mirror/FreshRSS
0
0 Fork 0
mirror of https://github.com/FreshRSS/FreshRSS.git synced 2026-10-24 12:08:33 -04:00
Code Issues Packages Projects Releases Wiki Activity

Regenerate session ID on login (#7829)

Browse Source 
Follow-up to #7762

* Regenerate session ID on login
* Send only one cookie
* Improvements
* Delete old session file
* Simplify
* Make function consistent with others
This commit is contained in:
Inverle authored and GitHub committed 2025-08-30 21:40:00 +02:00
1 parent 585875cda7
commit 200eafb352
3 files changed
+21 -12
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

app/Controllers/authController.php
+4 -6
View File
@@ -152,6 +152,7 @@ class FreshRSS_auth_Controller extends FreshRSS_ActionController {
);
if ($ok) {
// Set session parameter to give access to the user.
Minz_Session::regenerateID('FreshRSS');
Minz_Session::_params([
Minz_User::CURRENT_USER => $username,
'passwordHash' => FreshRSS_Context::userConf()->passwordHash,
@@ -203,6 +204,7 @@ class FreshRSS_auth_Controller extends FreshRSS_ActionController {
$ok = password_verify($password, $s);
unset($password);
if ($ok) {
Minz_Session::regenerateID('FreshRSS');
Minz_Session::_params([
Minz_User::CURRENT_USER => $username,
'passwordHash' => $s,
@@ -243,6 +245,7 @@ class FreshRSS_auth_Controller extends FreshRSS_ActionController {
)) {
Minz_Request::setBadNotification(_t('feedback.auth.login.invalid'));
} else {
Minz_Session::regenerateID('FreshRSS');
Minz_Session::_param('lastReauth', time());
Minz_Request::forward($redirect, true);
return;
@@ -259,12 +262,7 @@ class FreshRSS_auth_Controller extends FreshRSS_ActionController {
if (Minz_Request::isPost()) {
invalidateHttpCache();
FreshRSS_Auth::removeAccess();
ini_set('session.use_cookies', '1');
Minz_Session::lock();
Minz_Session::regenerateID();
Minz_Session::unlock();
Minz_Session::regenerateID('FreshRSS');
Minz_Request::good(_t('feedback.auth.logout.success'), [ 'c' => 'index', 'a' => 'index' ]);
} else {
Minz_Error::error(403);