feature 2783: ability to disable ip address in the session id

git-svn-id: http://piwigo.org/svn/trunk@18850 68402e56-0260-453c-a942-63ccdbb3a9ee
Piwigo · Nov 1, 2012 · 200f22e · 200f22e
1 parent a715d83
commit 200f22e
Show file tree

Hide file tree

Showing 2 changed files with 11 additions and 0 deletions.
diff --git a/include/config_default.inc.php b/include/config_default.inc.php
@@ -405,6 +405,10 @@
 // session_length : time of validity for normal session, in seconds.
 $conf['session_length'] = 3600;
 
+// session_use_ip_address: avoid session hijacking by using a part of the IP
+// address
+$conf['session_use_ip_address'] = true;
+
 // +-----------------------------------------------------------------------+
 // |                            debug/performance                          |
 // +-----------------------------------------------------------------------+

diff --git a/include/functions_session.inc.php b/include/functions_session.inc.php
@@ -94,6 +94,13 @@ function pwg_session_close()
 
 function get_remote_addr_session_hash()
 {
+  global $conf;
+
+  if (!$conf['session_use_ip_address'])
+  {
+    return '';
+  }
+
   if (strpos($_SERVER['REMOTE_ADDR'],':')===false)
   {//ipv4
     return vsprintf(