- session removal fix (csrf)

Marius Cramer · Marius Cramer · commit f3cc2c3985d2 · 2015-05-21T11:32:26.000+02:00
diff --git a/interface/lib/classes/tform.inc.php b/interface/lib/classes/tform.inc.php
@@ -685,8 +685,8 @@ function encode($record, $tab, $dbencode = true) {
 				unset($_POST);
 				unset($record);
 			}
-			$_SESSION['_csrf'][$_csrf_id] = ' ';
-			$_SESSION['_csrf_timeout'][$_csrf_id] = ' ';
+			$_SESSION['_csrf'][$_csrf_id] = null;
+			$_SESSION['_csrf_timeout'][$_csrf_id] = null;
 			unset($_SESSION['_csrf'][$_csrf_id]);
 			unset($_SESSION['_csrf_timeout'][$_csrf_id]);
 			
@@ -696,6 +696,8 @@ function encode($record, $tab, $dbencode = true) {
 					if($timeout < time()) $to_unset[] = $_csrf_id;
 				}
 				foreach($to_unset as $_csrf_id) {
+					$_SESSION['_csrf'][$_csrf_id] = null;
+					$_SESSION['_csrf_timeout'][$_csrf_id] = null;
 					unset($_SESSION['_csrf'][$_csrf_id]);
 					unset($_SESSION['_csrf_timeout'][$_csrf_id]);
 				}

Original file line number	Diff line number	Diff line change
`@@ -685,8 +685,8 @@ function encode($record, $tab, $dbencode = true) {`
`685`	`685`	`unset($_POST);`
`686`	`686`	`unset($record);`
`687`	`687`	`}`
`688`		`- $_SESSION['_csrf'][$_csrf_id] = ' ';`
`689`		`- $_SESSION['_csrf_timeout'][$_csrf_id] = ' ';`
	`688`	`+ $_SESSION['_csrf'][$_csrf_id] = null;`
	`689`	`+ $_SESSION['_csrf_timeout'][$_csrf_id] = null;`
`690`	`690`	`unset($_SESSION['_csrf'][$_csrf_id]);`
`691`	`691`	`unset($_SESSION['_csrf_timeout'][$_csrf_id]);`
`692`	`692`
`@@ -696,6 +696,8 @@ function encode($record, $tab, $dbencode = true) {`
`696`	`696`	`if($timeout < time()) $to_unset[] = $_csrf_id;`
`697`	`697`	`}`
`698`	`698`	`foreach($to_unset as $_csrf_id) {`
	`699`	`+ $_SESSION['_csrf'][$_csrf_id] = null;`
	`700`	`+ $_SESSION['_csrf_timeout'][$_csrf_id] = null;`
`699`	`701`	`unset($_SESSION['_csrf'][$_csrf_id]);`
`700`	`702`	`unset($_SESSION['_csrf_timeout'][$_csrf_id]);`
`701`	`703`	`}`