aboutsummaryrefslogtreecommitdiffstats
path: root/include
diff options
context:
space:
mode:
authornikrou <nikrou@piwigo.org>2010-07-05 19:34:15 +0000
committernikrou <nikrou@piwigo.org>2010-07-05 19:34:15 +0000
commitc1414297fb6ad08befb44bc78fc62e00e19ba8d5 (patch)
tree1daf84aa07abce4e1511d196f5ed92e03a3c9e19 /include
parent8fa8880122707f8ebfffddc56535b54ac1d2f26f (diff)
Bug 1760 fixed : Avoid session fixation
After connection, session id is changed using session_regenerate_id but without removing old session. Passing param true makes the job. git-svn-id: http://piwigo.org/svn/trunk@6660 68402e56-0260-453c-a942-63ccdbb3a9ee
Diffstat (limited to '')
-rw-r--r--include/functions_user.inc.php2
1 files changed, 1 insertions, 1 deletions
diff --git a/include/functions_user.inc.php b/include/functions_user.inc.php
index 6eb733bce..090c2e701 100644
--- a/include/functions_user.inc.php
+++ b/include/functions_user.inc.php
@@ -1100,7 +1100,7 @@ function log_user($user_id, $remember_me)
if ( session_id()!="" )
{ // we regenerate the session for security reasons
// see http://www.acros.si/papers/session_fixation.pdf
- session_regenerate_id();
+ session_regenerate_id(true);
}
else
{