diff options
author | Florian Pritz <bluewind@xinu.at> | 2018-06-14 20:56:36 +0200 |
---|---|---|
committer | Florian Pritz <bluewind@xinu.at> | 2018-06-14 20:56:36 +0200 |
commit | fb56cdb3efd11f4ec6cf053b8f04cc51a7d3bd4e (patch) | |
tree | fd81b4a7064f3dba7bdfadbd7a29424539cef324 /system/libraries/Session/drivers/Session_database_driver.php | |
parent | f34668f94b6a69fa777c6025ccc798b5e3c1110f (diff) | |
parent | 30e2eafa86c4c7b6b39cea3e7089a90df9f603fb (diff) |
Merge tag '3.1.9' of git://github.com/bcit-ci/CodeIgniter into dev
Signed-off-by: Florian Pritz <bluewind@xinu.at>
Diffstat (limited to 'system/libraries/Session/drivers/Session_database_driver.php')
-rw-r--r-- | system/libraries/Session/drivers/Session_database_driver.php | 26 |
1 files changed, 26 insertions, 0 deletions
diff --git a/system/libraries/Session/drivers/Session_database_driver.php b/system/libraries/Session/drivers/Session_database_driver.php index ae7a1b4a1..074accfe7 100644 --- a/system/libraries/Session/drivers/Session_database_driver.php +++ b/system/libraries/Session/drivers/Session_database_driver.php @@ -133,6 +133,8 @@ class CI_Session_database_driver extends CI_Session_driver implements SessionHan return $this->_fail(); } + $this->php5_validate_id(); + return $this->_success; } @@ -340,6 +342,30 @@ class CI_Session_database_driver extends CI_Session_driver implements SessionHan : $this->_fail(); } + // -------------------------------------------------------------------- + + /** + * Validate ID + * + * Checks whether a session ID record exists server-side, + * to enforce session.use_strict_mode. + * + * @param string $id + * @return bool + */ + public function validateId($id) + { + // Prevent previous QB calls from messing with our queries + $this->_db->reset_query(); + + $this->_db->select('1')->from($this->_config['save_path'])->where('id', $id); + empty($this->_config['match_ip']) OR $this->_db->where('ip_address', $_SERVER['REMOTE_ADDR']); + $result = $this->_db->get(); + empty($result) OR $result = $result->row(); + + return ! empty($result); + } + // ------------------------------------------------------------------------ /** |