MDL-16613 refactore session IP tracking; MDL-14213 improved message when IP changes...

diff --git a/lang/en_utf8/error.php b/lang/en_utf8/error.php
index 6da0e37a3c4c00c6a83467c0077df46dee324feb..198784ba030620ecc6ad3f15cf0d4a1778ad7da6 100644 (file)
--- a/lang/en_utf8/error.php
+++ b/lang/en_utf8/error.php
@@ -400,6 +400,7 @@ $string['sessioncookiesdisable'] = 'Incorrect use of require_key_login() - sessi
 $string['sessionerroruser'] = 'Your session has timed out.  Please login again.';
 $string['sessionerroruser2'] = 'A server error that affects your login session was detected. Please login again or restart your browser.';
 $string['sessionipnomatch'] = 'Sorry, but your IP number seems to have changed from when you first logged in.  This security feature prevents crackers stealing your identity while logged in to this site.  Normal users should not be seeing this message - please ask the site administrator for help.';
+$string['sessionipnomatch2'] = 'Sorry, but your IP number seems to have changed from when you first logged in.  This security feature prevents crackers stealing your identity while logged in to this site. You may see this error if you use wireless networks or if you are roaming between different networks. Please ask the site administrator for more help.<br /><br />If you want to continue please press F5 key to refresh this page.';
 $string['socksnotsupported'] = 'SOCKS5 proxy is not supported in PHP4';
 $string['spellcheckernotconf'] = 'Spellchecker not configured';
 $string['statscatchupmode'] = 'Statistics is currently in catchup mode. So far $a->daysdone day(s) have been processed and $a->dayspending are pending. Check back soon!';

diff --git a/lib/moodlelib.php b/lib/moodlelib.php
index c63a6bcd6e213a6e4b10a4963683368b0bf27293..bc8740afc6a41ed9962f0214de479fb162fce7c7 100644 (file)
--- a/lib/moodlelib.php
+++ b/lib/moodlelib.php
@@ -268,6 +268,10 @@ define ('DEBUG_ALL', 6143);
 /** DEBUG_ALL with extra Moodle debug messages - (DEBUG_ALL | 32768) */
 define ('DEBUG_DEVELOPER', 38911);
 
+/** Get remote addr constant */
+define('GETREMOTEADDR_SKIP_HTTP_CLIENT_IP', '1');
+/** Get remote addr constant */
+define('GETREMOTEADDR_SKIP_HTTP_X_FORWARDED_FOR', '2');
 
 /// Blog access level constant declaration ///
 define ('BLOG_USER_LEVEL', 1);
@@ -3364,10 +3368,6 @@ function get_complete_user_data($field, $value, $mnethostid=null) {
         $user->lastname   = ' ';
     }
 
-    if (isset($_SERVER['REMOTE_ADDR'])) {
-        $user->sessionIP = md5(getremoteaddr());   // Store the current IP in the session
-    }
-
     return $user;
 }
 
@@ -7395,8 +7395,6 @@ function remoteip_in_list($list){
  *
  * @return string The remote IP address
  */
-define('GETREMOTEADDR_SKIP_HTTP_CLIENT_IP', '1');
-define('GETREMOTEADDR_SKIP_HTTP_X_FORWARDED_FOR', '2');
 function getremoteaddr() {
     global $CFG;
 

diff --git a/lib/sessionlib.php b/lib/sessionlib.php
index 470e7701be994bd22704faf054d647872bbbbd31..7b8f87ff906a451e6755cfe11ed9513316f90eb1 100644 (file)
--- a/lib/sessionlib.php
+++ b/lib/sessionlib.php
@@ -45,6 +45,8 @@ class moodle_session {
         }
 
         $this->check_user_initialised();
+
+        $this->check_security();
     }
 
     /**
@@ -95,11 +97,15 @@ class moodle_session {
         session_set_user($user);
     }
 
+    /**
+     * Does various session security checks
+     * @global void
+     */
     protected function check_security() {
         global $CFG;
 
-        if (!empty($_SESSION['USER']->id)) {
-            /// Make sure current IP matches the one for this session (if required)
+        if (!empty($_SESSION['USER']->id) and !empty($CFG->tracksessionip)) {
+            /// Make sure current IP matches the one for this session
             $remoteaddr = getremoteaddr();
 
             if (empty($_SESSION['USER']->sessionip)) {
@@ -107,15 +113,14 @@ class moodle_session {
             }
 
             if ($_SESSION['USER']->sessionip != $remoteaddr) {
-                if (!is_guestuser($_SESSION['USER'])) {
-                    $link = '';
-                } else {
-                    
-                }
-                print_error('sessionipnomatch', 'error');
+                // this is a security feature - terminate the session in case of any doubt
+                $this->terminate();
+                print_error('sessionipnomatch2', 'error');
             }
         }
 
+        // TODO: add wwwroot check here
+
     }
 
     /**
@@ -138,11 +143,12 @@ class moodle_session {
         $line = null;
         if (headers_sent($file, $line)) {
             error_log('Can not terminate session properly - headers were already sent in file: '.$file.' on line '.$line);
-        } else {
-            // TODO: regenerate session ID here
-
         }
 
+        // now let's try to get a new session id and destroy the old one
+        @session_regenerate_id(true);
+
+        // close the session
         @session_write_close();
     }
 

diff --git a/lib/setup.php b/lib/setup.php
index bf9e4ff3353ef7663a8c8231c63f2ecdbbec5c42..3b17dace89dcae2ef6a96288942351cbb5714abe 100644 (file)
--- a/lib/setup.php
+++ b/lib/setup.php
@@ -386,11 +386,7 @@ global $HTTPSPAGEREQUIRED;
         }
     }
 
-/// start session and prepare global $SESSION, $USER
-    session_get_instance();
-    $SESSION = &$_SESSION['SESSION'];
-    $USER    = &$_SESSION['USER'];
-
+/// initialise ME's
     if (defined('FULLME')) {     // Usually in command-line scripts like admin/cron.php
         $FULLME = FULLME;
         $ME = FULLME;
@@ -399,6 +395,11 @@ global $HTTPSPAGEREQUIRED;
         $ME = strip_querystring($FULLME);
     }
 
+/// start session and prepare global $SESSION, $USER
+    session_get_instance();
+    $SESSION = &$_SESSION['SESSION'];
+    $USER    = &$_SESSION['USER'];
+
 /// Load up theme variables (colours etc)
 
     if (!isset($CFG->themedir)) {

diff --git a/lib/weblib.php b/lib/weblib.php
index 464e6c8afb8db6ee9100305c244272e7db03ccae..12b970a482a7440381c37e688f585e5fbc6e7fda 100644 (file)
--- a/lib/weblib.php
+++ b/lib/weblib.php
@@ -5925,7 +5925,7 @@ function _print_early_error($errorcode, $module, $a, $backtrace=null, $debuginfo
     if (debugging('', DEBUG_DEVELOPER)) {
         if ($debuginfo) {
             debugging($debuginfo, DEBUG_DEVELOPER, $backtrace);
-        } else {
+        } else if ($backtrace) {
             notify('Stack trace:'.print_backtrace($backtrace, true), 'notifytiny');
         }
     }