mirrors/pfsense
2
0
Fork 0
mirror of https://github.com/pfsense/pfsense.git synced 2025-10-26 11:38:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Re-generate session ID on a successful login to avoid session fixation

Browse Source
This commit is contained in:
Renato Botelho 2014-06-17 14:26:50 -03:00
parent 62480a449e
commit ff9b30ec40
1 changed files with 1 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
etc/inc/auth.inc
View File

@ -1361,6 +1361,7 @@ function session_auth() {
$authcfg = auth_get_authserver($config['system']['webgui']['authmode']);
if (authenticate_user($_POST['usernamefld'], $_POST['passwordfld'], $authcfg) ||
authenticate_user($_POST['usernamefld'], $_POST['passwordfld'])) {
session_regenerate_id();
$_SESSION['Logged_In'] = "True";
$_SESSION['Username'] = $_POST['usernamefld'];
$_SESSION['last_access'] = time();