force regenerate session id on successful login, remove previous blank SID check

2 files changed, 8 insertions, 5 deletions

diff --git a/include/functions.php b/include/functions.php
index d88e96dd6..3cd21969d 100755
--- a/include/functions.php
+++ b/include/functions.php
@@ -712,7 +712,14 @@
 			}
 
 			if ($user_id && !$check_only) {
-				@session_start();
+
+				if (session_status() != PHP_SESSION_NONE) {
+					session_destroy();
+					session_commit();
+				}
+
+				session_start();
+				session_regenerate_id(true);
 
 				$_SESSION["uid"] = $user_id;
 				$_SESSION["version"] = VERSION_STATIC;
diff --git a/include/sessions.php b/include/sessions.php
index 2d17bfd8e..f625cd16f 100644
--- a/include/sessions.php
+++ b/include/sessions.php
@@ -160,9 +160,5 @@
 	if (!defined('NO_SESSION_AUTOSTART')) {
 		if (isset($_COOKIE[session_name()])) {
 			@session_start();
-
-			if (!$_SESSION['uid']) {
-				logout_user();
-			}
 		}
 	}