Do not check the IP address with session protection disabled

This allows the user to stay logged in if his IP changes.

Fixes #1106

diff --git a/application/security/LoginManager.php b/application/security/LoginManager.php
index d6784d6da6424e266a21702b7f0686746e91fe20..5a58926dd16b441fa4b36db5e2c87d790c8ed07d 100644 (file)
--- a/application/security/LoginManager.php
+++ b/application/security/LoginManager.php
@@ -58,6 +58,9 @@ class LoginManager
      */
     public function generateStaySignedInToken($clientIpAddress)
     {
+        if ($this->configManager->get('security.session_protection_disabled') === true) {
+            $clientIpAddress = '';
+        }
         $this->staySignedInToken = sha1(
             $this->configManager->get('credentials.hash')
             . $clientIpAddress

diff --git a/tests/security/LoginManagerTest.php b/tests/security/LoginManagerTest.php
index f26cd1eb8635c0bd21f8f4ab68043b7569562ddf..b9ab5ec45929025d0de81040c8c9521f2785b4b0 100644 (file)
--- a/tests/security/LoginManagerTest.php
+++ b/tests/security/LoginManagerTest.php
@@ -259,6 +259,20 @@ class LoginManagerTest extends TestCase
         );
     }
 
+    /**
+     * Generate a token depending on the user credentials with session protected disabled
+     */
+    public function testGenerateStaySignedInTokenSessionProtectionDisabled()
+    {
+        $this->configManager->set('security.session_protection_disabled', true);
+        $this->loginManager->generateStaySignedInToken($this->clientIpAddress);
+
+        $this->assertEquals(
+            sha1($this->passwordHash . $this->salt),
+            $this->loginManager->getStaySignedInToken()
+        );
+    }
+
     /**
      * Check user login - Shaarli has not yet been configured
      */