Merge branch '2.5.x' into cc-5709-airtime-analyzer

Conflicts:
	airtime_mvc/application/Bootstrap.php
	airtime_mvc/locale/de_AT/LC_MESSAGES/airtime.po
	airtime_mvc/locale/en_GB/LC_MESSAGES/airtime.po
	airtime_mvc/locale/pt_BR/LC_MESSAGES/airtime.po

airtime_mvc/application/Bootstrap.php

@@ -14,6 +14,7 @@ require_once "DateHelper.php";
 require_once "OsPath.php";
 require_once "Database.php";
 require_once "Timezone.php";
+require_once "Auth.php";
 require_once __DIR__.'/forms/helpers/ValidationTypes.php';
 require_once __DIR__.'/controllers/plugins/RabbitMqPlugin.php';
 require_once __DIR__.'/controllers/plugins/Maintenance.php';
@@ -26,6 +27,8 @@ require_once __DIR__."/configs/navigation.php";
 
 Zend_Validate::setDefaultNamespaces("Zend");
 
+Application_Model_Auth::pinSessionToClient(Zend_Auth::getInstance());
+
 $front = Zend_Controller_Front::getInstance();
 $front->registerPlugin(new RabbitMqPlugin());
 

airtime_mvc/application/controllers/LoginController.php

@@ -15,7 +15,6 @@ class LoginController extends Zend_Controller_Action
         
         Application_Model_Locale::configureLocalization($request->getcookie('airtime_locale', 'en_CA'));
         $auth = Zend_Auth::getInstance();
-        Application_Model_Auth::pinSessionToClient($auth);
         
         if ($auth->hasIdentity())
         {
@@ -96,7 +95,6 @@ class LoginController extends Zend_Controller_Action
     public function logoutAction()
     {
         $auth = Zend_Auth::getInstance();
-        Application_Model_Auth::pinSessionToClient($auth);
         $auth->clearIdentity();
         $this->_redirect('showbuilder/index');
     }
@@ -189,7 +187,6 @@ class LoginController extends Zend_Controller_Action
             $auth->invalidateTokens($user, 'password.restore');
 
             $zend_auth = Zend_Auth::getInstance();
-            Application_Model_Auth::pinSessionToClient($zend_auth);
             $zend_auth->clearIdentity();
 
             $authAdapter = Application_Model_Auth::getAuthAdapter();

airtime_mvc/application/models/Auth.php

@@ -112,11 +112,16 @@ class Application_Model_Auth
     }
     
     /** It is essential to do this before interacting with Zend_Auth otherwise sessions could be shared between
-     *  different copies of Airtime on the same webserver. This essentially pins this session to this hostname and client ID.
+     *  different copies of Airtime on the same webserver. This essentially pins this session to:
+     *   - The server hostname - including subdomain so we segment multiple Airtime installs on different subdomains
+     *   - The remote IP of the browser - to help prevent session hijacking
+     *   - The client ID - same reason as server hostname
      * @param Zend_Auth $auth Get this with Zend_Auth::getInstance().
      */
     public static function pinSessionToClient($auth)
     {
-        $auth->setStorage(new Zend_Auth_Storage_Session('Airtime' . $_SERVER['SERVER_NAME'] . Application_Model_Preference::GetClientId()));
+        $serverName = isset($_SERVER['SERVER_NAME']) ? $_SERVER['SERVER_NAME'] : "";
+        $remoteAddr = isset($_SERVER['REMOTE_ADDR']) ? $_SERVER['REMOTE_ADDR'] : "";
+        $auth->setStorage(new Zend_Auth_Storage_Session('Airtime' . $serverName . $remoteAddr . Application_Model_Preference::GetClientId()));
     }
 }

airtime_mvc/locale/az/LC_MESSAGES/airtime.po

@@ -8,7 +8,7 @@ msgstr ""
 "Project-Id-Version: Airtime\n"
 "Report-Msgid-Bugs-To: \n"
 "POT-Creation-Date: 2013-12-13 12:58-0500\n"
-"PO-Revision-Date: 2014-06-14 14:00+0000\n"
+"PO-Revision-Date: 2014-07-02 12:01+0000\n"
 "Last-Translator: Daniel James <daniel@64studio.com>\n"
 "Language-Team: Azerbaijani (http://www.transifex.com/projects/p/airtime/language/az/)\n"
 "MIME-Version: 1.0\n"

airtime_mvc/locale/hy/LC_MESSAGES/airtime.po

@@ -8,7 +8,7 @@ msgstr ""
 "Project-Id-Version: Airtime\n"
 "Report-Msgid-Bugs-To: \n"
 "POT-Creation-Date: 2013-12-13 12:58-0500\n"
-"PO-Revision-Date: 2014-06-10 22:00+0000\n"
+"PO-Revision-Date: 2014-06-25 15:01+0000\n"
 "Last-Translator: Daniel James <daniel@64studio.com>\n"
 "Language-Team: Armenian (http://www.transifex.com/projects/p/airtime/language/hy/)\n"
 "MIME-Version: 1.0\n"

airtime_mvc/locale/ka/LC_MESSAGES/airtime.po

@@ -8,7 +8,7 @@ msgstr ""
 "Project-Id-Version: Airtime\n"
 "Report-Msgid-Bugs-To: \n"
 "POT-Creation-Date: 2013-12-13 12:58-0500\n"
-"PO-Revision-Date: 2014-06-05 11:14+0000\n"
+"PO-Revision-Date: 2014-07-02 12:01+0000\n"
 "Last-Translator: Daniel James <daniel@64studio.com>\n"
 "Language-Team: Georgian (http://www.transifex.com/projects/p/airtime/language/ka/)\n"
 "MIME-Version: 1.0\n"