fix session write handler always assuming that database entry exists and failing...

[tt-rss.git] / include / functions.php

diff --git a/include/functions.php b/include/functions.php
index be0d4e262151ebdec9b005844ed7ab6ac3e90a8c..b290898329a2a0d157455b317d61174d5c47a833 100755 (executable)
--- a/include/functions.php
+++ b/include/functions.php
@@ -700,22 +700,26 @@
 
                if (!SINGLE_USER_MODE) {
                        $user_id = false;
+                       $auth_module = false;
 
                        foreach (PluginHost::getInstance()->get_hooks(PluginHost::HOOK_AUTH_USER) as $plugin) {
 
                                $user_id = (int) $plugin->authenticate($login, $password);
 
                                if ($user_id) {
-                                       $_SESSION["auth_module"] = strtolower(get_class($plugin));
+                                       $auth_module = strtolower(get_class($plugin));
                                        break;
                                }
                        }
 
                        if ($user_id && !$check_only) {
-                               @session_start();
+
+                               session_start();
+                               session_regenerate_id(true);
 
                                $_SESSION["uid"] = $user_id;
                                $_SESSION["version"] = VERSION_STATIC;
+                               $_SESSION["auth_module"] = $auth_module;
 
                                $pdo = DB::pdo();
                                $sth = $pdo->prepare("SELECT login,access_level,pwd_hash FROM ttrss_users
@@ -811,10 +815,11 @@
        }
 
        function logout_user() {
-               session_destroy();
+               @session_destroy();
                if (isset($_COOKIE[session_name()])) {
                   setcookie(session_name(), '', time()-42000, '/');
                }
+               session_commit();
        }
 
        function validate_csrf($csrf_token) {
@@ -856,8 +861,7 @@
                                }
 
                                if (!$_SESSION["uid"]) {
-                                       @session_destroy();
-                                       setcookie(session_name(), '', time()-42000, '/');
+                                       logout_user();
 
                                        render_login_form();
                                        exit;