Changeset 1004 for trunk/category.php

Timestamp:

Jan 15, 2006, 2:45:42 PM (18 years ago)

Author:

nikrou

Message:

Improve security of sessions:

• use only cookies to store session id on client side
• use default php session system with database handler to store sessions on server side

File:

• trunk/category.php (modified) (16 diffs)

trunk/category.php

@@ -32 +32 @@
 if ( isset( $_GET['act'] )
      and $_GET['act'] == 'logout'
-     and isset( $_COOKIE['id'] ) )
+     and isset( $_COOKIE[session_name()] ) )
 {
   // cookie deletion if exists
-  setcookie( 'id', '', 0, cookie_path() );
+  $_SESSION = array();
+  session_unset();
+  session_destroy();
+  setcookie(session_name(),'',0,'/');
   $url = 'category.php';
   redirect( $url );
@@ -164 +167 @@
   'L_REMEMBER_ME' => $lang['remember_me'],
   
-  'F_IDENTIFY' => add_session_id( PHPWG_ROOT_PATH.'identification.php' ),
+  'F_IDENTIFY' => PHPWG_ROOT_PATH.'identification.php',
   'T_RECENT' => $icon_recent,
 
-  'U_HOME' => add_session_id( PHPWG_ROOT_PATH.'category.php' ),
-  'U_REGISTER' => add_session_id( PHPWG_ROOT_PATH.'register.php' ),
-  'U_LOST_PASSWORD' => add_session_id(PHPWG_ROOT_PATH.'password.php'),
+  'U_HOME' => PHPWG_ROOT_PATH.'category.php',
+  'U_REGISTER' => PHPWG_ROOT_PATH.'register.php',
+  'U_LOST_PASSWORD' => PHPWG_ROOT_PATH.'password.php',
   'U_LOGOUT' => PHPWG_ROOT_PATH.'category.php?act=logout',
-  'U_ADMIN'=>add_session_id( PHPWG_ROOT_PATH.'admin.php' ),
-  'U_PROFILE'=>add_session_id(PHPWG_ROOT_PATH.'profile.php')
+  'U_ADMIN'=> PHPWG_ROOT_PATH.'admin.php',
+  'U_PROFILE'=> PHPWG_ROOT_PATH.'profile.php'
   )
 );
@@ -199 +202 @@
     'special_cat',
     array(
-      'URL' => add_session_id(PHPWG_ROOT_PATH.'category.php?cat=fav'),
+      'URL' => PHPWG_ROOT_PATH.'category.php?cat=fav',
       'TITLE' => $lang['favorite_cat_hint'],
       'NAME' => $lang['favorite_cat']
@@ -208 +211 @@
   'special_cat',
   array(
-    'URL' => add_session_id(PHPWG_ROOT_PATH.'category.php?cat=most_visited'),
+    'URL' => PHPWG_ROOT_PATH.'category.php?cat=most_visited',
     'TITLE' => $lang['most_visited_cat_hint'],
     'NAME' => $lang['most_visited_cat']
@@ -218 +221 @@
     'special_cat',
     array(
-      'URL' => add_session_id(PHPWG_ROOT_PATH.'category.php?cat=best_rated'),
+      'URL' => PHPWG_ROOT_PATH.'category.php?cat=best_rated',
       'TITLE' => $lang['best_rated_cat_hint'],
       'NAME' => $lang['best_rated_cat']
@@ -228 +231 @@
   'special_cat',
   array(
-    'URL' => add_session_id(PHPWG_ROOT_PATH.'random.php'),
+    'URL' => PHPWG_ROOT_PATH.'random.php',
     'TITLE' => $lang['random_cat_hint'],
     'NAME' => $lang['random_cat']
@@ -236 +239 @@
   'special_cat',
   array(
-    'URL' => add_session_id(PHPWG_ROOT_PATH.'category.php?cat=recent_pics'),
+    'URL' => PHPWG_ROOT_PATH.'category.php?cat=recent_pics',
     'TITLE' => $lang['recent_pics_cat_hint'],
     'NAME' => $lang['recent_pics_cat']
@@ -244 +247 @@
   'special_cat',
   array(
-    'URL' => add_session_id(PHPWG_ROOT_PATH.'category.php?cat=recent_cats'),
+    'URL' => PHPWG_ROOT_PATH.'category.php?cat=recent_cats',
     'TITLE' => $lang['recent_cats_cat_hint'],
     'NAME' => $lang['recent_cats_cat']
@@ -252 +255 @@
   'special_cat',
   array(
-    'URL' => add_session_id(PHPWG_ROOT_PATH.'category.php?cat=calendar'),
+    'URL' => PHPWG_ROOT_PATH.'category.php?cat=calendar',
     'TITLE' => $lang['calendar_hint'],
     'NAME' => $lang['calendar']
@@ -291 +294 @@
 'TITLE'=>$lang['hint_search'],
 'NAME'=>$lang['search'],
-'U_SUMMARY'=>add_session_id( 'search.php' ),
+'U_SUMMARY'=> 'search.php',
 ));
 
@@ -298 +301 @@
 'TITLE'=>$lang['hint_comments'],
 'NAME'=>$lang['comments'],
-'U_SUMMARY'=>add_session_id( 'comments.php' ),
+'U_SUMMARY'=> 'comments.php',
 ));
 
@@ -305 +308 @@
 'TITLE'=>$lang['about_page_title'],
 'NAME'=>$lang['About'],
-'U_SUMMARY'=>add_session_id( 'about.php?'.str_replace( '&', '&', $_SERVER['QUERY_STRING'] ) )
+'U_SUMMARY'=> 'about.php?'.str_replace( '&', '&', $_SERVER['QUERY_STRING'] ) 
 ));
 
@@ -314 +317 @@
     'TITLE'=>l10n('notification'),
     'NAME'=>l10n('Notification'),
-    'U_SUMMARY'=>add_session_id(PHPWG_ROOT_PATH.'notification.php')
+    'U_SUMMARY'=> PHPWG_ROOT_PATH.'notification.php'
 ));
 
@@ -325 +328 @@
     array(
       'URL' =>
-        add_session_id(
           PHPWG_ROOT_PATH.'admin.php?page=cat_modify'
           .'&cat_id='.$page['cat']
-          )
       )
     );
@@ -353 +354 @@
       array(
         'URL' =>
-          add_session_id(
             PHPWG_ROOT_PATH.'category.php'
             .get_query_string_diff(array('caddie')).'&caddie=1')
-        )
       );
   }
@@ -384 +383 @@
     $template->assign_block_vars(
       'upload',
-      array('U_UPLOAD'=>add_session_id( $url ))
+      array('U_UPLOAD'=> $url )
       );
   }