Give editors a new session id when they log in.

publish/login.php

@@ -32,7 +32,7 @@ if (isset($_SESSION['editor'])) {
   if (!password_verify($compare_password, $stored_password)) {
     $denied = TRUE;
   } else {
-    $_SESSION['editor'] = $username; 
+    login_editor($username);
     // Keep user logged in with cookie, if they request it
     if (isset($_POST['remember'])) {
       create_persistent_login($username);

session.lib.php

@@ -46,7 +46,7 @@ function check_persistent_login() {
     $stored_session = $row['session'];
     if ($stored_session == $key) {
       // login
-      $_SESSION['editor'] = $username; 
+      login_editor($username);
       // delete cookie
       delete_persistent_login();
       // create new cookie
@@ -122,3 +122,13 @@ function csrf_valid($token = NULL) {
   return is_string($token) && isset($_SESSION['csrf_token']) &&
          hash_equals((string)$_SESSION['csrf_token'], $token);
 }
+
+/*
+ * Log an editor in under a new session id, so that a session id that
+ * someone planted or saw before the login is of no use afterwards.
+ */
+function login_editor($username) {
+  session_regenerate_id(TRUE);
+  unset($_SESSION['csrf_token']);
+  $_SESSION['editor'] = $username;
+}