]> git.wh0rd.org - tt-rss.git/blobdiff - include/sessions.php
if empty session is autostarted because of a cookie, immediately destroy it
[tt-rss.git] / include / sessions.php
index c80c21de3a24cc6314f4fe8164c0313363f29cfb..2d17bfd8e388363edef677662e8ac4db944649f2 100644 (file)
         $pdo = Db::pdo();
 
                if ($_SESSION["uid"]) {
+
+                       if (!defined('_SKIP_SESSION_ADDRESS_CHECKS') || !_SKIP_SESSION_ADDRESS_CHECKS) {
+                               if ($_SESSION["ip_address"] != $_SERVER["REMOTE_ADDR"]) {
+                                       $_SESSION["login_error_msg"] = __("Session failed to validate.");
+                                       return false;
+                               }
+                       }
+
+                       if ($_SESSION["user_agent"] != sha1($_SERVER['HTTP_USER_AGENT'])) {
+                               $_SESSION["login_error_msg"] = __("Session failed to validate.");
+                               return false;
+                       }
+
                        $sth = $pdo->prepare("SELECT pwd_hash FROM ttrss_users WHERE id = ?");
                        $sth->execute([$_SESSION['uid']]);
 
        if (!defined('NO_SESSION_AUTOSTART')) {
                if (isset($_COOKIE[session_name()])) {
                        @session_start();
+
+                       if (!$_SESSION['uid']) {
+                               logout_user();
+                       }
                }
        }