From 3019e656498ef5ba5b2072f642c85ac38487436e Mon Sep 17 00:00:00 2001 From: "Namhyeon, Go" Date: Mon, 24 Sep 2018 03:38:08 +0900 Subject: [PATCH] Update security.php --- system/security.php | 21 +++++++++++++-------- 1 file changed, 13 insertions(+), 8 deletions(-) diff --git a/system/security.php b/system/security.php index daa56bf..6d90b00 100644 --- a/system/security.php +++ b/system/security.php @@ -301,25 +301,30 @@ if(!function_exists("session_logout")) { $ss_user_name = get_session("ss_user_name"); $ss_key = get_session("ss_key"); - + + // delete session file + $session_name = get_password($ss_key); + remove_storage_file($session_name, array( + "filename" => $session_name, + "storage_type" => get_value_in_array("session_dir", $config, "session"), + )); + + // reset session if(!empty($ss_key)) { set_session("ss_user_name", ""); set_session("ss_key", ""); } - // delete session file - @unlink($config['session_dir'] . '/' . protect_dir_path($ss_key)); - // permanently destory session_unset(); session_destroy(); // check ereased token - $abuse = check_token_abuse($ss_user_name, get_session("ss_user_name")); - $abuse = ($abuse && check_token_abuse($ss_key, get_session("ss_key"))); + $abuse_ss_user_name = check_token_abuse($ss_user_name, get_session("ss_user_name")); + $abuse_ss_key = check_token_abuse($ss_key, get_session("ss_key")); - // apply result - $flag = $abuse; + // return result + $flag = ($abuse_ss_user_name && $abuse_ss_key); return $flag; }