mirror of
https://github.com/magicbug/Cloudlog
synced 2026-08-13 17:49:35 -04:00
5a44ef4b4e
Replace hardcoded encryption key in installer with a %encryption_key% placeholder and generate a unique per-install key during installation (uses random_bytes, falls back to openssl_random_pseudo_bytes or sha1(uniqid)). Inject the generated key into config.php. Also tighten User_Model::validate_session(): return early if no user_id, clear session if user_hash is missing, re-read the user from the database to verify user_type before authenticating, and refresh or clear the session accordingly. These changes improve security by using a unique encryption key per install and by validating session state against persisted user data. |
||
|---|---|---|
| .. | ||
| core_class.php | ||
| database_class.php | ||