diff --git a/system/admin/views/login.html.php b/system/admin/views/login.html.php
index 7bd42e07..3f4ee650 100644
--- a/system/admin/views/login.html.php
+++ b/system/admin/views/login.html.php
@@ -20,6 +20,10 @@
}
} ?>" name="password" placeholder=""/>
+
+ >
+
+
diff --git a/system/admin/views/logout.html.php b/system/admin/views/logout.html.php
index 19ab5c8c..f15c8d9f 100644
--- a/system/admin/views/logout.html.php
+++ b/system/admin/views/logout.html.php
@@ -2,6 +2,10 @@
generate_meta(null, null),
'username' => $user,
'password' => $pass,
+ 'remember' => $remember,
'type' => 'is_login',
'is_login' => true,
'bodyclass' => 'in-login',
'breadcrumb' => '
' . config('breadcrumb.home') . ' » ' . i18n('Login')
));
} else {
- session($user, $pass);
- $log = session($user, $pass);
+ $log = session($user, $pass, $remember);
if (!empty($log)) {
@@ -180,6 +182,7 @@
'canonical' => site_url(),
'metatags' => generate_meta(null, null),
'error' => '
',
+ 'remember' => $remember,
'type' => 'is_login',
'is_login' => true,
'bodyclass' => 'in-login',
@@ -212,6 +215,7 @@
'error' => '
' . $message['error'] . '
',
'username' => $user,
'password' => $pass,
+ 'remember' => $remember,
'type' => 'is_login',
'is_login' => true,
'bodyclass' => 'in-login',
@@ -226,12 +230,12 @@
$proper = is_csrf_proper(from($_REQUEST, 'csrf_token'));
$user = $_SESSION["mfa_uid"];
$pass = $_SESSION["mfa_pwd"];
+ $remember = isset($_SESSION['mfa_remember']) && $_SESSION['mfa_remember'] === '1';
$mfacode = from($_REQUEST, 'mfacode');
$mfa_secret = user('mfa_secret', $user);
$google2fa = new Google2FA();
if ($proper && $google2fa->verifyKey($mfa_secret, $mfacode, '1')) {
- session($user, $pass);
- $log = session($user, $pass);
+ $log = session($user, $pass, $remember);
if (!empty($log)) {
diff --git a/system/includes/session.php b/system/includes/session.php
index 826294a8..27f8d23d 100644
--- a/system/includes/session.php
+++ b/system/includes/session.php
@@ -8,10 +8,71 @@
session_start();
+function current_session_ip()
+{
+ return isset($_SERVER['REMOTE_ADDR']) ? (string) $_SERVER['REMOTE_ADDR'] : '';
+}
+
+function is_session_ip_validation_enabled()
+{
+ $setting = config('session.ip.validation');
+ return is_null($setting) || $setting === 'true';
+}
+
+function invalidate_auth_session()
+{
+ unset($_SESSION[site_url()]);
+
+ if (session_status() === PHP_SESSION_ACTIVE) {
+ set_session_cookie_lifetime(time() - 3600);
+ }
+}
+
+function set_session_cookie_lifetime($lifetime = 0)
+{
+ if (session_status() == PHP_SESSION_NONE || headers_sent()) {
+ return;
+ }
+
+ $params = session_get_cookie_params();
+ if (PHP_VERSION_ID < 70300) {
+ $path = isset($params['path']) ? $params['path'] : '/';
+ $path .= '; samesite=' . $GLOBALS['samesite'];
+ setcookie(session_name(), session_id(), $lifetime, $path, $params['domain'], $params['secure'], $params['httponly']);
+ } else {
+ setcookie(session_name(), session_id(), array(
+ 'expires' => $lifetime,
+ 'path' => $params['path'],
+ 'domain' => $params['domain'],
+ 'secure' => $params['secure'],
+ 'httponly' => $params['httponly'],
+ 'samesite' => isset($params['samesite']) ? $params['samesite'] : 'strict'
+ ));
+ }
+}
+
function login()
{
if (session_status() == PHP_SESSION_NONE) return false;
if (isset($_SESSION[site_url()]['user']) && !empty($_SESSION[site_url()]['user'])) {
+ if (!is_session_ip_validation_enabled()) {
+ return true;
+ }
+
+ $storedIp = isset($_SESSION[site_url()]['ip']) ? (string) $_SESSION[site_url()]['ip'] : '';
+ $currentIp = current_session_ip();
+
+ // Backward compatibility for older sessions created before IP binding existed.
+ if ($storedIp === '' && $currentIp !== '') {
+ $_SESSION[site_url()]['ip'] = $currentIp;
+ return true;
+ }
+
+ if ($storedIp !== '' && $currentIp !== '' && $storedIp !== $currentIp) {
+ invalidate_auth_session();
+ return false;
+ }
+
return true;
} else {
return false;
@@ -22,5 +83,6 @@ function login()
if (isset($_SESSION['mfa_pwd']) && isset($_SESSION['mfa_uid'])) {
unset($_SESSION['mfa_pwd']);
unset($_SESSION['mfa_uid']);
+ unset($_SESSION['mfa_remember']);
}
}