Bug #3269

session_regenerate_id() is run on every page request when regenid is true

Details

Submitted	2005-01-22 13:33 UTC
From	roehr at zilleon dot com
Assigned	lsmith
Status	Closed
Package	LiveUser
PHP Version	Irrelevant
OS	irrelevent
Roadmaps	(Not assigned)

Comments

[2005-01-22 13:33 UTC] roehr at zilleon dot com

Description:
------------
Hi,

while refacturing the init() method for the 0.14.0 release a severe bug has been introduced:

When the option "regenid" is set to true LiveUser will call session_regenerate_id() on *each* page request thereby generating a new session id every time!

This creates multiple entries in the session container and only deletes the last one on logout. So multiple entries with valid session ids are still hanging around in the session container and the session is not destroyed correctly.

Reproduce code:
---------------
LiveUser.php, lines 924-929:

// Return boolean that indicates whether a auth object has been created
// or retrieved from session
if ($this->isLoggedIn()) {
if ($this->_options['login']['regenid']) {
session_regenerate_id();
}

As the comment says this code is run whenever a user has been authenticated. But session_regenerate_id() should only be run after the FIRST login.

Unfortunately, I haven't found an obvious way to determine when a login is being processed for the first time and therefore cannot supply a patch.

Please fix this as soon as possible - otherwise the regenid option is causing severe problems.

Thanks and best regards,
Torsten Roehr

[2005-01-23 20:30 UTC] smith at backendmedia dot com

Well I was under the impression that this was the actual intention? The session container should be able to handle that afaik. Obviously this is going to break things for people surfing on the site with multiple browser windows.

Anyways the solution is to either leave this kind of stuff to the observers or have LiveUser default to the bahaviour requested by Tobias. Personally I have disabled the regen id for the same reasons was Tobias mentions in the bug report. So I am +1 on changing things to only regen the session id on login.

[2005-01-23 20:35 UTC] smith at backendmedia dot com

*blush*

s/Tobias/Torsten

[2005-01-25 10:27 UTC] smith at backendmedia dot com

This bug has been fixed in CVS.

In case this was a documentation problem, the fix will show up at the
end of next Sunday (CET) on pear.php.net.

In case this was a pear.php.net website problem, the change will show
up on the website in short time.

Thank you for the report, and for helping us make PEAR better.