Changeset 6661f09a2e6f822ef068c383527094aec7b7b5e4

Timestamp:

09/08/11 10:05:26 (8 months ago)

Author:

Neutron Soutmun <neo.neutron@…>

Children:

5d2b232350232d3c7e8e8fd416c2d84bf9df27e6

Parents:

34a6ec5005b242b699dcd00b4ac1dae47ae806cf

git-author:

Neutron Soutmun <neo.neutron@…> (09/07/11 18:23:16)

git-committer:

Neutron Soutmun <neo.neutron@…> (09/08/11 10:05:26)

Message:

Prevent double login, invalid logout/update info

• weblogin/rahu_radius.class.php (gen_session_id):
  • Keep the generated session_id in the session variable to prevent the double login with different session_id by mistake.
• weblogin/rahu_radius.class.php (rahu_radius_acct):
  • Do not permit the requests that have no session_id.

Files:

• weblogin/rahu_radius.class.php (modified) (4 diffs)

weblogin/rahu_radius.class.php

@@ -187 +187 @@
 
   function gen_session_id() {
+    if (!empty($_SESSION["login_session_id"]) &&
+          $this->username == $_SESSION["login_username"]) {
+      return $_SESSION["login_session_id"];
+    }
+
     $randno1 = rand(0,65535);
     $randno2 = rand(0,65535);
@@ -197 +202 @@
                 str_pad(dechex($randno4), 4, "0", STR_PAD_LEFT));
     $this->session_id = $randno;
+    $_SESSION["login_session_id"] = $randno;
+    $_SESSION["login_username"] = $this->username;
                                                      
     return $this->session_id;
@@ -206 +213 @@
 
   function acct($accttype, $param=NULL) {
+    if ($this->username == $_SESSION["login_username"] &&
+          $accttype == "Start" && $_SESSION["login_lastacct"] == "Start" &&
+          (time() - $_SESSION["login_lasttime"]) < 10) {
+      return -1;
+    }
+
     $classname = "Auth_RADIUS_Acct_" .$accttype;
     $racct = new $classname;
@@ -211 +224 @@
     $racct->username = $this->username;
     $racct->authentic = RADIUS_AUTH_LOCAL;
-    $racct->session_id = empty($this->session_id) ? $this->gen_session_id() :
-                                                    $this->session_id;
+
+    if (empty($this->session_id)) {
+      switch($accttype) {
+        case "Start":
+          $this->session_id = $this->gen_session_id();
+          break;
+        case "Stop":
+          /* Fall-through */
+        case "Update":
+          /* Do not permit the requests that have no session ID */
+          return -1;
+          break;
+      }
+    }
+
+    $_SESSION["login_lastacct"] = $accttype;
+    $_SESSION["login_lasttime"] = time();
+
+    $racct->session_id = $this->session_id;
     $racct->session_time = $this->get_session_time();
     $racct->useStandardAttributes = 0;