Joomla 2.5中的会话固定

Question

这可能造成的影响：有可能窃取或操纵客户会话和cookie，这些会话和cookie可能被用来冒充合法用户，使黑客能够查看或更改用户记录，并以该用户的身份执行交易。

防止会话固定攻击的建议解决方案是在用户登录时续订会话ID。此修复可以在代码级别或框架级别完成，具体取决于会话管理功能的实现位置。

我正在设法解决这个问题，但还是没有成功。有人可以帮助如何在Joomla 2.5中解决这个问题吗？

我想在框架级别实现这个修复。任何帮助都将不胜感激。

Answer 1

我为Joomla3.x版本做了这件事。在2.5中应该类似。您应该修改2个文件以使其工作。

1. 库/cms/application/cms.php

2. libraries/joomla/session/session.php

在cms.php中修改登录的功能

 // Import the user plugin group.
            JPluginHelper::importPlugin('user');
            if ($response->status === JAuthentication::STATUS_SUCCESS)
            {
                    $session = &JFactory::getSession();
                    // we fork the session to prevent session fixation issues
                    $session->fork();
                    /*
                     * Validate that the user should be able to login (different to being authenticated).
                     * This permits authentication plugins blocking the user.
                     */
                    $authorisations = $authenticate->authorise($response, $options);

在session.php中，将函数fork（）更改为包含

function fork()
    {
            if( $this->_state !== 'active' ) {
                    // @TODO :: generated error here
                    return false;
            }
            // save values
            $values = $_SESSION;
            // keep session config
            /*$trans        =       ini_get( 'session.use_trans_sid' );
            if( $trans ) {
                    ini_set( 'session.use_trans_sid', 0 );
            } */
            $cookie =       session_get_cookie_params();
            // create new session id
            //$id   =       $this->_createId( strlen( $this->getId() ) );
            session_regenerate_id(true);
            $id = session_id();
            // first we grab the session data
            $data = $this->_store->read($this->getId());
            // kill session
            session_destroy();
            // re-register the session store after a session has been destroyed, to avoid PHP bug
            $this->_store->register();
            // restore config
            ini_set( 'session.use_trans_sid', $trans );
            session_set_cookie_params($cookie['lifetime'], $cookie['path'], $cookie['domain'], $cookie['secure'], true);
            // restart session with new id
            session_id( $id );
            //session_regenerate_id(true);
            session_start();
            $_SESSION = $values;
            //now we put the session data back
            $this->_store->write($id, $data);
            return true;
    }

Answer 2

非常感谢@ryadavalli！这很有帮助。使用您建议的解决方案，我为Joomla 2.5解决了它。

只有很少的变化；对于Joomla 2.5，代码需要放置在中

1. libraries/joomla/application/application.php
2. libraries/joomla/session/session.php

在application.phpw.r.t您的解决方案中

public function login($credentials, $options = array())
    {
        // Get the global JAuthentication object.
        jimport('joomla.user.authentication');
        $authenticate = JAuthentication::getInstance();
        $response = $authenticate->authenticate($credentials, $options);
        // Import the user plugin group.
        JPluginHelper::importPlugin('user');
        if ($response->status === JAuthentication::STATUS_SUCCESS)
        {
             $session = &JFactory::getSession();
                    // we fork the session to prevent session fixation issues
             $session->fork();
            // validate that the user should be able to login (different to being authenticated)
            // this permits authentication plugins blocking the user
            $authorisations = $authenticate->authorise($response, $options);

在session.php中，更新代码如下

public function fork()
    {
        if ($this->_state !== 'active')
        {
            // @TODO :: generated error here
            return false;
        }
        // Save values
        $values = $_SESSION;
        // Keep session config
        /*$trans = ini_get('session.use_trans_sid');
        if ($trans)
        {
            ini_set('session.use_trans_sid', 0);
        } */
        $cookie = session_get_cookie_params();
        // Create new session id
        //$id = $this->_createId();
            session_regenerate_id(true);
            $id = session_id();
            // first we grab the session data
            $data = $this->_store->read();
        // Kill session
        session_destroy();
        // Re-register the session store after a session has been destroyed, to avoid PHP bug
        $this->_store->register();
        // Restore config
        ini_set('session.use_trans_sid', $trans);
        session_set_cookie_params($cookie['lifetime'], $cookie['path'], $cookie['domain'], $cookie['secure']);
        // Restart session with new id
        session_id($id);
        session_start();
        $_SESSION = $values;
            //now we put the session data back
            $this->_store->write($id, $data);
        return true;
    }