mirrors/pfsense
2
0
Fork 0
mirror of https://github.com/pfsense/pfsense.git synced 2025-10-26 11:38:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Detect when protocol changes and invalidate session to get a new cookie with secure flag set according. It fixes #3714

Browse Source
This commit is contained in:
Renato Botelho 2014-07-18 14:18:50 -03:00
parent 639567b8f0
commit dd030de935
1 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
etc/inc/auth.inc
View File

@ -1359,6 +1359,10 @@ function session_auth() {
if (!session_id())
session_start();
// Detect protocol change
if (!isset($_POST['login']) && !empty($_SESSION['Logged_In']) && $_SESSION['protocol'] != $config['system']['webgui']['protocol'])
return false;
/* Validate incoming login request */
if (isset($_POST['login']) && !empty($_POST['usernamefld']) && !empty($_POST['passwordfld'])) {
$authcfg = auth_get_authserver($config['system']['webgui']['authmode']);
@ -1369,6 +1373,7 @@ function session_auth() {
$_SESSION['Logged_In'] = "True";
$_SESSION['Username'] = $_POST['usernamefld'];
$_SESSION['last_access'] = time();
$_SESSION['protocol'] = $config['system']['webgui']['protocol'];
if(! isset($config['system']['webgui']['quietlogin'])) {
log_auth(sprintf(gettext("Successful login for user '%1\$s' from: %2\$s"), $_POST['usernamefld'], $_SERVER['REMOTE_ADDR']));
}