Development

Changeset 5325

You must first sign up to be able to contribute.

Changeset 5325

Show
Ignore:
Timestamp:
10/01/07 06:37:47 (1 year ago)
Author:
dwhittle
Message:

dwhittle: added sfSession::regenerate and added calls on authentication/credential change to protect against session fixation attacks

Files:

Legend:

Unmodified
Added
Removed
Modified
Copied
Moved

  • branches/dwhittle/lib/storage/sfNoStorage.class.php

    r4897 r5325  
    44 * This file is part of the symfony package. 
    55 * (c) 2004-2006 Fabien Potencier <fabien.potencier@symfony-project.com> 
    6  *  
     6 * 
    77 * For the full copyright and license information, please view the LICENSE 
    88 * file that was distributed with this source code. 
    …… 
    5757 
    5858  /** 
    59    * Executes the shutdown procedure. 
    60    * 
    61    * @throws <b>sfStorageException</b> If an error occurs while shutting down this storage 
    62    */ 
    63   public function shutdown() 
    64   { 
    65   } 
    66  
    67   /** 
    6859   * Writes data to this storage. 
    6960   * 
    …… 
    7869  { 
    7970  } 
     71 
     72  /** 
     73   * Regenerates id that represents this storage. 
     74   * 
     75   * @param boolean Destroy session when regenerating 
     76   * @return boolean True if session regenerated, false if error 
     77   * 
     78   */ 
     79  public function regenerate($destroy = false) 
     80  { 
     81  } 
     82 
     83  /** 
     84   * Executes the shutdown procedure. 
     85   * 
     86   * @throws <b>sfStorageException</b> If an error occurs while shutting down this storage 
     87   */ 
     88  public function shutdown() 
     89  { 
     90  } 
    8091} 

  • branches/dwhittle/lib/storage/sfSessionStorage.class.php

    r5323 r5325  
    136136 
    137137  /** 
     138   * Regenerates id that represents this storage. 
     139   * 
     140   * @param boolean Destroy session when regenerating? 
     141   * @return boolean True if session regenerated, false if error 
     142   * 
     143   */ 
     144  public function regenerate($destroy = false) 
     145  { 
     146    // regenerate a new session id 
     147    session_regenerate_id($destroy); 
     148  } 
     149 
     150  /** 
    138151   * Executes the shutdown procedure. 
    139152   * 

  • branches/dwhittle/lib/storage/sfSessionTestStorage.class.php

    r4897 r5325  
    133133 
    134134  /** 
     135   * Regenerates id that represents this storage. 
     136   * 
     137   * @param boolean Destroy session when regenerating? 
     138   * @return boolean True if session regenerated, false if error 
     139   * 
     140   */ 
     141  public function regenerate($destroy = false) 
     142  { 
     143    // regenerate a new session id 
     144  } 
     145 
     146  /** 
    135147   * Executes the shutdown procedure. 
    136148   * 

  • branches/dwhittle/lib/storage/sfStorage.class.php

    r5047 r5325  
    55 * (c) 2004-2006 Fabien Potencier <fabien.potencier@symfony-project.com> 
    66 * (c) 2004-2006 Sean Kerr. 
    7  *  
     7 * 
    88 * For the full copyright and license information, please view the LICENSE 
    99 * file that was distributed with this source code. 
    …… 
    6666   */ 
    6767  abstract public function read($key); 
     68 
     69  /** 
     70   * Regenerates id that represents this storage. 
     71   * 
     72   * @param boolean Destroy session when regenerating? 
     73   * 
     74   * @return boolean True if session regenerated, false if error 
     75   * 
     76   * @throws <b>sfStorageException</b> If an error occurs while regenerating this storage 
     77   */ 
     78  abstract public function regenerate($destroy = false); 
    6879 
    6980  /** 

  • branches/dwhittle/lib/user/sfBasicSecurityUser.class.php

    r5164 r5325  
    55 * (c) 2004-2006 Fabien Potencier <fabien.potencier@symfony-project.com> 
    66 * (c) 2004-2006 Sean Kerr. 
    7  *  
     7 * 
    88 * For the full copyright and license information, please view the LICENSE 
    99 * file that was distributed with this source code. 
    …… 
    5454   * 
    5555   * @param  mixed credential 
    56    */   
     56   */ 
    5757  public function removeCredential($credential) 
    5858  { 
    …… 
    7272        } 
    7373      } 
    74     } 
    75   }   
     74      $this->storage->regenerate(false); 
     75    } 
     76  } 
    7677 
    7778  /** 
    …… 
    109110      } 
    110111    } 
    111   } 
    112  
    113    
     112    $this->storage->regenerate(false); 
     113  } 
     114 
     115 
    114116  /** 
    115117   * Returns true if user has credential. 
    …… 
    186188      $this->clearCredentials(); 
    187189    } 
     190 
     191    $this->storage->regenerate(false); 
    188192  } 
    189193