phpfreechat-svn

[Phpfreechat-svn] SF.net SVN: phpfreechat:[1244] trunk/src/pfcuserconfig.class.php

[<ke...@us...>]

Revision: 1244
          http://phpfreechat.svn.sourceforge.net/phpfreechat/?rev=1244&view=rev
Author:   kerphi
Date:     2008-07-30 07:32:57 +0000 (Wed, 30 Jul 2008)

Log Message:
-----------
This revision fixes a big security hole. The nickid is a public identifier shared between all the chatters. Before this patch, the nickid was equal to the session_id without any shadow. Now the sessionid is blured. (Many thanks to DrNathan for the report)

Modified Paths:
--------------
    trunk/src/pfcuserconfig.class.php

Modified: trunk/src/pfcuserconfig.class.php
===================================================================
--- trunk/src/pfcuserconfig.class.php	2008-07-29 14:10:33 UTC (rev 1243)
+++ trunk/src/pfcuserconfig.class.php	2008-07-30 07:32:57 UTC (rev 1244)
@@ -23,10 +23,10 @@
     // start the session : session is used for locking purpose and cache purpose
     session_name( "phpfreechat" );
     if(session_id() == "") session_start();
-    
-    //    echo "pfcUserConfig()<br>";
 
-    $this->nickid = session_id();
+    // the nickid is a public identifier shared between all the chatters
+    // this is why the session_id must not be assigned directly to the nickid
+    $this->nickid = sha1(session_id());
 
     // user parameters are cached in sessions
     $this->_getParam("nick");


This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site.

[Phpfreechat-svn] SF.net SVN: phpfreechat:[1257] trunk/src/pfcuserconfig.class.php

[<ke...@us...>]

Revision: 1257
          http://phpfreechat.svn.sourceforge.net/phpfreechat/?rev=1257&view=rev
Author:   kerphi
Date:     2008-12-02 08:35:22 +0000 (Tue, 02 Dec 2008)

Log Message:
-----------
Remove the specific session_name value. From now phpfreechat totaly share the sessions data with the whole website. This should simplify integrations. (thanks to Ivan Kravets aka x-man for the suggestion)

Modified Paths:
--------------
    trunk/src/pfcuserconfig.class.php

Modified: trunk/src/pfcuserconfig.class.php
===================================================================
--- trunk/src/pfcuserconfig.class.php	2008-12-01 17:16:29 UTC (rev 1256)
+++ trunk/src/pfcuserconfig.class.php	2008-12-02 08:35:22 UTC (rev 1257)
@@ -21,7 +21,6 @@
     $c =& pfcGlobalConfig::Instance();
 
     // start the session : session is used for locking purpose and cache purpose
-    session_name( "phpfreechat" );
     if(session_id() == "") session_start();
 
     // the nickid is a public identifier shared between all the chatters


This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site.

[Phpfreechat-svn] SF.net SVN: phpfreechat:[1258] trunk/src/pfcuserconfig.class.php

[<ke...@us...>]

Revision: 1258
          http://phpfreechat.svn.sourceforge.net/phpfreechat/?rev=1258&view=rev
Author:   kerphi
Date:     2009-01-01 18:03:30 +0000 (Thu, 01 Jan 2009)

Log Message:
-----------
Few fixes about the user's sessions variables (thanks to Dany Eudes for the suggestions)

Modified Paths:
--------------
    trunk/src/pfcuserconfig.class.php

Modified: trunk/src/pfcuserconfig.class.php
===================================================================
--- trunk/src/pfcuserconfig.class.php	2008-12-02 08:35:22 UTC (rev 1257)
+++ trunk/src/pfcuserconfig.class.php	2009-01-01 18:03:30 UTC (rev 1258)
@@ -37,7 +37,7 @@
     $this->_getParam("privmsg");
     if (!isset($this->privmsg)) $this->_setParam("privmsg",array());
     $this->_getParam("serverid");
-    if (!isset($this->privmsg)) $this->_setParam("serverid",$c->serverid);
+    if (!isset($this->serverid)) $this->_setParam("serverid",$c->serverid);
   }
 
   function &Instance()
@@ -56,7 +56,7 @@
     if (!isset($this->$p))
     {
       $c =& pfcGlobalConfig::Instance();
-      $nickid       = "pfcuserconfig_".$c->getId();
+      $nickid       = 'pfcuserconfig_'.$c->getId().'_'.$this->nickid;
       $nickid_param = $nickid."_".$p;
       if (isset($_SESSION[$nickid_param]))
         $this->$p = $_SESSION[$nickid_param];
@@ -67,7 +67,7 @@
   function _setParam($p, $v)
   {
     $c =& pfcGlobalConfig::Instance();
-    $nickid_param = "pfcuserconfig_".$c->getId()."_".$p;
+    $nickid_param = 'pfcuserconfig_'.$c->getId().'_'.$this->nickid.'_'.$p;
     $_SESSION[$nickid_param] = $v;
     $this->$p = $v;
   }
@@ -75,7 +75,7 @@
   function _rmParam($p)
   {
     $c =& pfcGlobalConfig::Instance();
-    $nickid_param = "pfcuserconfig_".$c->getId()."_".$p;    
+    $nickid_param = 'pfcuserconfig_'.$c->getId().'_'.$this->nickid.'_'.$p;    
     unset($_SESSION[$nickid_param]);
     unset($this->$p);
     if ($p == 'active') $this->active = false;


This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site.