+define('VARLIB_PATH', $path_to_root.'/tmp');
+define('VARLOG_PATH', $path_to_root.'/tmp');
+
+class SessionManager
+{
+ function sessionStart($name, $limit = 0, $path = '/', $domain = null, $secure = null)
+ {
+ // Set the cookie name
+ session_name($name);
+
+ // Set SSL level
+ $https = isset($secure) ? $secure : (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off');
+
+ // Set session cookie options
+ if (version_compare(PHP_VERSION, '5.2', '<')) // avoid failure on older php versions
+ session_set_cookie_params($limit, $path, $domain, $https);
+ else
+ session_set_cookie_params($limit, $path, $domain, $https, true);
+
+ session_start();
+
+ // Make sure the session hasn't expired, and destroy it if it has
+ if ($this->validateSession())
+ {
+ // Check to see if the session is new or a hijacking attempt
+ if(!$this->preventHijacking())
+ {
+ // Reset session data and regenerate id
+ $_SESSION = array();
+ $_SESSION['IPaddress'] = $_SERVER['REMOTE_ADDR'];
+ $_SESSION['userAgent'] = @$_SERVER['HTTP_USER_AGENT'];
+ $this->regenerateSession();
+
+ // Give a 5% chance of the session id changing on any request
+ }
+ elseif (rand(1, 100) <= 5)
+ {
+ $this->regenerateSession();
+ }
+ }
+ else
+ {
+ $_SESSION = array();
+ session_destroy();
+ session_start();
+ }
+ }
+
+ function preventHijacking()
+ {
+ if (!isset($_SESSION['IPaddress']) || !isset($_SESSION['userAgent']))
+ return false;
+
+ if ($_SESSION['IPaddress'] != $_SERVER['REMOTE_ADDR'])
+ return false;
+
+ if ( $_SESSION['userAgent'] != @$_SERVER['HTTP_USER_AGENT'])
+ return false;
+
+ return true;
+ }
+
+ function regenerateSession()
+ {
+ // If this session is obsolete it means there already is a new id
+ if (isset($_SESSION['OBSOLETE']) && ($_SESSION['OBSOLETE'] == true))
+ return;
+
+ // Set current session to expire in 10 seconds
+ $_SESSION['OBSOLETE'] = true;
+ $_SESSION['EXPIRES'] = time() + 10;
+
+ // Create new session without destroying the old one
+ session_regenerate_id();
+ // Grab current session ID and close both sessions to allow other scripts to use them
+ $newSession = session_id();
+ session_write_close();
+ // Set session ID to the new one, and start it back up again
+
+ session_id($newSession);
+ session_start();
+
+ // Now we unset the obsolete and expiration values for the session we want to keep
+ unset($_SESSION['OBSOLETE']);
+ unset($_SESSION['EXPIRES']);
+ }
+
+ function validateSession()
+ {
+ if (isset($_SESSION['OBSOLETE']) && !isset($_SESSION['EXPIRES']) )
+ return false;
+
+ if (isset($_SESSION['EXPIRES']) && $_SESSION['EXPIRES'] < time())
+ return false;
+
+ return true;
+ }
+}
+