mirror/php-phpbb
1
0
Fork 0
mirror of https://github.com/phpbb/phpbb.git synced 2025-05-04 22:58:10 +02:00
Code Issues Releases Wiki Activity

Merge pull request #3057 from marc1706/ticket/security-159

Browse Source 
[ticket/security-159] Only show first 8 characters of login keys in UCP
This commit is contained in:
Nils Adermann 2014-10-22 18:20:46 -04:00
commit d7553893c4
1 changed files with 7 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
phpBB/includes/ucp/ucp_profile.php
View File

@ -655,9 +655,14 @@ class ucp_profile
{
if (!empty($keys))
{
foreach ($keys as $key => $id)
{
$keys[$key] = $db->sql_like_expression($id . $db->get_any_char());
}
$sql_where = '(key_id ' . implode(' OR key_id ', $keys) . ')';
$sql = 'DELETE FROM ' . SESSIONS_KEYS_TABLE . '
WHERE user_id = ' . (int) $user->data['user_id'] . '
AND ' . $db->sql_in_set('key_id', $keys) ;
AND ' . $sql_where ;
$db->sql_query($sql);
@ -681,7 +686,7 @@ class ucp_profile
while ($row = $db->sql_fetchrow($result))
{
$template->assign_block_vars('sessions', array(
'KEY' => $row['key_id'],
'KEY' => substr($row['key_id'], 0, 8),
'IP' => $row['last_ip'],
'LOGIN_TIME' => $user->format_date($row['last_login']),
));