diff options
| author | Marc Alexander <admin@m-a-styles.de> | 2014-10-22 16:18:52 -0500 |
|---|---|---|
| committer | Marc Alexander <admin@m-a-styles.de> | 2014-10-22 16:21:16 -0500 |
| commit | f796f920589a88b6572a04057bbb039f98196032 (patch) | |
| tree | 5e46d6d74dc353e3d251bd1fcca903c9741cf7ba /phpBB/includes/ucp/ucp_profile.php | |
| parent | fad280f94b97799cf12a636b65f7f2288e8b3640 (diff) | |
| download | forums-f796f920589a88b6572a04057bbb039f98196032.tar forums-f796f920589a88b6572a04057bbb039f98196032.tar.gz forums-f796f920589a88b6572a04057bbb039f98196032.tar.bz2 forums-f796f920589a88b6572a04057bbb039f98196032.tar.xz forums-f796f920589a88b6572a04057bbb039f98196032.zip | |
[ticket/security-159] Only show first 8 characters of login keys in UCP
SECURITY-159
Diffstat (limited to 'phpBB/includes/ucp/ucp_profile.php')
| -rw-r--r-- | phpBB/includes/ucp/ucp_profile.php | 9 |
1 files changed, 7 insertions, 2 deletions
diff --git a/phpBB/includes/ucp/ucp_profile.php b/phpBB/includes/ucp/ucp_profile.php index 361dc831aa..a876d0133a 100644 --- a/phpBB/includes/ucp/ucp_profile.php +++ b/phpBB/includes/ucp/ucp_profile.php @@ -655,9 +655,14 @@ class ucp_profile { if (!empty($keys)) { + foreach ($keys as $key => $id) + { + $keys[$key] = $db->sql_like_expression($id . $db->get_any_char()); + } + $sql_where = '(key_id ' . implode(' OR key_id ', $keys) . ')'; $sql = 'DELETE FROM ' . SESSIONS_KEYS_TABLE . ' WHERE user_id = ' . (int) $user->data['user_id'] . ' - AND ' . $db->sql_in_set('key_id', $keys) ; + AND ' . $sql_where ; $db->sql_query($sql); @@ -681,7 +686,7 @@ class ucp_profile while ($row = $db->sql_fetchrow($result)) { $template->assign_block_vars('sessions', array( - 'KEY' => $row['key_id'], + 'KEY' => substr($row['key_id'], 0, 8), 'IP' => $row['last_ip'], 'LOGIN_TIME' => $user->format_date($row['last_login']), )); |