Joomla 2.5 中的会话固定

Question

这可能导致的影响： 可能会窃取或操纵客户会话和 cookie，它们可能被用来冒充合法用户，允许黑客查看或更改用户记录，以及以该用户身份执行交易。

建议的防止会话固定攻击的解决方案是在用户登录时更新会话 ID。此修复可以在代码级别或框架级别完成，具体取决于实现会话管理功能的位置。

我正在尝试解决这个问题，但我仍然没有成功。任何人都可以帮助如何在 Joomla 2.5 中解决这个问题？

我想在框架级别实施此修复。任何帮助将不胜感激。

Answer 1

我为 Joomla 3.x 版本做了这个。在 2.5 中应该是类似的。 您应该修改 2 个文件以使其正常工作。

1. 库/cms/application/cms.php

2. 库/joomla/session/session.php

在cms.php中修改登录功能

 // Import the user plugin group.
            JPluginHelper::importPlugin('user');

            if ($response->status === JAuthentication::STATUS_SUCCESS)
            {
                    $session = &JFactory::getSession();
                    // we fork the session to prevent session fixation issues
                    $session->fork();

                    /*
                     * Validate that the user should be able to login (different to being authenticated).
                     * This permits authentication plugins blocking the user.
                     */
                    $authorisations = $authenticate->authorise($response, $options);

在 session.php 中更改函数 fork() 以包含

function fork()
    {
            if( $this->_state !== 'active' ) {
                    // @TODO :: generated error here
                    return false;
            }

            // save values
            $values = $_SESSION;

            // keep session config
            /*$trans        =       ini_get( 'session.use_trans_sid' );
            if( $trans ) {
                    ini_set( 'session.use_trans_sid', 0 );
            } */
            $cookie =       session_get_cookie_params();
            // create new session id
            //$id   =       $this->_createId( strlen( $this->getId() ) );
            session_regenerate_id(true);
            $id = session_id();

            // first we grab the session data
            $data = $this->_store->read($this->getId());

            // kill session
            session_destroy();

            // re-register the session store after a session has been destroyed, to avoid PHP bug
            $this->_store->register();

            // restore config
            ini_set( 'session.use_trans_sid', $trans );
            session_set_cookie_params($cookie['lifetime'], $cookie['path'], $cookie['domain'], $cookie['secure'], true);

            // restart session with new id
            session_id( $id );
            //session_regenerate_id(true);
            session_start();
            $_SESSION = $values;

            //now we put the session data back
            $this->_store->write($id, $data);
            return true;
    }

Answer 2

非常感谢@ryadavalli！这是非常有帮助的。使用您建议的解决方案，我为 Joomla 2.5 解决了它。

只有很少的变化；对于 Joomla 2.5，代码需要放在

1. 库/joomla/application/application.php
2. 库/joomla/session/session.php

在 application.php 中 w.r.t 您的解决方案

public function login($credentials, $options = array())
    {
        // Get the global JAuthentication object.
        jimport('joomla.user.authentication');

        $authenticate = JAuthentication::getInstance();
        $response = $authenticate->authenticate($credentials, $options);

        // Import the user plugin group.
        JPluginHelper::importPlugin('user');

        if ($response->status === JAuthentication::STATUS_SUCCESS)
        {
             $session = &JFactory::getSession();
                    // we fork the session to prevent session fixation issues
             $session->fork();
            // validate that the user should be able to login (different to being authenticated)
            // this permits authentication plugins blocking the user
            $authorisations = $authenticate->authorise($response, $options);

在session.php中，更新代码如下

public function fork()
    {
        if ($this->_state !== 'active')
        {
            // @TODO :: generated error here
            return false;
        }

        // Save values
        $values = $_SESSION;

        // Keep session config
        /*$trans = ini_get('session.use_trans_sid');
        if ($trans)
        {
            ini_set('session.use_trans_sid', 0);
        } */
        $cookie = session_get_cookie_params();

        // Create new session id
        //$id = $this->_createId();

            session_regenerate_id(true);
            $id = session_id();

            // first we grab the session data
            $data = $this->_store->read();

        // Kill session
        session_destroy();

        // Re-register the session store after a session has been destroyed, to avoid PHP bug
        $this->_store->register();

        // Restore config
        ini_set('session.use_trans_sid', $trans);
        session_set_cookie_params($cookie['lifetime'], $cookie['path'], $cookie['domain'], $cookie['secure']);

        // Restart session with new id
        session_id($id);
        session_start();

        $_SESSION = $values;

            //now we put the session data back
            $this->_store->write($id, $data);

        return true;
    }