Changeset 6134 in subversion

Timestamp:

Apr 30, 2012 5:04:53 PM (14 months ago)

Author:

thomasb

Message:

Accept two past time slots for auth cookie validation; don't encode user-agent into session auth hash (#1488449)

Location:

trunk/roundcubemail/program/include

Files:

• rcube.php (modified) (1 diff)
• rcube_session.php (modified) (3 diffs)

trunk/roundcubemail/program/include/rcube.php

@@ -477 +477 @@
         }
 
-        $this->session->set_secret($this->config->get('des_key') . $_SERVER['HTTP_USER_AGENT']);
+        $this->session->set_secret($this->config->get('des_key') . dirname($_SERVER['SCRIPT_NAME']));
         $this->session->set_ip_check($this->config->get('ip_check'));
     }

trunk/roundcubemail/program/include/rcube_session.php

@@ -44 +44 @@
   private $key;
   private $now;
-  private $prev;
   private $secret = '';
   private $ip_check = false;
@@ -520 +519 @@
       $now = time();
       $this->now = $now - ($now % ($this->lifetime / 2));
-      $this->prev = $this->now - ($this->lifetime / 2);
   }
 
@@ -591 +589 @@
 
     if ($result && $this->_mkcookie($this->now) != $this->cookie) {
-      // Check if using id from previous time slot
-      if ($this->_mkcookie($this->prev) == $this->cookie) {
-        $this->set_auth_cookie();
-      }
-      else {
-        $result = false;
-        $this->log("Session authentication failed for " . $this->key . "; invalid auth cookie sent");
-      }
-    }
+      $this->log("Session auth check failed for " . $this->key . "; timeslot = " . date('Y-m-d H:i:s', $this->now));
+      $result = false;
+
+      // Check if using id from a previous time slot
+      for ($i = 1; $i <= 2; $i++) {
+        $prev = $this->now - ($this->lifetime / 2) * $i;
+        if ($this->_mkcookie($prev) == $this->cookie) {
+          $this->log("Send new auth cookie for " . $this->key . ": " . $this->cookie);
+          $this->set_auth_cookie();
+          $result = true;
+        }
+      }
+        }
+
+    if (!$result)
+      $this->log("Session authentication failed for " . $this->key . "; invalid auth cookie sent; timeslot = " . date('Y-m-d H:i:s', $prev));
 
     return $result;