From 095f04d578145963bf5fd986ea780cdf3001e130 Mon Sep 17 00:00:00 2001 From: John Reese Date: Mon, 27 Oct 2008 15:49:42 -0400 Subject: [PATCH] Fix #9744: Properly handle sessions for proxied users. Add User-Agent checks when validating sessions. --- mantisbt/core/constant_inc.php | 5 +++++ mantisbt/core/session_api.php | 30 ++++++++++++++++++++++++++---- 2 files changed, 31 insertions(+), 4 deletions(-) diff --git a/mantisbt/core/constant_inc.php b/mantisbt/core/constant_inc.php index 7e8444a..e24b856 100644 --- a/mantisbt/core/constant_inc.php +++ b/mantisbt/core/constant_inc.php @@ -142,6 +142,11 @@ define( 'ALL_USERS', 0 ); # no user define( 'NO_USER', 0 ); +# session constants +define( 'SESSION_NEW', 0 ); +define( 'SESSION_DIRECT', 1 ); +define( 'SESSION_PROXIED', 2 ); + # history constants define( 'NORMAL_TYPE', 0 ); define( 'NEW_BUG', 1 ); diff --git a/mantisbt/core/session_api.php b/mantisbt/core/session_api.php index 7049b21..bef2124 100644 --- a/mantisbt/core/session_api.php +++ b/mantisbt/core/session_api.php @@ -136,18 +136,40 @@ function session_init( $p_session_id=null ) { * @param object Session object */ function session_validate( $p_session ) { + $t_last_type = $p_session->get( 'session_type', SESSION_NEW ); + $t_last_ip = $p_session->get( 'session_ip', '' ); + $t_last_agent = $p_session->get( 'session_agent', '' ); + + $t_user_type = SESSION_DIRECT; $t_user_ip = ''; - if ( isset( $_SERVER['REMOTE_ADDR'] ) ) { + if ( isset( $_SERVER['HTTP_X_FORWARDED_FOR'] ) ) { + $t_user_type = SESSION_PROXIED; + $t_user_ip = trim( $_SERVER['HTTP_X_FORWARDED_FOR'] ); + + } else if ( isset( $_SERVER['HTTP_CLIENT_IP'] ) ) { + $t_user_type = SESSION_PROXIED; + $t_user_ip = trim( $_SERVER['HTTP_CLIENT_IP'] ); + + } else if ( isset( $_SERVER['REMOTE_ADDR'] ) ) { + $t_user_type = SESSION_DIRECT; $t_user_ip = trim( $_SERVER['REMOTE_ADDR'] ); } - if ( is_null( $t_last_ip = $p_session->get( 'last_ip', null ) ) ) { + $t_user_agent = $_SERVER['HTTP_USER_AGENT']; + + if ( SESSION_NEW == $t_last_type ) { # First session usage - $p_session->set( 'last_ip', $t_user_ip ); + $p_session->set( 'session_type', $t_user_type ); + $p_session->set( 'session_ip', $t_user_ip ); + $p_session->set( 'session_agent', $t_user_agent ); } else { # Check a continued session request - if ( $t_user_ip != $t_last_ip ) { + + if ( $t_last_type != $t_user_type || + $t_last_ip != $t_user_ip || + $t_last_agent != $t_user_agent ) { + session_clean(); trigger_error( ERROR_SESSION_NOT_VALID, WARNING ); -- 1.6.0.2