Changeset 3018 for branches/2.2/header.session.inc.php

Timestamp:

07/08/10 17:52:20 (14 years ago)

Author:

amuller

Message:

Ticket #1135 - Aplicando alterações do branches 2.0 no branches 2.2

File:

• branches/2.2/header.session.inc.php (modified) (1 diff)

branches/2.2/header.session.inc.php

@@ -1 +1 @@
 <?php
-        session_id( $_COOKIE[ 'sessionid' ] );
-        session_start( );
+if ( isset( $_COOKIE[ 'sessionid' ] ) ) 
+        session_id( $_COOKIE[ 'sessionid' ] ); 
 
-        $sess = $_SESSION[ 'phpgw_session' ];
-        $connection_id = "{$sess['session_id']}{$sess['session_ip']}".substr($_SERVER[ 'HTTP_USER_AGENT' ],0,199);
+session_start( );
 
+$sess = $_SESSION[ 'phpgw_session' ];
+$invalidSession = false; 
+$user_agent = array(); 
+if (isset($GLOBALS['phpgw']) && !isset($_SESSION['connection_db_info'])){ 
+        $_SESSION['phpgw_info']['admin']['server']['sessions_checkip'] = $GLOBALS['phpgw_info']['server']['sessions_checkip'];
+        if($GLOBALS['phpgw_info']['server']['use_https'] == 1) { 
+                $new_ip = (isset($_SERVER['HTTP_X_FORWARDED_FOR']) ? $_SERVER['HTTP_X_FORWARDED_FOR']."," : ""). $_SERVER['REMOTE_ADDR']; 
+                $GLOBALS['phpgw']->db->query("UPDATE phpgw_access_log SET ip='$new_ip' WHERE account_id <> 0 and lo = 0 and sessionid='{$GLOBALS['sessionid']}'",__LINE__,__FILE__); 
+        } 
+         $GLOBALS['phpgw']->db->query("select trim(sessionid),".($_SESSION['phpgw_info']['admin']['server']['sessions_checkip'] ? "ip," : "")."browser from phpgw_access_log where account_id <> 0 and lo = 0 and sessionid='{$GLOBALS['sessionid']}' limit 1",__LINE__,__FILE__); 
+        $GLOBALS['phpgw']->db->next_record(); 
+        if($GLOBALS['phpgw']->db->row( )) 
+                $_SESSION['connection_db_info']['user_auth'] = implode("",$GLOBALS['phpgw']->db->row( )); 
+} 
+if($_SESSION['connection_db_info']['user_auth']){ 
+        $invalidSession = true; 
+        $http_user_agent = substr($_SERVER[ 'HTTP_USER_AGENT' ],0,199); 
+        $user_ip = isset($_SERVER['HTTP_X_FORWARDED_FOR']) ? array($_SERVER['REMOTE_ADDR'], $_SERVER['HTTP_X_FORWARDED_FOR']) : array($_SERVER['REMOTE_ADDR']); 
+        $user_agent[] = ($_SESSION['phpgw_info']['admin']['server']['sessions_checkip'] ? "{$sess['session_id']}{$user_ip[0]}" : "{$sess['session_id']}").$http_user_agent;
+        if(count($user_ip) == 2) { 
+                $user_agent[] = "{$sess['session_id']}{$user_ip[1]}".$http_user_agent; 
+                $user_agent[] = $sess['session_id'].implode(",",array_reverse($user_ip)).$http_user_agent; 
+        } 
+        $pconnection_id = $_SESSION['connection_db_info']['user_auth']; 
+        if(array_search($pconnection_id, $user_agent)  !== FALSE) { 
+                $invalidSession = false; 
+        } 
+} 
+if (empty($_SESSION['phpgw_session']['session_id']) || $invalidSession) 
+{
+        if($_SESSION['connection_db_info']['user_auth'] && !strstr($_SERVER['SCRIPT_URL'],"/controller.php")) {
+                error_log( '[ INVALID SESSION ] >>>>' .$_SESSION['connection_db_info']['user_auth'].'<<<< - >>>>' . implode("",$user_agent), 0 ); 
+                $GLOBALS['phpgw']->session->phpgw_setcookie('sessionid'); 
+                $GLOBALS['phpgw']->redirect($GLOBALS['phpgw_info']['server']['webserver_url'].'/login.php?cd=10'); 
+        } 
 
-        if ($_SESSION['connection_db_info']['user_auth'] && implode('',$_SESSION['connection_db_info']['user_auth']) !== $connection_id)
-        {
-                setcookie("PHPSESSID","",0);
-                setcookie ("sessionid","",0);
-                echo lang("An important error has occured with your login, please contact your system administrator");  
-                exit;
-        }
+        setcookie(session_name(),"",0); // Removing session cookie. 
+        unset($_SESSION);                               // Removing session values. 
+        // From ExpressoAjax response "nosession" 
+        if(strstr($_SERVER['SCRIPT_URL'],"/controller.php")){ 
+                echo serialize(array("nosession" => true)); 
+                exit; 
+        } 
+} 
+else{ 
+        // From ExpressoAjax update session_dla (datetime last access).  
+        if(strstr($_SERVER['SCRIPT_URL'],"/controller.php")) 
+                $_SESSION['phpgw_session']['session_dla'] = time(); 
+
+}
 ?>