From 36c7fe97c569c634f9c710f87e846a4ff5a48e91 Mon Sep 17 00:00:00 2001
From: Timothy Allen <tim@treehouse.org.za>
Date: Fri, 25 Sep 2026 21:39:06 +0200
Subject: [PATCH] Give editors a new session id when they log in.

---
 publish/login.php |  2 +-
 session.lib.php   | 12 +++++++++++-
 2 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/publish/login.php b/publish/login.php
index da88274..10e3375 100644
--- a/publish/login.php
+++ b/publish/login.php
@@ -32,7 +32,7 @@ if (isset($_SESSION['editor'])) {
   if (!password_verify($compare_password, $stored_password)) {
     $denied = TRUE;
   } else {
-    $_SESSION['editor'] = $username; 
+    login_editor($username);
     // Keep user logged in with cookie, if they request it
     if (isset($_POST['remember'])) {
       create_persistent_login($username);
diff --git a/session.lib.php b/session.lib.php
index 07c6055..9f0f6b2 100644
--- a/session.lib.php
+++ b/session.lib.php
@@ -46,7 +46,7 @@ function check_persistent_login() {
     $stored_session = $row['session'];
     if ($stored_session == $key) {
       // login
-      $_SESSION['editor'] = $username; 
+      login_editor($username);
       // delete cookie
       delete_persistent_login();
       // create new cookie
@@ -122,3 +122,13 @@ function csrf_valid($token = NULL) {
   return is_string($token) && isset($_SESSION['csrf_token']) &&
          hash_equals((string)$_SESSION['csrf_token'], $token);
 }
+
+/*
+ * Log an editor in under a new session id, so that a session id that
+ * someone planted or saw before the login is of no use afterwards.
+ */
+function login_editor($username) {
+  session_regenerate_id(TRUE);
+  unset($_SESSION['csrf_token']);
+  $_SESSION['editor'] = $username;
+}