Version 4.7.0

system/Session/Front.php

@@ -100,6 +100,17 @@ class _Front extends \IPS\Session
 			$session = NULL;
 		}
 
+		/* Validate member_id cookie against member_id the session belongs to */
+		if( $session and isset( \IPS\Request::i()->cookie['member_id'] ) AND \IPS\Request::i()->cookie['member_id'] != $session['member_id'] )
+		{
+			$session = FALSE;
+		}
+		/* If the session is for a member but the member_id cookie is not present, wipe the session */
+		elseif( $session AND $session['member_id'] > 0 AND empty( \IPS\Request::i()->cookie['member_id'] ) )
+		{
+			$session = FALSE;
+		}
+
 		/* We match bots by browser and IP address, so reset our session ID if we found a matching bot row */
 		if( $session AND $session['uagent_type'] == 'search' AND $session['id'] != $this->sessionId )
 		{
@@ -237,11 +248,11 @@ class _Front extends \IPS\Session
 				\IPS\Request::i()->clearLoginCookies();
 			}
 		}
-								
+
 		/* Work out the type */
 		if ( $this->member->member_id )
 		{
-			if ( $this->member->group['g_hide_online_list'] != 2 AND ( ( $session and $session['login_type'] === static::LOGIN_TYPE_ANONYMOUS ) or ( $device and $device->anonymous ) OR $this->member->group['g_hide_online_list'] == 1 ) )
+			if ( $this->member->group['g_hide_online_list'] != 2 AND ( ( $session and $session['login_type'] === static::LOGIN_TYPE_ANONYMOUS ) or ( $this->member->members_bitoptions['is_anon'] ) OR $this->member->group['g_hide_online_list'] == 1 ) )
 			{
 				$type = static::LOGIN_TYPE_ANONYMOUS;
 			}