mirror/zoneminder
1
0 Fork 0
mirror of https://github.com/ZoneMinder/zoneminder.git synced 2026-09-08 11:26:15 -04:00
Code Issues Packages Projects Releases Wiki Activity

Add support for HTTP_X_FORWARDED_FOR instead of REMOTE_ADDR. Comment out debugging

Browse Source
This commit is contained in:
Isaac Connor committed 2023-05-12 12:53:26 -04:00
1 parent d0b8018d9c
commit e1c3584462
1 file changed
+8 -7
Download Patch File Download Diff File Expand all files Collapse all files
web/includes/session.php
+8 -7
View File
@@ -13,7 +13,7 @@ function zm_setcookie($cookie, $value, $options=array()) {
} else {
setcookie($cookie, $value, $options['expires'], '/; samesite=strict');
}
ZM\Debug("Setting cookie for $cookie to $value");
//ZM\Debug("Setting cookie for $cookie to $value");
}
// ZM session start function support timestamp management
@@ -41,14 +41,15 @@ function zm_session_start() {
}
ini_set('session.name', 'ZMSESSID');
ZM\Debug('Setting cookie parameters to '.print_r($currentCookieParams, true));
//ZM\Debug('Setting cookie parameters to '.print_r($currentCookieParams, true));
}
session_start();
$_SESSION['remoteAddr'] = $_SERVER['REMOTE_ADDR']; // To help prevent session hijacking
// To help prevent session hijacking
$_SESSION['remoteAddr'] = (!empty($_SERVER['HTTP_X_FORWARDED_FOR']) ? $_SERVER['HTTP_X_FORWARDED_FOR'] : $_SERVER['REMOTE_ADDR']);
$now = time();
// Do not allow to use expired session ID
if ( !empty($_SESSION['last_time']) && ($_SESSION['last_time'] < ($now - 180)) ) {
ZM\Info('Destroying session due to timeout.');
//ZM\Info('Destroying session due to timeout.');
session_destroy();
session_start();
} else if ( !empty($_SESSION['generated_at']) ) {
@@ -70,12 +71,12 @@ function zm_session_regenerate_id() {
session_start();
ZM\Debug("Regenerating session. Old id was " . session_id());
//ZM\Debug("Regenerating session. Old id was " . session_id());
session_regenerate_id();
ZM\Debug("Regenerating session. New id was " . session_id());
//ZM\Debug("Regenerating session. New id was " . session_id());
unset($_SESSION['last_time']);
$_SESSION['generated_at'] = time();
$_SESSION['remoteAddr'] = $_SERVER['REMOTE_ADDR']; // To help prevent session hijacking
$_SESSION['remoteAddr'] = (!empty($_SERVER['HTTP_X_FORWARDED_FOR']) ? $_SERVER['HTTP_X_FORWARDED_FOR'] : $_SERVER['REMOTE_ADDR']);
} // function zm_session_regenerate_id()
function is_session_started() {