[geeklog-cvs] geeklog-1.3/system lib-sessions.php,1.17,1.18

[geeklog-cvs-admin at lists.geeklog.net]

Update of /usr/cvs/geeklog/geeklog-1.3/system
In directory internal.geeklog.net:/tmp/cvs-serv3547/system

Modified Files:
	lib-sessions.php 
Log Message:
Don't trust the cookie data too much ...


Index: lib-sessions.php
===================================================================
RCS file: /usr/cvs/geeklog/geeklog-1.3/system/lib-sessions.php,v
retrieving revision 1.17
retrieving revision 1.18
diff -C2 -d -r1.17 -r1.18
*** lib-sessions.php	21 May 2003 10:33:20 -0000	1.17
--- lib-sessions.php	23 May 2003 11:42:06 -0000	1.18
***************
*** 109,118 ****
              if (isset($HTTP_COOKIE_VARS[$_CONF['cookie_name']])) {
                  $userid = $HTTP_COOKIE_VARS[$_CONF['cookie_name']];
!                 if (empty ($userid) || ($userid == 'deleted')) {
                      unset ($userid);
                  } else {
                      $cookie_password = $HTTP_COOKIE_VARS[$_CONF['cookie_password']];
                      $userpass = DB_getItem($_TABLES['users'],'passwd',"uid = $userid");
!                     if ($cookie_password <> $userpass) {
                          //User may have modified their UID in cookie, ignore them
                      } else {
--- 109,118 ----
              if (isset($HTTP_COOKIE_VARS[$_CONF['cookie_name']])) {
                  $userid = $HTTP_COOKIE_VARS[$_CONF['cookie_name']];
!                 if (empty ($userid) || !is_int ($userid)) {
                      unset ($userid);
                  } else {
                      $cookie_password = $HTTP_COOKIE_VARS[$_CONF['cookie_password']];
                      $userpass = DB_getItem($_TABLES['users'],'passwd',"uid = $userid");
!                     if (empty ($cookie_password) || ($cookie_password <> $userpass)) {
                          //User may have modified their UID in cookie, ignore them
                      } else {
***************
*** 143,159 ****
  
              $userid = $HTTP_COOKIE_VARS[$_CONF['cookie_name']];
!             $cookie_password = $HTTP_COOKIE_VARS[$_CONF['cookie_password']];
!             $userpass = DB_getItem($_TABLES['users'],'passwd',"uid = $userid");
!             if ($cookie_password <> $userpass) {
!                 // User could have modified UID in cookie, don't do shit
              } else {
!                 if ($userid) {
!                     $user_logged_in = 1;
  
!                     // Create new session and write cookie
!                     $sessid = SESS_newSession($userid, $REMOTE_ADDR, $_CONF['session_cookie_timeout'], $_CONF['cookie_ip']);
!                     SESS_setSessionCookie($sessid, $_CONF['session_cookie_timeout'], $_CONF['cookie_session'], $_CONF['cookie_path'], $_CONF['cookiedomain'], $_CONF['cookiesecure']);
!                     $userdata = SESS_getUserDataFromId($userid);
!                     $_USER = $userdata;
                  }
              }
--- 143,163 ----
  
              $userid = $HTTP_COOKIE_VARS[$_CONF['cookie_name']];
!             if (!is_int ($userid)) {
!                 unset ($userid);
              } else {
!                 $userpass = DB_getItem($_TABLES['users'],'passwd',"uid = $userid");
!                 $cookie_password = $HTTP_COOKIE_VARS[$_CONF['cookie_password']];
!                 if (empty ($cookie_password) || ($cookie_password <> $userpass)) {
!                     // User could have modified UID in cookie, don't do shit
!                 } else {
!                     if ($userid) {
!                         $user_logged_in = 1;
  
!                         // Create new session and write cookie
!                         $sessid = SESS_newSession($userid, $REMOTE_ADDR, $_CONF['session_cookie_timeout'], $_CONF['cookie_ip']);
!                         SESS_setSessionCookie($sessid, $_CONF['session_cookie_timeout'], $_CONF['cookie_session'], $_CONF['cookie_path'], $_CONF['cookiedomain'], $_CONF['cookiesecure']);
!                         $userdata = SESS_getUserDataFromId($userid);
!                         $_USER = $userdata;
!                     }
                  }
              }