Merge remote-tracking branch 'upstream/develop' into develop-core-security

1 files changed, 8 insertions, 3 deletions

diff --git a/system/core/Security.php b/system/core/Security.php
index d0d3c0803..f09298bba 100755
--- a/system/core/Security.php
+++ b/system/core/Security.php
@@ -169,9 +169,14 @@ class CI_Security {
 		// polute the _POST array
 		unset($_POST[$this->_csrf_token_name]);
 
-		// Nothing should last forever
-		unset($_COOKIE[$this->_csrf_cookie_name]);
-		$this->_csrf_hash = '';
+		// Regenerate on every submission?
+		if (config_item('csrf_regenerate'))
+		{
+			// Nothing should last forever
+			unset($_COOKIE[$this->_csrf_cookie_name]);
+			$this->_csrf_hash = '';
+		}
+		
 		$this->_csrf_set_hash();
 		$this->csrf_set_cookie();