diff options
| author | Dries Buytaert <dries@buytaert.net> | 2008-11-24 06:12:46 +0000 |
|---|---|---|
| committer | Dries Buytaert <dries@buytaert.net> | 2008-11-24 06:12:46 +0000 |
| commit | 96dc47665ef84588874200aec2a5a61e4b93e19f (patch) | |
| tree | 55a44d3fd694e53e4eb4b79798eb30210fa89d6a /modules/user/user.module | |
| parent | bd9554952c02b4ea70103a87d3b7ef51af29f9d4 (diff) | |
| download | brdo-96dc47665ef84588874200aec2a5a61e4b93e19f.tar.gz brdo-96dc47665ef84588874200aec2a5a61e4b93e19f.tar.bz2 | |
- Patch #280934 by pwolanin, swentel, et al: harden session regeneration. It took a while, but it comes with tests and extra features now.
Diffstat (limited to 'modules/user/user.module')
| -rw-r--r-- | modules/user/user.module | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/modules/user/user.module b/modules/user/user.module index 6e8b83a80..cdb912d92 100644 --- a/modules/user/user.module +++ b/modules/user/user.module @@ -1361,8 +1361,11 @@ function user_authenticate_finalize(&$edit) { // This is also used to invalidate one-time login links. $user->login = REQUEST_TIME; db_query("UPDATE {users} SET login = %d WHERE uid = %d", $user->login, $user->uid); - user_module_invoke('login', $edit, $user); + // Regenerate the session ID to prevent against session fixation attacks. + // This is called before hook_user in case one of those functions fails + // or incorrectly does a redirect which would leave the old session in place. drupal_session_regenerate(); + user_module_invoke('login', $edit, $user); } /** |