[geeklog-cvs] geeklog-1.3/system lib-sessions.php,1.14,1.14.2.1

[geeklog-cvs-admin at lists.geeklog.net]

Update of /usr/cvs/geeklog/geeklog-1.3/system
In directory internal.geeklog.net:/tmp/cvs-serv3565/system

Modified Files:
      Tag: geeklog_1_3_7sr1_1
	lib-sessions.php 
Log Message:
Don't trust the cookie data too much ...


Index: lib-sessions.php
===================================================================
RCS file: /usr/cvs/geeklog/geeklog-1.3/system/lib-sessions.php,v
retrieving revision 1.14
retrieving revision 1.14.2.1
diff -C2 -d -r1.14 -r1.14.2.1
*** lib-sessions.php	5 Sep 2002 19:38:46 -0000	1.14
--- lib-sessions.php	23 May 2003 11:42:20 -0000	1.14.2.1
***************
*** 100,114 ****
              if (isset($HTTP_COOKIE_VARS[$_CONF['cookie_name']])) {
                  $userid = $HTTP_COOKIE_VARS[$_CONF['cookie_name']];
!                 if (empty ($userid) || ($userid == 'deleted')) {
                      unset ($userid);
                  } else {
                      $cookie_password = $HTTP_COOKIE_VARS[$_CONF['cookie_password']];
                      $userpass = DB_getItem($_TABLES['users'],'passwd',"uid = $userid");
!                     if ($cookie_password <> $userpass) {
                          //User may have modified their UID in cookie, ignore them
                      } else {
                          if ($userid) {
                              $user_logged_in = 1;
!                             $sess_id = SESS_newSession($userid, $REMOTE_ADDR, $_CONF['session_cookie_timeout'], $_CONF['cookie_ip']);
                              SESS_setSessionCookie($sessid, $_CONF['session_cookie_timeout'], $_CONF['cookie_session'], $_CONF['cookie_path'], $_CONF['cookiedomain'], $_CONF['cookiesecure']);
                              $userdata = SESS_getUserDataFromId($userid);
--- 100,114 ----
              if (isset($HTTP_COOKIE_VARS[$_CONF['cookie_name']])) {
                  $userid = $HTTP_COOKIE_VARS[$_CONF['cookie_name']];
!                 if (empty ($userid) || !is_int ($userid)) {
                      unset ($userid);
                  } else {
                      $cookie_password = $HTTP_COOKIE_VARS[$_CONF['cookie_password']];
                      $userpass = DB_getItem($_TABLES['users'],'passwd',"uid = $userid");
!                     if (empty ($cookie_password) || ($cookie_password <> $userpass)) {
                          //User may have modified their UID in cookie, ignore them
                      } else {
                          if ($userid) {
                              $user_logged_in = 1;
!                             $sessid = SESS_newSession($userid, $REMOTE_ADDR, $_CONF['session_cookie_timeout'], $_CONF['cookie_ip']);
                              SESS_setSessionCookie($sessid, $_CONF['session_cookie_timeout'], $_CONF['cookie_session'], $_CONF['cookie_path'], $_CONF['cookiedomain'], $_CONF['cookiesecure']);
                              $userdata = SESS_getUserDataFromId($userid);
***************
*** 134,150 ****
  
              $userid = $HTTP_COOKIE_VARS[$_CONF['cookie_name']];
!             $cookie_password = $HTTP_COOKIE_VARS[$_CONF['cookie_password']];
!             $userpass = DB_getItem($_TABLES['users'],'passwd',"uid = $userid");
!             if ($cookie_password <> $userpass) {
!                 // User could have modified UID in cookie, don't do shit
              } else {
!                 if ($userid) {
!                     $user_logged_in = 1;
  
!                     // Create new session and write cookie
!                     $sessid = SESS_newSession($userid, $REMOTE_ADDR, $_CONF['session_cookie_timeout'], $_CONF['cookie_ip']);
!                     SESS_setSessionCookie($sessid, $_CONF['session_cookie_timeout'], $_CONF['cookie_session'], $_CONF['cookie_path'], $_CONF['cookiedomain'], $_CONF['cookiesecure']);
!                     $userdata = SESS_getUserDataFromId($userid);
!                     $_USER = $userdata;
                  }
              }
--- 134,154 ----
  
              $userid = $HTTP_COOKIE_VARS[$_CONF['cookie_name']];
!             if (!is_int ($userid)) {
!                 unset ($userid);
              } else {
!                 $cookie_password = $HTTP_COOKIE_VARS[$_CONF['cookie_password']];
!                 $userpass = DB_getItem($_TABLES['users'],'passwd',"uid = $userid");
!                 if (empty ($cookie_password) || ($cookie_password <> $userpass)) {
!                     // User could have modified UID in cookie, don't do shit
!                 } else {
!                     if ($userid) {
!                         $user_logged_in = 1;
  
!                         // Create new session and write cookie
!                         $sessid = SESS_newSession($userid, $REMOTE_ADDR, $_CONF['session_cookie_timeout'], $_CONF['cookie_ip']);
!                         SESS_setSessionCookie($sessid, $_CONF['session_cookie_timeout'], $_CONF['cookie_session'], $_CONF['cookie_path'], $_CONF['cookiedomain'], $_CONF['cookiesecure']);
!                         $userdata = SESS_getUserDataFromId($userid);
!                         $_USER = $userdata;
!                     }
                  }
              }
***************
*** 169,173 ****
  
      // Set cookie.
!     setcookie($_CONF['cookie_lastvisittemp'], $temptime ,$expiredate2, $_CONF['cookie_path'], $_CONF['site_url'], $_CONF['cookiesecure']);
  
      if ($_SESS_VERBOSE) {
--- 173,177 ----
  
      // Set cookie.
!     setcookie($_CONF['cookie_lastvisittemp'], $temptime ,$expiredate2, $_CONF['cookie_path'], $_CONF['cookiedomain'], $_CONF['cookiesecure']);
  
      if ($_SESS_VERBOSE) {