From 65e98f40867862eb345676e23b633b9f52109d30 Mon Sep 17 00:00:00 2001 From: Andrew Dolgov Date: Mon, 15 Oct 2018 15:47:50 +0300 Subject: force regenerate session id on successful login, remove previous blank SID check --- include/functions.php | 9 ++++++++- include/sessions.php | 4 ---- 2 files changed, 8 insertions(+), 5 deletions(-) (limited to 'include') diff --git a/include/functions.php b/include/functions.php index d88e96dd6..3cd21969d 100755 --- a/include/functions.php +++ b/include/functions.php @@ -712,7 +712,14 @@ } if ($user_id && !$check_only) { - @session_start(); + + if (session_status() != PHP_SESSION_NONE) { + session_destroy(); + session_commit(); + } + + session_start(); + session_regenerate_id(true); $_SESSION["uid"] = $user_id; $_SESSION["version"] = VERSION_STATIC; diff --git a/include/sessions.php b/include/sessions.php index 2d17bfd8e..f625cd16f 100644 --- a/include/sessions.php +++ b/include/sessions.php @@ -160,9 +160,5 @@ if (!defined('NO_SESSION_AUTOSTART')) { if (isset($_COOKIE[session_name()])) { @session_start(); - - if (!$_SESSION['uid']) { - logout_user(); - } } } -- cgit v1.2.3