nsinnovations/fusionpbx
2
0
Fork 0
mirror of https://github.com/fusionpbx/fusionpbx.git synced 2025-12-30 00:53:50 +00:00
Code Issues Packages Projects Releases Wiki Activity

Security - Update session validation and regenerate session id on login

Browse Source
This commit is contained in:
FusionPBX
2024-01-23 23:11:28 -07:00
committed by GitHub
parent cfbfd8ab52
commit 560a51cff7
2 changed files with 26 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
resources/check_auth.php
View File

@@ -75,8 +75,18 @@
$_SESSION['authorized'] = false;
}
//validate the session address
if ($_SESSION['authorized'] && $_SESSION["user_hash"] !== hash('sha256', $_SERVER['REMOTE_ADDR'].$_SERVER['HTTP_USER_AGENT'])) {
//session validate: use HTTP_USER_AGENT as a default value
if (!isset($conf['session.validate'])) {
$conf['session.validate'][] = 'HTTP_USER_AGENT';
}
//session validate: prepare the server array
foreach($conf['session.validate'] as $name) {
$server_array[$name] = $_SERVER[$name];
}
//session validate: check to see if the session is valid
if ($_SESSION['authorized'] && $_SESSION["user_hash"] !== hash('sha256', implode($server_array))) {
session_destroy();
header("Location: ".PROJECT_PATH."/logout.php");
}