<?php
class sessions {
function sessions_page_start ( ) {
session_start ( );
if ( $_SESSION[username] ) {
$this->sessions_check ( );
}
}
function sessions_check ( ) {
global $db; // database class (uses one almost the same as phpbb 2.x
global $REMOTE_ADDR; // users ip
$sql = "select `username` from " . USERS_TABLE . " where `username` = '" . $_SESSION[username] . "' AND `ses_id` = '" . md5 ( session_id ( ) . $_SESSION[loged_in_time] . $REMOTE_ADDR ) . "'";
$result = $db->query($sql); // mysql query
if( !$db->numrows ( $result ) ) { // delete the session(log them out) if the ses_id doesn't match the usernames. Prevents session jacking.
$this->sessions_logout ( );
}
}
function sessions_logout ( ) {
unset ( $_SESSION[username] );
unset ( $_SESSION[loged_in_time] );
session_destroy ( );
}
function sessions_login ( $username, $password ) {
global $db;
global $REMOTE_ADDR;
if ( isset ( $username ) and isset ( $password ) ) { // checks username and password was sent to the function.
$_SESSION[username] = $username; // sets the username for the session.
$_SESSION[loged_in_time] = time ( ); // sets the time of log in, this is needed for session checking.
$sql = sprintf ( "update " . USERS_TABLE . " set `ses_id` = '" . md5( session_id ( ) . $_SESSION[loged_in_time] . $REMOTE_ADDR ) . "' where username='%s' AND password = '%s'", addslashes ( $username) , addslashes ( $password ) ); // updates the session ses_id.
$result = $db->query($sql);
}
}
}
?>
