SESSION['poche_user'] != array()) { if (isset($_SESSION['poche_user']) && $_SESSION['poche_user'] != array()) {
$this->user = $_SESSION['poche_user']; $this->user = $_SESSION['poche_user'];

6
index.php
View File

@ -12,6 +12,12 @@ define ('POCHE', '1.5.3');
require 'check_setup.php'; require 'check_setup.php';
require_once 'inc/poche/global.inc.php'; require_once 'inc/poche/global.inc.php';
# Start session
Session::$sessionName = 'poche';
if ( !isset($_GET['login']) ) {
Session::init();
}
# Start Poche # Start Poche
$poche = new Poche(); $poche = new Poche();
$notInstalledMessage = $poche -> getNotInstalledMessage(); $notInstalledMessage = $poche -> getNotInstalledMessage();