From a68db47508b74ccd0d7e6f8529a0f98b59dd69e0 Mon Sep 17 00:00:00 2001 From: Malf Furious Date: Sat, 5 Mar 2016 16:48:58 -0500 Subject: Add verify_ip security assertion This assertion will be used app-wide. This asserts that the IP address a client uses to conenct to the app is constant throughout the the session's lifetime. This is to detect any session hijacking. If a session suddenly appears to be comming from a different IP address, the session will be killed. --- app/class/controller.class.php | 15 +++++++++++++++ 1 file changed, 15 insertions(+) (limited to 'app') diff --git a/app/class/controller.class.php b/app/class/controller.class.php index fabd7e7..effaf78 100644 --- a/app/class/controller.class.php +++ b/app/class/controller.class.php @@ -32,6 +32,21 @@ abstract class Controller extends Framework if (isset($_SERVER['HTTPS'])) $this->redirectTo("http://" . $_SERVER['SERVER_NAME'] . $this->ap()); } + + /* + * Security check + * Assert that the client's IP address does not change during its session. If a change is detected, logout. + */ + function sec_verify_ip() + { + $addr = $_SERVER['REMOTE_ADDR']; + + if ($this->getCurrentUser() && $addr != $this->getOriginIP()) + { + $this->setCurrentUser(); + $this->redirectTo($this->ar() . "/"); + } + } } ?> -- cgit v1.2.3