Changeset 6661

Timestamp:

Jul 5, 2010, 9:35:36 PM (14 years ago)

Author:

nikrou

Message:

Bug 1760 fixed : Avoid session fixation
After connection, session id is changed using session_regenerate_id
but without removing old session. Passing param true makes the job

Merge from trunk

File:

• branches/2.1/include/functions_user.inc.php (modified) (1 diff)

branches/2.1/include/functions_user.inc.php

@@ -1101 +1101 @@
   { // we regenerate the session for security reasons
     // see http://www.acros.si/papers/session_fixation.pdf
-    session_regenerate_id();
+    session_regenerate_id(true);
   }
   else