Changeset 2452 for trunk/modules/auth

Timestamp:

04/08/2008 11:27:44 AM (8 months ago)

Author:

Geert

Message:

It is a good idea to regenerate session identifiers whenever a user's privilege level changes.

Also see: http://shiflett.org/articles/session-fixation

Location:

trunk/modules/auth

Files:

• libraries/Auth.php (modified) (2 diffs)
• models/user.php (modified) (1 diff)

trunk/modules/auth/libraries/Auth.php

@@ -199 +199 @@
                         // Remove the user object from the session
                         unset($_SESSION['auth_user']);
+
+                        // Regenerate session_id
+                        $this->session->regenerate();
                 }
 
@@ -317 +320 @@
                 $user->save();
 
+                // Regenerate session_id
+                $this->session->regenerate();
+
                 // Store session data
                 $_SESSION['auth_user'] = $user;

trunk/modules/auth/models/user.php

@@ -26 +26 @@
         public function __set($key, $value)
         {
-                static $auth;
-
                 if ($key === 'password')
                 {