AS1024/Kanboard-Prod
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Improve session handler and add Ajax session check

Browse Source
This commit is contained in:
Frédéric Guillot
2014-11-29 17:18:23 -05:00
parent 7d36747de6
commit e72327d4b1
10 changed files with 68 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
app/Core/Session.php
View File

@@ -36,14 +36,9 @@ class Session
*
* @access public
* @param string $base_path Cookie path
* @param string $save_path Custom session save path
*/
public function open($base_path = '/', $save_path = '')
public function open($base_path = '/')
{
if ($save_path !== '') {
session_save_path($save_path);
}
// HttpOnly and secure flags for session cookie
session_set_cookie_params(
self::SESSION_LIFETIME,
@@ -56,12 +51,15 @@ class Session
// Avoid session id in the URL
ini_set('session.use_only_cookies', '1');
// Enable strict mode
ini_set('session.use_strict_mode', '1');
// Ensure session ID integrity
ini_set('session.entropy_file', '/dev/urandom');
ini_set('session.entropy_length', '32');
ini_set('session.hash_bits_per_character', 6);
// If session was autostarted with session.auto_start = 1 in php.ini destroy it, otherwise we cannot login
// If session was autostarted with session.auto_start = 1 in php.ini destroy it
if (isset($_SESSION)) {
session_destroy();
}