Changeset 2757 for trunk/include/functions_user.inc.php

Timestamp:

Oct 16, 2008, 2:38:26 AM (16 years ago)

Author:

rvelices

Message:

merge 2755 and 2756 from branch 2.0 to trunk

• 2755 fix vulnerability ​http://www.milw0rm.com/exploits/6755
• 2756 security paranoia: protect session/remember me cookies from XSS attacks (works only if php>=5.2 and with IE/FF maybe others)

File:

• trunk/include/functions_user.inc.php (modified) (3 diffs)

trunk/include/functions_user.inc.php

@@ -1014 +1014 @@
     {
       $cookie = $user_id.'-'.$now.'-'.$key;
-      setcookie($conf['remember_me_name'],
+      if (version_compare(PHP_VERSION, '5.2', '>=') )
+      {
+        setcookie($conf['remember_me_name'],
             $cookie,
             time()+$conf['remember_me_length'],
-            cookie_path()
+            cookie_path(),ini_get('session.cookie_domain'),ini_get('session.cookie_secure'),
+            ini_get('session.cookie_httponly')
           );
+      }
+      else
+      {
+        setcookie($conf['remember_me_name'],
+            $cookie,
+            time()+$conf['remember_me_length'],
+            cookie_path(),ini_get('session.cookie_domain'),ini_get('session.cookie_secure')
+          );
+      }
     }
   }
   else
   { // make sure we clean any remember me ...
-    setcookie($conf['remember_me_name'], '', 0, cookie_path());
+    setcookie($conf['remember_me_name'], '', 0, cookie_path(),ini_get('session.cookie_domain'));
   }
   if ( session_id()!="" )
@@ -1063 +1075 @@
       }
     }
-    setcookie($conf['remember_me_name'], '', 0, cookie_path());
+    setcookie($conf['remember_me_name'], '', 0, cookie_path(),ini_get('session.cookie_domain'));
   }
   return false;
@@ -1091 +1103 @@
   trigger_action('login_failure', $username);
   return false;
+}
+
+/** Performs all the cleanup on user logout */
+function logout_user()
+{
+  global $conf;
+  $_SESSION = array();
+  session_unset();
+  session_destroy();
+  setcookie(session_name(),'',0,
+      ini_get('session.cookie_path'),
+      ini_get('session.cookie_domain')
+    );
+  setcookie($conf['remember_me_name'], '', 0, cookie_path(),ini_get('session.cookie_domain'));
 }