diff --git a/airtime_mvc/application/Bootstrap.php b/airtime_mvc/application/Bootstrap.php index fc9f6c7e4..ff80a4a65 100644 --- a/airtime_mvc/application/Bootstrap.php +++ b/airtime_mvc/application/Bootstrap.php @@ -14,6 +14,7 @@ require_once "DateHelper.php"; require_once "OsPath.php"; require_once "Database.php"; require_once "Timezone.php"; +require_once "Auth.php"; require_once __DIR__.'/forms/helpers/ValidationTypes.php'; require_once __DIR__.'/controllers/plugins/RabbitMqPlugin.php'; require_once __DIR__.'/controllers/plugins/Maintenance.php'; @@ -26,6 +27,8 @@ require_once __DIR__."/configs/navigation.php"; Zend_Validate::setDefaultNamespaces("Zend"); +Application_Model_Auth::pinSessionToClient(Zend_Auth::getInstance()); + $front = Zend_Controller_Front::getInstance(); $front->registerPlugin(new RabbitMqPlugin()); diff --git a/airtime_mvc/application/controllers/LoginController.php b/airtime_mvc/application/controllers/LoginController.php index 4f462478d..84af7f954 100644 --- a/airtime_mvc/application/controllers/LoginController.php +++ b/airtime_mvc/application/controllers/LoginController.php @@ -15,7 +15,6 @@ class LoginController extends Zend_Controller_Action Application_Model_Locale::configureLocalization($request->getcookie('airtime_locale', 'en_CA')); $auth = Zend_Auth::getInstance(); - Application_Model_Auth::pinSessionToClient($auth); if ($auth->hasIdentity()) { @@ -96,7 +95,6 @@ class LoginController extends Zend_Controller_Action public function logoutAction() { $auth = Zend_Auth::getInstance(); - Application_Model_Auth::pinSessionToClient($auth); $auth->clearIdentity(); $this->_redirect('showbuilder/index'); } @@ -189,7 +187,6 @@ class LoginController extends Zend_Controller_Action $auth->invalidateTokens($user, 'password.restore'); $zend_auth = Zend_Auth::getInstance(); - Application_Model_Auth::pinSessionToClient($zend_auth); $zend_auth->clearIdentity(); $authAdapter = Application_Model_Auth::getAuthAdapter(); diff --git a/airtime_mvc/application/models/Auth.php b/airtime_mvc/application/models/Auth.php index 5fe65084f..b474a04cf 100644 --- a/airtime_mvc/application/models/Auth.php +++ b/airtime_mvc/application/models/Auth.php @@ -112,11 +112,16 @@ class Application_Model_Auth } /** It is essential to do this before interacting with Zend_Auth otherwise sessions could be shared between - * different copies of Airtime on the same webserver. This essentially pins this session to this hostname and client ID. + * different copies of Airtime on the same webserver. This essentially pins this session to: + * - The server hostname - including subdomain so we segment multiple Airtime installs on different subdomains + * - The remote IP of the browser - to help prevent session hijacking + * - The client ID - same reason as server hostname * @param Zend_Auth $auth Get this with Zend_Auth::getInstance(). */ public static function pinSessionToClient($auth) { - $auth->setStorage(new Zend_Auth_Storage_Session('Airtime' . $_SERVER['SERVER_NAME'] . Application_Model_Preference::GetClientId())); + $serverName = isset($_SERVER['SERVER_NAME']) ? $_SERVER['SERVER_NAME'] : ""; + $remoteAddr = isset($_SERVER['REMOTE_ADDR']) ? $_SERVER['REMOTE_ADDR'] : ""; + $auth->setStorage(new Zend_Auth_Storage_Session('Airtime' . $serverName . $remoteAddr . Application_Model_Preference::GetClientId())); } } diff --git