Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fixed session renew timestamp should be updated when customer changes password #2916

Merged
merged 1 commit into from
Apr 13, 2023
+32 −7
Merged

Fixed session renew timestamp should be updated when customer changes password #2916

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 1 addition & 3 deletions app/code/core/Mage/Checkout/Model/Type/Onepage.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -719,9 +719,7 @@ protected function _prepareNewCustomerQuote()

Mage::helper('core')->copyFieldset('checkout_onepage_quote', 'to_customer', $quote, $customer);
$customer->setPassword($customer->decryptPassword($quote->getPasswordHash()));
$passwordCreatedTime = $this->_checkoutSession->getSessionValidatorData()['session_expire_timestamp']
- Mage::getSingleton('core/cookie')->getLifetime();
$customer->setPasswordCreatedAt($passwordCreatedTime);
$customer->setPasswordCreatedAt(time());
$quote->setCustomer($customer)
->setCustomerId(true);
$quote->setPasswordHash('');
Expand Down
19 changes: 16 additions & 3 deletions app/code/core/Mage/Core/Model/Session/Abstract/Varien.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -423,7 +423,7 @@ public function useValidateSessionExpire()
}

/**
* Use password creation timestamp in validator key
* Password creation timestamp must not be newer than last session renewal
*
* @return bool
*/
Expand Down Expand Up @@ -465,15 +465,27 @@ public function validate()
}

// Refresh expire timestamp
if ($this->useValidateSessionExpire()) {
$_SESSION[self::VALIDATOR_KEY][self::VALIDATOR_SESSION_RENEW_TIMESTAMP] = time();
if ($this->useValidateSessionExpire() || $this->useValidateSessionPasswordTimestamp()) {
$this->setValidatorSessionRenewTimestamp(time());
$_SESSION[self::VALIDATOR_KEY][self::VALIDATOR_SESSION_LIFETIME] = $this->getCookie()->getLifetime();
}
}

return $this;
}

/**
* Update the session's last legitimate renewal time (call when customer password is updated to avoid
* being logged out)
*
* @param int $timestamp
* @return void
*/
public function setValidatorSessionRenewTimestamp($timestamp)
{
$_SESSION[self::VALIDATOR_KEY][self::VALIDATOR_SESSION_RENEW_TIMESTAMP] = $timestamp;
}

/**
* Validate data
*
Expand Down Expand Up @@ -563,6 +575,7 @@ public function getValidatorData()
$parts[self::VALIDATOR_HTTP_USER_AGENT_KEY] = (string)$_SERVER['HTTP_USER_AGENT'];
}

// get time when password was last changed
if (isset($this->_data['visitor_data']['customer_id'])) {
$parts[self::VALIDATOR_PASSWORD_CREATE_TIMESTAMP] =
Mage::helper('customer')->getPasswordTimestamp($this->_data['visitor_data']['customer_id']);
Expand Down
16 changes: 15 additions & 1 deletion app/code/core/Mage/Customer/Model/Customer.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -79,7 +79,6 @@
* @method string getPasswordConfirmation()
* @method $this setPasswordConfirmation(string $value)
* @method int getPasswordCreatedAt()
* @method $this setPasswordCreatedAt(int $value)
* @method string getPasswordHash()
* @method $this setPasswordHash(string $value)
* @method string getPrefix()
Expand Down Expand Up @@ -327,6 +326,21 @@ public function changePassword($newPassword)
return $this;
}

/**
* Set time when password was changed to invalidate other sessions
*
* @param int $time
* @return $this
*/
public function setPasswordCreatedAt($time)
{
$this->setData('password_created_at', $time);
if (session_status() === PHP_SESSION_ACTIVE) {
Mage::getSingleton('checkout/session')->setValidatorSessionRenewTimestamp($time);
}
return $this;
}

/**
* Get full customer name
*
Expand Down