external/aurweb
0
0
Fork 0
mirror of https://gitlab.archlinux.org/archlinux/aurweb.git synced 2025-02-03 10:43:03 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Add a per-user session limit (fixes FS#12898).

Browse source 
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
This commit is contained in:
Lukas Fleischer 2011-02-22 10:42:57 +01:00
parent c39183c3ee
commit f961ffd9c7
2 changed files with 18 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
web/lib/acctfuncs.inc
View file

@ -601,7 +601,7 @@ function display_account_info($U="", $T="", $E="", $R="", $I="") {
* SID of 0 means login failed. * SID of 0 means login failed.
*/ */
function try_login() { function try_login() {
global $PERSISTENT_COOKIE_TIMEOUT; global $MAX_SESSIONS_PER_USER, $PERSISTENT_COOKIE_TIMEOUT;
$login_error = ""; $login_error = "";
$new_sid = ""; $new_sid = "";
@ -624,6 +624,20 @@ function try_login() {
$dbh = db_connect(); $dbh = db_connect();
while (!$logged_in && $num_tries < 5) { while (!$logged_in && $num_tries < 5) {
if ($MAX_SESSIONS_PER_USER) {
# Delete all user sessions except the
# last ($MAX_SESSIONS_PER_USER - 1).
$q = "DELETE s.* FROM Sessions s ";
$q.= "LEFT JOIN (SELECT SessionID FROM Sessions ";
$q.= "WHERE UsersId = '" . $userID . "' ";
$q.= "ORDER BY LastUpdateTS DESC ";
$q.= "LIMIT " . ($MAX_SESSIONS_PER_USER - 1) . ") q ";
$q.= "ON s.SessionID = q.SessionID ";
$q.= "WHERE s.UsersId = '" . $userID . "' ";
$q.= "AND q.SessionID IS NULL;";
db_query($q, $dbh);
}
$new_sid = new_sid(); $new_sid = new_sid();
$q = "INSERT INTO Sessions (UsersID, SessionID, LastUpdateTS)" $q = "INSERT INTO Sessions (UsersID, SessionID, LastUpdateTS)"
." VALUES ( $userID, '" . $new_sid . "', UNIX_TIMESTAMP())"; ." VALUES ( $userID, '" . $new_sid . "', UNIX_TIMESTAMP())";

3
web/lib/config.inc.proto
View file

@ -45,6 +45,9 @@ $SUPPORTED_LANGS = array(
"zh_CN" => "简体中文" "zh_CN" => "简体中文"
); );
# Session limit per user
$MAX_SESSIONS_PER_USER = 8;
# Idle seconds before timeout # Idle seconds before timeout
$LOGIN_TIMEOUT = 7200; $LOGIN_TIMEOUT = 7200;