a/airtime_mvc/locale/az/LC_MESSAGES/airtime.mo b/airtime_mvc/locale/az/LC_MESSAGES/airtime.mo index 8b114640c..7ea37474f 100644 Binary files a/airtime_mvc/locale/az/LC_MESSAGES/airtime.mo and b/airtime_mvc/locale/az/LC_MESSAGES/airtime.mo differ diff --git a/airtime_mvc/locale/az/LC_MESSAGES/airtime.po b/airtime_mvc/locale/az/LC_MESSAGES/airtime.po index b53dce118..f37138f82 100644 --- a/airtime_mvc/locale/az/LC_MESSAGES/airtime.po +++ b/airtime_mvc/locale/az/LC_MESSAGES/airtime.po @@ -8,7 +8,7 @@ msgstr "" "Project-Id-Version: Airtime\n" "Report-Msgid-Bugs-To: \n" "POT-Creation-Date: 2013-12-13 12:58-0500\n" -"PO-Revision-Date: 2014-06-14 14:00+0000\n" +"PO-Revision-Date: 2014-07-02 12:01+0000\n" "Last-Translator: Daniel James \n" "Language-Team: Azerbaijani (http://www.transifex.com/projects/p/airtime/language/az/)\n" "MIME-Version: 1.0\n" diff --git a/airtime_mvc/locale/de_AT/LC_MESSAGES/airtime.mo b/airtime_mvc/locale/de_AT/LC_MESSAGES/airtime.mo index 26d7f1347..221ba9b4e 100644 Binary files a/airtime_mvc/locale/de_AT/LC_MESSAGES/airtime.mo and b/airtime_mvc/locale/de_AT/LC_MESSAGES/airtime.mo differ diff --git a/airtime_mvc/locale/en_GB/LC_MESSAGES/airtime.mo b/airtime_mvc/locale/en_GB/LC_MESSAGES/airtime.mo index 30f46f726..a51c6018b 100644 Binary files a/airtime_mvc/locale/en_GB/LC_MESSAGES/airtime.mo and b/airtime_mvc/locale/en_GB/LC_MESSAGES/airtime.mo differ diff --git a/airtime_mvc/locale/hy/LC_MESSAGES/airtime.mo b/airtime_mvc/locale/hy/LC_MESSAGES/airtime.mo index 62c3ca8fa..001dae0b9 100644 Binary files a/airtime_mvc/locale/hy/LC_MESSAGES/airtime.mo and b/airtime_mvc/locale/hy/LC_MESSAGES/airtime.mo differ diff --git a/airtime_mvc/locale/hy/LC_MESSAGES/airtime.po b/airtime_mvc/locale/hy/LC_MESSAGES/airtime.po index efb388027..17f62d28c 100644 --- a/airtime_mvc/locale/hy/LC_MESSAGES/airtime.po +++ b/airtime_mvc/locale/hy/LC_MESSAGES/airtime.po @@ -8,7 +8,7 @@ msgstr "" "Project-Id-Version: Airtime\n" "Report-Msgid-Bugs-To: \n" "POT-Creation-Date: 2013-12-13 12:58-0500\n" -"PO-Revision-Date: 2014-06-10 22:00+0000\n" +"PO-Revision-Date: 2014-06-25 15:01+0000\n" "Last-Translator: Daniel James \n" "Language-Team: Armenian (http://www.transifex.com/projects/p/airtime/language/hy/)\n" "MIME-Version: 1.0\n" diff --git a/airtime_mvc/locale/ka/LC_MESSAGES/airtime.mo b/airtime_mvc/locale/ka/LC_MESSAGES/airtime.mo index be7d0012a..baa86c187 100644 Binary files a/airtime_mvc/locale/ka/LC_MESSAGES/airtime.mo and b/airtime_mvc/locale/ka/LC_MESSAGES/airtime.mo differ diff --git a/airtime_mvc/locale/ka/LC_MESSAGES/airtime.po b/airtime_mvc/locale/ka/LC_MESSAGES/airtime.po index 05ac06155..669df8dbb 100644 --- a/airtime_mvc/locale/ka/LC_MESSAGES/airtime.po +++ b/airtime_mvc/locale/ka/LC_MESSAGES/airtime.po @@ -8,7 +8,7 @@ msgstr "" "Project-Id-Version: Airtime\n" "Report-Msgid-Bugs-To: \n" "POT-Creation-Date: 2013-12-13 12:58-0500\n" -"PO-Revision-Date: 2014-06-05 11:14+0000\n" +"PO-Revision-Date: 2014-07-02 12:01+0000\n" "Last-Translator: Daniel James \n" "Language-Team: Georgian (http://www.transifex.com/projects/p/airtime/language/ka/)\n" "MIME-Version: 1.0\n" diff --git a/airtime_mvc/locale/pt_BR/LC_MESSAGES/airtime.mo b/airtime_mvc/locale/pt_BR/LC_MESSAGES/airtime.mo index 00735f424..32e0474d4 100644 Binary files a/airtime_mvc/locale/pt_BR/LC_MESSAGES/airtime.mo and b/airtime_mvc/locale/pt_BR/LC_MESSAGES/airtime.mo differ