diff options
| author | Nils Adermann <naderman@naderman.de> | 2014-10-27 19:55:56 -0700 |
|---|---|---|
| committer | Nils Adermann <naderman@naderman.de> | 2014-10-27 19:55:56 -0700 |
| commit | 64d97d0787a63b3c646f89237574ac566ed89c50 (patch) | |
| tree | c3156462e9509fa95e09e2e07ab6d6af1a6356bb /phpBB | |
| parent | d51c1707e3220173996af6fa0e870fc44ea3e94d (diff) | |
| download | forums-64d97d0787a63b3c646f89237574ac566ed89c50.tar forums-64d97d0787a63b3c646f89237574ac566ed89c50.tar.gz forums-64d97d0787a63b3c646f89237574ac566ed89c50.tar.bz2 forums-64d97d0787a63b3c646f89237574ac566ed89c50.tar.xz forums-64d97d0787a63b3c646f89237574ac566ed89c50.zip | |
[ticket/13234] Never allow autologin/remember me to modify the userid
This prevents admin relogin with forced user id from overwriting
remember me cookies
PHPBB3-13234
Diffstat (limited to 'phpBB')
| -rw-r--r-- | phpBB/includes/session.php | 71 |
1 files changed, 40 insertions, 31 deletions
diff --git a/phpBB/includes/session.php b/phpBB/includes/session.php index 4c13a4f558..fcc6745021 100644 --- a/phpBB/includes/session.php +++ b/phpBB/includes/session.php @@ -553,6 +553,45 @@ class session $method = basename(trim($config['auth_method'])); include_once($phpbb_root_path . 'includes/auth/auth_' . $method . '.' . $phpEx); + $method = 'autologin_' . $method; + if (function_exists($method)) + { + $user_data = $method(); + + if ($user_id === false || (isset($user_data['user_id']) && $user_id = $user_data['user_id'])) + { + $this->data = $user_data; + } + + if (sizeof($this->data)) + { + $this->cookie_data['k'] = ''; + $this->cookie_data['u'] = $this->data['user_id']; + } + } + + // If we're presented with an autologin key we'll join against it. + // Else if we've been passed a user_id we'll grab data based on that + if (isset($this->cookie_data['k']) && $this->cookie_data['k'] && $this->cookie_data['u'] && !sizeof($this->data)) + { + $sql = 'SELECT u.* + FROM ' . USERS_TABLE . ' u, ' . SESSIONS_KEYS_TABLE . ' k + WHERE u.user_id = ' . (int) $this->cookie_data['u'] . ' + AND u.user_type IN (' . USER_NORMAL . ', ' . USER_FOUNDER . ") + AND k.user_id = u.user_id + AND k.key_id = '" . $db->sql_escape(md5($this->cookie_data['k'])) . "'"; + $result = $db->sql_query($sql); + $user_data = $db->sql_fetchrow($result); + + if ($user_id === false || (isset($user_data['user_id']) && $user_id = $user_data['user_id'])) + { + $this->data = $user_data; + $bot = false; + } + + $db->sql_freeresult($result); + } + if ($user_id !== false && !sizeof($this->data)) { $this->cookie_data['k'] = ''; @@ -567,36 +606,6 @@ class session $db->sql_freeresult($result); $bot = false; } - else if (!$bot) - { - $method = 'autologin_' . $method; - if (function_exists($method)) - { - $this->data = $method(); - - if (sizeof($this->data)) - { - $this->cookie_data['k'] = ''; - $this->cookie_data['u'] = $this->data['user_id']; - } - } - - // If we're presented with an autologin key we'll join against it. - // Else if we've been passed a user_id we'll grab data based on that - if (isset($this->cookie_data['k']) && $this->cookie_data['k'] && $this->cookie_data['u'] && !sizeof($this->data)) - { - $sql = 'SELECT u.* - FROM ' . USERS_TABLE . ' u, ' . SESSIONS_KEYS_TABLE . ' k - WHERE u.user_id = ' . (int) $this->cookie_data['u'] . ' - AND u.user_type IN (' . USER_NORMAL . ', ' . USER_FOUNDER . ") - AND k.user_id = u.user_id - AND k.key_id = '" . $db->sql_escape(md5($this->cookie_data['k'])) . "'"; - $result = $db->sql_query($sql); - $this->data = $db->sql_fetchrow($result); - $db->sql_freeresult($result); - $bot = false; - } - } // Bot user, if they have a SID in the Request URI we need to get rid of it // otherwise they'll index this page with the SID, duplicate content oh my! @@ -2459,4 +2468,4 @@ class user extends session } } -?>
\ No newline at end of file +?> |