Merge pull request #1182 from ArthurHoaro/feature/session-protection-stay-login

Do not check the IP address with session protection disabled

diff --combined application/security/LoginManager.php
index 0f3154835d734d74c035f169035d9d684b50dcfb,5a58926dd16b441fa4b36db5e2c87d790c8ed07d..1ff3d0be84ad89bbdd9bec265569b53d3eef43cc
--- 1/application/security/LoginManager.php
--- 2/application/security/LoginManager.php
+++ b/application/security/LoginManager.php
@@@ -58,6 -58,9 +58,9 @@@ class LoginManage
       */
      public function generateStaySignedInToken($clientIpAddress)
      {
+         if ($this->configManager->get('security.session_protection_disabled') === true) {
+             $clientIpAddress = '';
+         }
          $this->staySignedInToken = sha1(
              $this->configManager->get('credentials.hash')
              . $clientIpAddress
@@@ -95,6 -98,7 +98,6 @@@
              // The user client has a valid stay-signed-in cookie
              // Session information is updated with the current client information
              $this->sessionManager->storeLoginInfo($clientIpId);
 -
          } elseif ($this->sessionManager->hasSessionExpired()
              || $this->sessionManager->hasClientIpChanged($clientIpId)
          ) {

diff --combined tests/security/LoginManagerTest.php
index de8055edaede452cdeeb1c21ed42ae3b13447a8e,b9ab5ec45929025d0de81040c8c9521f2785b4b0..7b0262b32c128871841cf9d98aaf83e129ffacca
--- 1/tests/security/LoginManagerTest.php
--- 2/tests/security/LoginManagerTest.php
+++ b/tests/security/LoginManagerTest.php
@@@ -2,8 -2,7 +2,8 @@@
  namespace Shaarli\Security;
  
  require_once 'tests/utils/FakeConfigManager.php';
 -use \PHPUnit\Framework\TestCase;
 +
 +use PHPUnit\Framework\TestCase;
  
  /**
   * Test coverage for LoginManager
@@@ -260,6 -259,20 +260,20 @@@ class LoginManagerTest extends TestCas
          );
      }
  
+     /**
+      * Generate a token depending on the user credentials with session protected disabled
+      */
+     public function testGenerateStaySignedInTokenSessionProtectionDisabled()
+     {
+         $this->configManager->set('security.session_protection_disabled', true);
+         $this->loginManager->generateStaySignedInToken($this->clientIpAddress);
+ 
+         $this->assertEquals(
+             sha1($this->passwordHash . $this->salt),
+             $this->loginManager->getStaySignedInToken()
+         );
+     }
+ 
      /**
       * Check user login - Shaarli has not yet been configured
       */