Added hook for session handling, fixed bug [0000315]

diff --git a/CHANGELOG.txt b/CHANGELOG.txt
index 0afe9ba386fec0c39ced060bd39beb0116dce0d7..b312c4b2a90e94856e05f7c4c7e49425c4f863da 100644 (file)
--- a/CHANGELOG.txt
+++ b/CHANGELOG.txt
@@ -20,12 +20,17 @@ Legend:
 $ -> Affected files
 
 16-Dec-2010 Janusz Dobrowolski
++ Added hook for session handling, fixed bug [0000315] (session fixation)
+$ /includes/hooks.inc
+  /includes/session.inc
 # Cleanup on add_quick_entry() qid parameter added
 $ /gl/includes/db/gl_db_bank_accounts.inc
 # Could not change quick entry base amount description
 $ /gl/manage/gl_quick_entries.php
 # Fixed error handling
 $ /includes/ui/items_cart.inc
+# Fixed get_gl_trans_from_to return type
+$ /gl/includes/db/gl_db_trans.inc
 
 15-Dec-2010 Janusz Dobrowolski
 + Added Georgian installer wizard translation by Giorgi Natsvlishvili

diff --git a/includes/hooks.inc b/includes/hooks.inc
index c279b4afc4371ded9621aa6548884168a729d8bc..d89c1d3e677c3e30fe7b8f5ad8beffa497ef81a8 100644 (file)
--- a/includes/hooks.inc
+++ b/includes/hooks.inc
@@ -367,3 +367,17 @@ function hook_price_in_words($amount, $document)
 {
        return hook_invoke_last('price_in_words', $amount, $document);
 }
+//
+//     Session handling hook. This is special case of hook class which have to be run before session is started.
+//     If fa_session_manager class is defined in any installed extension, this class provides session handling
+//     for application, otherwise standard php session handling is used.
+//
+function hook_session_start($company)
+{
+       if (class_exists('fa_session_manager')) {
+               global $SessionManager;
+               $SessionManager = new fa_session_manager($company);
+               return $SessionManager->installed;
+       }
+       return false;
+}

diff --git a/includes/session.inc b/includes/session.inc
index f98c97b284d6188c55e940bff51ab84a762a3ac4..2424b57421a2af8036767644be1a1396fd2a3a3f 100644 (file)
--- a/includes/session.inc
+++ b/includes/session.inc
@@ -192,9 +192,12 @@ include_once($path_to_root . "/includes/hooks.inc");
 
 ini_set('session.gc_maxlifetime', 36000); // 10hrs
 
+hook_session_start(@$_POST["company_login_name"]);
+
 session_name('FA'.md5(dirname(__FILE__)));
-//include_once($path_to_root.'/modules/www_statistics/includes/db_sessions.inc');
+
 session_start();
+session_regenerate_id();
 
 // this is to fix the "back-do-you-want-to-refresh" issue - thanx PHPFreaks
 header("Cache-control: private");