note 12688 deleted from function.session-start by jimw

**SECURITY ALERT** (Another addendum) The suggestions in both the security alerts above are really insufficient. If I have access to a box where I can write and execute my own PHP scripts, I can trivially make one that has in it the registered variable $admin, and then use a text editor to change the cookie on my PC to be valid for any domain. So then the admin variable will have been set by a session, but the admin hasn't logged in. To get around this, we have to check the admin's password each time we load a page with such code (or if it's a site where a user logs in, then accesses many pages as that user, we must check user's password). However transferring even the encrypted password back and forth isn't all that secure. If someone knows the encrypted password, they can use a dictionary crack on it. So what we do is when creating a session, we take that session's ID, and the user's password (with which he has just successfully logged in), concatenate them into 1 string, take the md5 sum of that string, and store that in the session. We do not store the encrypted passwd (and certainly not the plaintext password). Then for each subsequent page we take this variable from the session, and recreate the md5 sum from server-side data, and if they don't match, redirect to an error page. Some sample code: login_page.phtml: ----------------- <?PHP session_start(); $id = session_id(); //$password is submitted by login form $string = $password.$id; $hash = md5sum($string); session_register($hash); ?> other pages: ------------- session_start(); $id = session_id(); //$password is read from the database on the server $string = $password.$id; $local_hash = md5sum($string); //$hash was in the session if ($hash != $local_hash) { //destroy the false session session_destroy(); Header("Location: error_page.phtml"); } ?> This should be used in conjunction with the other checks as it won't weed out foo.phtml?admin=1 or the like. Because we are only transmitting the md5sum of the string "passwordSESSIONID", if it's intercepted the hacker can't get either the password or the session ID (to hijack the session) from it. Enjoy.