Question

这可能导致的影响：可以窃取或操纵客户会话和Cookie，这可能会用来冒充合法用户，允许黑客查看或更改用户记录，以及以该用户身份执行交易。

防止会话固定攻击的推荐解决方案是在用户登录时更新会话ID。此修复可以在代码级别或框架级别完成，具体取决于会话管理功能的实现位置。

我试图找到一个解决方案但仍然没有成功。任何人都可以帮助如何在Joomla 2.5中解决这个问题？

我想在框架级别实现此修复。任何帮助将不胜感激。

Answer 1

我为Joomla 3.x版本做了这个。它应该在2.5中类似。您应修改2个文件以使其工作。

库/ CMS /应用/ cms.php
库/的Joomla /会话/ session.php文件

在cms.php中修改函数login

 // Import the user plugin group.
            JPluginHelper::importPlugin('user');

            if ($response->status === JAuthentication::STATUS_SUCCESS)
            {
                    $session = &JFactory::getSession();
                    // we fork the session to prevent session fixation issues
                    $session->fork();

                    /*
                     * Validate that the user should be able to login (different to being authenticated).
                     * This permits authentication plugins blocking the user.
                     */
                    $authorisations = $authenticate->authorise($response, $options);

将函数fork（）更改为include

function fork()
    {
            if( $this->_state !== 'active' ) {
                    // @TODO :: generated error here
                    return false;
            }

            // save values
            $values = $_SESSION;

            // keep session config
            /*$trans        =       ini_get( 'session.use_trans_sid' );
            if( $trans ) {
                    ini_set( 'session.use_trans_sid', 0 );
            } */
            $cookie =       session_get_cookie_params();
            // create new session id
            //$id   =       $this->_createId( strlen( $this->getId() ) );
            session_regenerate_id(true);
            $id = session_id();

            // first we grab the session data
            $data = $this->_store->read($this->getId());

            // kill session
            session_destroy();

            // re-register the session store after a session has been destroyed, to avoid PHP bug
            $this->_store->register();

            // restore config
            ini_set( 'session.use_trans_sid', $trans );
            session_set_cookie_params($cookie['lifetime'], $cookie['path'], $cookie['domain'], $cookie['secure'], true);

            // restart session with new id
            session_id( $id );
            //session_regenerate_id(true);
            session_start();
            $_SESSION = $values;

            //now we put the session data back
            $this->_store->write($id, $data);
            return true;
    }

Answer 2

非常感谢@ryadavalli！这非常有帮助。使用您建议的解决方案，我为Joomla 2.5解决了它。

只有少数变化;对于Joomla 2.5，代码需要放在

中

库/的Joomla /应用/ application.php
库/的Joomla /会话/ session.php文件

在 application.php w.r.t您的解决方案

public function login($credentials, $options = array())
    {
        // Get the global JAuthentication object.
        jimport('joomla.user.authentication');

        $authenticate = JAuthentication::getInstance();
        $response = $authenticate->authenticate($credentials, $options);

        // Import the user plugin group.
        JPluginHelper::importPlugin('user');

        if ($response->status === JAuthentication::STATUS_SUCCESS)
        {
             $session = &JFactory::getSession();
                    // we fork the session to prevent session fixation issues
             $session->fork();
            // validate that the user should be able to login (different to being authenticated)
            // this permits authentication plugins blocking the user
            $authorisations = $authenticate->authorise($response, $options);

在 session.php 中，更新了以下代码

public function fork()
    {
        if ($this->_state !== 'active')
        {
            // @TODO :: generated error here
            return false;
        }

        // Save values
        $values = $_SESSION;

        // Keep session config
        /*$trans = ini_get('session.use_trans_sid');
        if ($trans)
        {
            ini_set('session.use_trans_sid', 0);
        } */
        $cookie = session_get_cookie_params();

        // Create new session id
        //$id = $this->_createId();

            session_regenerate_id(true);
            $id = session_id();

            // first we grab the session data
            $data = $this->_store->read();

        // Kill session
        session_destroy();

        // Re-register the session store after a session has been destroyed, to avoid PHP bug
        $this->_store->register();

        // Restore config
        ini_set('session.use_trans_sid', $trans);
        session_set_cookie_params($cookie['lifetime'], $cookie['path'], $cookie['domain'], $cookie['secure']);

        // Restart session with new id
        session_id($id);
        session_start();

        $_SESSION = $values;

            //now we put the session data back
            $this->_store->write($id, $data);

        return true;
    }

会话固定在Joomla 2.5

2 个答案: