Re: Re[2]: [PEAR] session cross between users?
| From: | Justin Patrin | Date: | Thu, 18 Nov 2004 18:22:15 +0000 |
| Subject: | Re: Re[2]: [PEAR] session cross between users? | ||
| References: | 1 2 3 | Groups: | php.pear.general |
| Request: | Send a blank email to pear-general+get-15647@lists.php.net to get a copy of this message | ||
On Thu, 18 Nov 2004 17:06:32 +0100, Leo Márquez <leo@calidae.net> wrote:
> They are users from differents machines at same time.
>
> Thanks for the answer
>
> Leo
>
> Wednesday, November 17, 2004, 7:32:17 PM, vas escriure:
>
>
>
> JP> On Wed, 17 Nov 2004 12:47:23 +0100, Leo Márquez <leo@calidae.net> wrote:
> >> Working with php5 in a multiuser application in some cases the
> >> sessions of these users interchange
> >> and the one screen is put to him vice versa to the other. It is a
> >> serious problem because it harms the security of the system.
> >> I'm not sure if is a problem of the configuration of php5 in
> >> the servant, of the source code, bug of php5,
> >> bug of pear package, etc.
>
> JP> Are these users on different workstations or is this two people using
> JP> the same machine, one aftre the other?
>
>
>
> >> I have viewed the bug page of the Auth Package and I see:
> >>
> >> Session fixation attack vulnerability
> >> ---------------------------------------
> >> On successful authentication using supplied username and password, the
> >> session id should be changed. It would be nice to add an object option
> >> to allow setting this behavior.
> >>
> >> Can be my problem caused by this bug?
> >>
> >> I say to you what the system uses:
> >>
> >> Archive_Tar 1.2 stable
> >> Auth 1.2.3 stable
> >> Config 1.10.2 stable
> >> Console_Getopt 1.2 stable
> >> DB 1.6.8 stable
> >> DB_DataObject 1.7.2 stable
> >> DB_DataObject_FormBuilder 0.10.3 beta
> >> Date 1.4.3 stable
> >> File 1.0.3 stable
> >> HTML_Common 1.2.1 stable
> >> HTML_QuickForm 3.2.4 stable
> >> HTML_Table 1.5 stable
> >> HTML_TreeMenu 1.1.9 stable
> >> Image_Barcode 0.5 stable
> >> Log 1.8.6 stable
> >> PEAR 1.3.2 stable
> >> Translation 1.2.6pl1 stable
> >> XML_Parser 1.2.1 stable
> >> XML_RPC 1.1.0 stable
> >> XML_Util 0.6.1 stable
> >>
>
Well then...I would suggest adding IP validation to your sessions. Do
something like this at the start of your script:
session_start();
if (isset($_SESSION['userIp'])) {
if ($_SESSION['userIp'] != $_SERVER['REMOTE_ADDR']) {
session_destroy();
header('Location: http://www.example.com/login.php');
exit;
}
} else {
$_SESSION['userIp'] = $_SERVER['REMOTE_ADDR'];
}
--
Justin Patrin