From 8edd7f15886620b07064aa889aea05c5acbc0e58 Mon Sep 17 00:00:00 2001 From: VirtualTam Date: Wed, 30 May 2018 02:09:09 +0200 Subject: SessionManager+LoginManager: fix checkLoginState logic Signed-off-by: VirtualTam --- application/security/LoginManager.php | 2 +- application/security/SessionManager.php | 5 ++++- 2 files changed, 5 insertions(+), 2 deletions(-) (limited to 'application') diff --git a/application/security/LoginManager.php b/application/security/LoginManager.php index 4946850b..d6784d6d 100644 --- a/application/security/LoginManager.php +++ b/application/security/LoginManager.php @@ -95,7 +95,6 @@ class LoginManager // The user client has a valid stay-signed-in cookie // Session information is updated with the current client information $this->sessionManager->storeLoginInfo($clientIpId); - $this->isLoggedIn = true; } elseif ($this->sessionManager->hasSessionExpired() || $this->sessionManager->hasClientIpChanged($clientIpId) @@ -105,6 +104,7 @@ class LoginManager return; } + $this->isLoggedIn = true; $this->sessionManager->extendSession(); } diff --git a/application/security/SessionManager.php b/application/security/SessionManager.php index 24e25528..b8b8ab8d 100644 --- a/application/security/SessionManager.php +++ b/application/security/SessionManager.php @@ -169,6 +169,9 @@ class SessionManager */ public function hasSessionExpired() { + if (empty($this->session['expires_on'])) { + return true; + } if (time() >= $this->session['expires_on']) { return true; } @@ -188,7 +191,7 @@ class SessionManager if ($this->conf->get('security.session_protection_disabled') === true) { return false; } - if ($this->session['ip'] == $clientIpId) { + if (isset($this->session['ip']) && $this->session['ip'] === $clientIpId) { return false; } return true; -- cgit v1.2.3