diff options
| -rw-r--r-- | engine/lib/actions.php | 5 | ||||
| -rw-r--r-- | engine/lib/sessions.php | 3 |
2 files changed, 7 insertions, 1 deletions
diff --git a/engine/lib/actions.php b/engine/lib/actions.php index 76913f2b4..a78072f31 100644 --- a/engine/lib/actions.php +++ b/engine/lib/actions.php @@ -177,8 +177,11 @@ // Get user agent $ua = $_SERVER['HTTP_USER_AGENT']; + // Session token + $st = $_SESSION['__elgg_session']; + if (($site_secret) && ($session_id)) - return md5($site_secret.$timestamp.$session_id.$ua); + return md5($site_secret.$timestamp.$session_id.$ua.$st); return false; } diff --git a/engine/lib/sessions.php b/engine/lib/sessions.php index 0a35fec1a..3dd9ac9e1 100644 --- a/engine/lib/sessions.php +++ b/engine/lib/sessions.php @@ -204,6 +204,9 @@ { $_SESSION['__elgg_fingerprint'] = get_session_fingerprint(); } + + // Generate a simple token + if (!isset($_SESSION['__elgg_session'])) $_SESSION['__elgg_session'] = md5(microtime().rand()); if (empty($_SESSION['guid'])) {
if (isset($_COOKIE['elggperm'])) {
|