Changeset 18850

Timestamp:

Nov 1, 2012, 10:18:03 AM (11 years ago)

Author:

plg

Message:

feature 2783: ability to disable ip address in the session id

Location:

trunk/include

Files:

• config_default.inc.php (modified) (1 diff)
• functions_session.inc.php (modified) (1 diff)

trunk/include/config_default.inc.php

@@ -405 +405 @@
 // session_length : time of validity for normal session, in seconds.
 $conf['session_length'] = 3600;
+
+// session_use_ip_address: avoid session hijacking by using a part of the IP
+// address
+$conf['session_use_ip_address'] = true;
 
 // +-----------------------------------------------------------------------+

trunk/include/functions_session.inc.php

@@ -95 +95 @@
 function get_remote_addr_session_hash()
 {
+  global $conf;
+
+  if (!$conf['session_use_ip_address'])
+  {
+    return '';
+  }
+  
   if (strpos($_SERVER['REMOTE_ADDR'],':')===false)
   {//ipv4