From 9c4280be80f1f0ad4011ca1ae4f05c89e7963bb9 Mon Sep 17 00:00:00 2001 From: Derek Allard Date: Tue, 18 Mar 2008 00:01:52 +0000 Subject: added hashing to prevent client side data tampering to sessions --- system/libraries/Session.php | 20 ++++++ user_guide/changelog.html | 1 + user_guide/installation/index.html | 2 +- user_guide/installation/upgrade_162.html | 103 +++++++++++++++++++++++++++++++ 4 files changed, 125 insertions(+), 1 deletion(-) create mode 100644 user_guide/installation/upgrade_162.html diff --git a/system/libraries/Session.php b/system/libraries/Session.php index 2cdd50c23..afa43348e 100644 --- a/system/libraries/Session.php +++ b/system/libraries/Session.php @@ -196,7 +196,22 @@ class CI_Session { { $session = $this->CI->encrypt->decode($session); } + else + { + // encryption was not used, so we need to check the md5 hash + $hash = substr($session, strlen($session)-32); // get last 32 chars + $session = substr($session, 0, strlen($session)-32); + // Does the md5 hash match? This is to prevent manipulation of session data + // in userspace + if ($hash !== md5($session.$this->CI->config->item('encryption_key'))) + { + log_message('error', 'The session cookie data did not match what was expected. This could be a possible hacking attempt.'); + $this->sess_destroy(); + return FALSE; + } + } + $session = @unserialize($this->strip_slashes($session)); if ( ! is_array($session) OR ! isset($session['last_activity'])) @@ -284,6 +299,11 @@ class CI_Session { { $cookie_data = $this->CI->encrypt->encode($cookie_data); } + else + { + // if encryption is not used, we provide an md5 hash to prevent userside tampering + $cookie_data = $cookie_data . md5($cookie_data.$this->CI->config->item('encryption_key')); + } setcookie( $this->sess_cookie, diff --git a/user_guide/changelog.html b/user_guide/changelog.html index d90f79aba..b0fa83d6b 100644 --- a/user_guide/changelog.html +++ b/user_guide/changelog.html @@ -68,6 +68,7 @@ Change Log
  • Libraries
  • Helpers diff --git a/user_guide/installation/index.html b/user_guide/installation/index.html index 336f7586b..e925c2175 100644 --- a/user_guide/installation/index.html +++ b/user_guide/installation/index.html @@ -62,7 +62,7 @@ Installation Instructions
    1. Unzip the package.
    2. Upload the CodeIgniter folders and files to your server. Normally the index.php file will be at your root.
      3. -
    3. Open the application/config/config.php file with a text editor and set your base URL.
      4. +
    4. Open the application/config/config.php file with a text editor and set your base URL. If you intend to use encryption or sessions, set your encryption key.
    5. If you intend to use a database, open the application/config/database.php file with a text editor and set your database settings.
    diff --git a/user_guide/installation/upgrade_162.html b/user_guide/installation/upgrade_162.html new file mode 100644 index 000000000..7fd01ea44 --- /dev/null +++ b/user_guide/installation/upgrade_162.html @@ -0,0 +1,103 @@ + + + + +CodeIgniter User Guide : Upgrading from 1.6.1 to 1.6.2 + + + + + + + + + + + + + + + + + + + + + + +
    + + + + + +

    CodeIgniter User Guide Version 1.6.1

    +
    + + + + + + + + + +
    + + +
    + + + +
    + +

    Upgrading from 1.6.1 to 1.6.2

    + +

    Before performing an update you should take your site offline by replacing the index.php file with a static one.

    + + + +

    Step 1: Update your CodeIgniter files

    + +

    Replace these files and directories in your "system" folder with the new versions:

    + +
      + +
    • system/codeigniter
      • +
    • system/database
      • +
    • system/helpers
      • +
    • system/language
      • +
    • system/libraries
      • +
    + +

    Note: If you have any custom developed files in these folders please make copies of them first.

    + + +

    Step 2: Encryption Key

    +

    If you are using sessions, open up system/application/config.php and verify you've set an encryption key.

    + + +

    Step 3: Update your user guide

    +

    Please also replace your local copy of the user guide with the new version.

    + +
    + + + + + + + \ No newline at end of file -- cgit v1.2.3-24-g4f1b