diff options
| author | Nils Adermann <naderman@naderman.de> | 2014-10-20 14:53:38 -0400 |
|---|---|---|
| committer | Nils Adermann <naderman@naderman.de> | 2014-10-20 14:53:38 -0400 |
| commit | 99f63f39eb8e9987669cb0c7146afc431aee1400 (patch) | |
| tree | 7066474b369d4cdc5e09d6a13101cf5284074f34 /phpBB/phpbb/session.php | |
| parent | 57a575b5f0e3ddd6f42ed7ee225da407044e19bc (diff) | |
| parent | d4faeb064bf7a3e97e1258d40343e83c80308024 (diff) | |
| download | forums-99f63f39eb8e9987669cb0c7146afc431aee1400.tar forums-99f63f39eb8e9987669cb0c7146afc431aee1400.tar.gz forums-99f63f39eb8e9987669cb0c7146afc431aee1400.tar.bz2 forums-99f63f39eb8e9987669cb0c7146afc431aee1400.tar.xz forums-99f63f39eb8e9987669cb0c7146afc431aee1400.zip | |
Merge branch 'develop-olympus' into develop-ascraeus
* develop-olympus:
[ticket/13138] Do not use cookie data and autologin while forcing a user_id
Conflicts:
phpBB/phpbb/session.php
Diffstat (limited to 'phpBB/phpbb/session.php')
| -rw-r--r-- | phpBB/phpbb/session.php | 55 |
1 files changed, 29 insertions, 26 deletions
diff --git a/phpBB/phpbb/session.php b/phpBB/phpbb/session.php index da8b848fa5..234842b550 100644 --- a/phpBB/phpbb/session.php +++ b/phpBB/phpbb/session.php @@ -577,32 +577,7 @@ class session } } - $provider_collection = $phpbb_container->get('auth.provider_collection'); - $provider = $provider_collection->get_provider(); - $this->data = $provider->autologin(); - - if (sizeof($this->data)) - { - $this->cookie_data['k'] = ''; - $this->cookie_data['u'] = $this->data['user_id']; - } - - // If we're presented with an autologin key we'll join against it. - // Else if we've been passed a user_id we'll grab data based on that - if (isset($this->cookie_data['k']) && $this->cookie_data['k'] && $this->cookie_data['u'] && !sizeof($this->data)) - { - $sql = 'SELECT u.* - FROM ' . USERS_TABLE . ' u, ' . SESSIONS_KEYS_TABLE . ' k - WHERE u.user_id = ' . (int) $this->cookie_data['u'] . ' - AND u.user_type IN (' . USER_NORMAL . ', ' . USER_FOUNDER . ") - AND k.user_id = u.user_id - AND k.key_id = '" . $db->sql_escape(md5($this->cookie_data['k'])) . "'"; - $result = $db->sql_query($sql); - $this->data = $db->sql_fetchrow($result); - $db->sql_freeresult($result); - $bot = false; - } - else if ($user_id !== false && !sizeof($this->data)) + if ($user_id !== false && !sizeof($this->data)) { $this->cookie_data['k'] = ''; $this->cookie_data['u'] = $user_id; @@ -616,6 +591,34 @@ class session $db->sql_freeresult($result); $bot = false; } + else if (!$bot) + { + $provider_collection = $phpbb_container->get('auth.provider_collection'); + $provider = $provider_collection->get_provider(); + $this->data = $provider->autologin(); + + if (sizeof($this->data)) + { + $this->cookie_data['k'] = ''; + $this->cookie_data['u'] = $this->data['user_id']; + } + + // If we're presented with an autologin key we'll join against it. + // Else if we've been passed a user_id we'll grab data based on that + if (isset($this->cookie_data['k']) && $this->cookie_data['k'] && $this->cookie_data['u'] && !sizeof($this->data)) + { + $sql = 'SELECT u.* + FROM ' . USERS_TABLE . ' u, ' . SESSIONS_KEYS_TABLE . ' k + WHERE u.user_id = ' . (int) $this->cookie_data['u'] . ' + AND u.user_type IN (' . USER_NORMAL . ', ' . USER_FOUNDER . ") + AND k.user_id = u.user_id + AND k.key_id = '" . $db->sql_escape(md5($this->cookie_data['k'])) . "'"; + $result = $db->sql_query($sql); + $this->data = $db->sql_fetchrow($result); + $db->sql_freeresult($result); + $bot = false; + } + } // Bot user, if they have a SID in the Request URI we need to get rid of it // otherwise they'll index this page with the SID, duplicate content oh my! |