Version 4.3.0

system/Session/Admin.php

@@ -26,6 +26,11 @@ class _Admin extends \IPS\Session
 	 * @brief	Unix Timestamp of log in time
 	 */
 	public $logInTime;
+	
+	/**
+	 * @brief	Key for cookie
+	 */
+	public $cookieKey;
 			
 	/**
 	 * Open Session
@@ -55,6 +60,7 @@ class _Admin extends \IPS\Session
 			/* Load session */
 			$session = \IPS\Db::i()->select( '*', 'core_sys_cp_sessions', array( 'session_id=?', $sessionId ) )->first();
 			$this->logInTime = $session['session_log_in_time'];
+			$this->cookieKey = $session['session_cookie_key'];
 			
 			/* Store this so plugins can access */
 			$this->sessionData	= $session;
@@ -71,6 +77,10 @@ class _Admin extends \IPS\Session
 			{
 				throw new \DomainException('NO_ADSESS');
 			}
+			if ( \IPS\Request::i()->cookie['acp_login_key'] !== $this->cookieKey )
+			{
+				throw new \DomainException('NO_COOKIE');
+			}
 			
 			/* Check IP address */
 			if ( ( defined( '\IPS\BYPASS_ACP_IP_CHECK' ) and !\IPS\BYPASS_ACP_IP_CHECK ) and \IPS\Settings::i()->match_ipaddress and $session['session_ip_address'] !== \IPS\Request::i()->ipAddress() )
@@ -86,7 +96,8 @@ class _Admin extends \IPS\Session
 			$this->member = new \IPS\Member;
 			$this->logInTime = 0;
 			$this->error = $e;
-			return '';
+			$this->cookieKey = \IPS\Login::generateRandomString();
+			return isset( $this->sessionData['session_app_data'] ) ? $this->sessionData['session_app_data'] : '';
 		}
 	}
 	
@@ -108,8 +119,9 @@ class _Admin extends \IPS\Session
 			'session_log_in_time'		=> $this->logInTime,
 			'session_running_time'		=> time(),
 			'session_url'				=> \IPS\Request::i()->url(),
-			'session_app_data'			=> $data
-			) );
+			'session_app_data'			=> $data,
+			'session_cookie_key'		=> $this->cookieKey
+		) );
 		
 		return TRUE;
 	}