mirror of
https://github.com/ZoneMinder/zoneminder.git
synced 2026-02-04 11:31:13 -05:00
2b90bf15a6
* Introduce ZM_COOKIE_LIFETIME which sets the life of the SESSION cookie, instead of using what is in php.ini * Use zm specific session functions, which are now located in includes/session.php. Be more agressive about clearing session on logout. * Move session code to includes/session.php * remove duplicate line * Move is_session_open to session.php. Move code to clear a session into session.php * improve debug line when there is a problem updating config entry * split description into description and help text for COOKIE_LIFETIME * Remove redirect on line. We do it in javascript on postlogin view so that we can say logging in before switching to console * If there is a username in the session, then we are logged in, but we need to load the user object from the db. We can't just trust it from the session. The user may have been deleted and having that data in the session can be a security risk. So load the user object on every request. * Use session_regenerate_id instead of our broken code to do the same * Move auth code to includes/auth.php * add autocomplete tags to username and password inputs * Don't redirect to login if we are already viewing login. Put auth before including skin includes * need to include session.php in auth.php * update to php namespace
66 lines
2.1 KiB
PHP
66 lines
2.1 KiB
PHP
<?php
|
|
// ZM session start function support timestamp management
|
|
function zm_session_start() {
|
|
// Make sure use_strict_mode is enabled.
|
|
// use_strict_mode is mandatory for security reasons.
|
|
ini_set('session.use_strict_mode', 1);
|
|
|
|
$currentCookieParams = session_get_cookie_params();
|
|
$currentCookieParams['lifetime'] = ZM_COOKIE_LIFETIME;
|
|
|
|
ZM\Logger::Debug('Setting cookie parameters to lifetime('.$currentCookieParams['lifetime'].') path('.$currentCookieParams['path'].') domain ('.$currentCookieParams['domain'].') secure('.$currentCookieParams['secure'].') httpOnly(1)');
|
|
session_set_cookie_params(
|
|
$currentCookieParams['lifetime'],
|
|
$currentCookieParams['path'],
|
|
$currentCookieParams['domain'],
|
|
$currentCookieParams['secure'],
|
|
true
|
|
);
|
|
|
|
ini_set('session.name', 'ZMSESSID');
|
|
|
|
session_start();
|
|
// Do not allow to use expired session ID
|
|
if (!empty($_SESSION['last_time']) && $_SESSION['last_time'] < time() - 180) {
|
|
session_destroy();
|
|
session_start();
|
|
}
|
|
} // function zm_session_start()
|
|
|
|
// My session regenerate id function
|
|
function zm_session_regenerate_id() {
|
|
if ( session_status() != PHP_SESSION_ACTIVE ) {
|
|
session_start();
|
|
}
|
|
// Set deleted timestamp. Session data must not be deleted immediately for reasons.
|
|
$_SESSION['last_time'] = time();
|
|
session_regenerate_id();
|
|
unset($_SESSION['last_time']);
|
|
} // function zm_session_regenerate_id()
|
|
|
|
function is_session_started() {
|
|
if ( php_sapi_name() !== 'cli' ) {
|
|
if ( version_compare(phpversion(), '5.4.0', '>=') ) {
|
|
return session_status() === PHP_SESSION_ACTIVE ? TRUE : FALSE;
|
|
} else {
|
|
return session_id() === '' ? FALSE : TRUE;
|
|
}
|
|
} else {
|
|
Warning("php_sapi_name === 'cli'");
|
|
}
|
|
return FALSE;
|
|
} // function is_session_started()
|
|
|
|
function zm_session_clear() {
|
|
session_start();
|
|
$_SESSION = array();
|
|
if ( ini_get('session.use_cookies') ) {
|
|
$p = session_get_cookie_params();
|
|
# Update the cookie to expire in the past.
|
|
setcookie(session_name(), '', time() - 31536000, $p['path'], $p['domain'], $p['secure'], $p['httponly']);
|
|
}
|
|
session_unset();
|
|
session_destroy();
|
|
} // function zm_session_clear()
|
|
?>
|