diff options
| -rw-r--r-- | config.php-dist | 7 | ||||
| -rw-r--r-- | include/sessions.php | 29 |
2 files changed, 0 insertions, 36 deletions
diff --git a/config.php-dist b/config.php-dist index 311b94df0..2eaaab617 100644 --- a/config.php-dist +++ b/config.php-dist @@ -141,13 +141,6 @@ // Default lifetime of a session (e.g. login) cookie. In seconds, // 0 means cookie will be deleted when browser closes. - define('SESSION_CHECK_ADDRESS', 1); - // Check client IP address when validating session: - // 0 - disable checking - // 1 - check first 3 octets of an address (recommended) - // 2 - check first 2 octets of an address - // 3 - check entire address - // ********************************* // *** Email and digest settings *** // ********************************* diff --git a/include/sessions.php b/include/sessions.php index 30d502641..c0ec64c3d 100644 --- a/include/sessions.php +++ b/include/sessions.php @@ -39,41 +39,12 @@ function validate_session() { if (SINGLE_USER_MODE) return true; - //if (VERSION_STATIC != $_SESSION["version"]) return false; - - $check_ip = $_SESSION['ip_address']; - - switch (SESSION_CHECK_ADDRESS) { - case 0: - $check_ip = ''; - break; - case 1: - $check_ip = substr($check_ip, 0, strrpos($check_ip, '.')+1); - break; - case 2: - $check_ip = substr($check_ip, 0, strrpos($check_ip, '.')); - $check_ip = substr($check_ip, 0, strrpos($check_ip, '.')+1); - break; - }; - - if ($check_ip && strpos($_SERVER['REMOTE_ADDR'], $check_ip) !== 0) { - $_SESSION["login_error_msg"] = - __("Session failed to validate (incorrect IP)"); - return false; - } - if (isset($_SESSION["ref_schema_version"]) && $_SESSION["ref_schema_version"] != session_get_schema_version(true)) { $_SESSION["login_error_msg"] = __("Session failed to validate (schema version changed)"); return false; } - /* if (sha1($_SERVER['HTTP_USER_AGENT']) != $_SESSION["user_agent"]) { - $_SESSION["login_error_msg"] = - __("Session failed to validate (user agent changed)"); - return false; - } */ - if ($_SESSION["uid"]) { $result = Db::get()->query( "SELECT pwd_hash FROM ttrss_users WHERE id = '".$_SESSION["uid"]."'"); |