Fixed session fixation vulnerability (issue 62)

diff --git a/docs/04_releases.mkd b/docs/04_releases.mkd
index e1dcb40025ad5564ebd697a86fa9143df19b3ebd..2b64eaed66570b5a9b250eec8438f410644fdfc5 100644 (file)
--- a/docs/04_releases.mkd
+++ b/docs/04_releases.mkd
@@ -4,6 +4,10 @@
 \r
 **%VERSION%** ([go](http://code.google.com/p/gitblit/downloads/detail?name=%GO%) | [war](http://code.google.com/p/gitblit/downloads/detail?name=%WAR%) | [express](http://code.google.com/p/gitblit/downloads/detail?name=%EXPRESS%) | [fedclient](http://code.google.com/p/gitblit/downloads/detail?name=%FEDCLIENT%) | [manager](http://code.google.com/p/gitblit/downloads/detail?name=%MANAGER%) | [api](http://code.google.com/p/gitblit/downloads/detail?name=%API%)) based on [%JGIT%][jgit]   *released %BUILDDATE%*\r
 \r
+#### security\r
+\r
+- Fixed session fixation vulnerability where the session identifier was not reset during the login process (issue 62)\r
+\r
 #### changes\r
 \r
 - block pushes to a repository with a working copy (i.e. non-bare repository) (issue-49)\r

diff --git a/src/com/gitblit/wicket/pages/BasePage.java b/src/com/gitblit/wicket/pages/BasePage.java
index 80bff16781d731c7e0d6631a6981476cb6d1de83..ca9400713cea400d88cdb99b39beaebe025bf00a 100644 (file)
--- a/src/com/gitblit/wicket/pages/BasePage.java
+++ b/src/com/gitblit/wicket/pages/BasePage.java
@@ -80,7 +80,10 @@ public abstract class BasePage extends WebPage {
                // Login the user\r
                if (user != null) {\r
                        // Set the user into the session\r
-                       GitBlitWebSession.get().setUser(user);\r
+                       GitBlitWebSession session = GitBlitWebSession.get();\r
+                       // issue 62: fix session fixation vulnerability\r
+                       session.replaceSession();\r
+                       session.setUser(user);\r
 \r
                        // Set Cookie\r
                        WebResponse response = (WebResponse) getRequestCycle().getResponse();\r

diff --git a/src/com/gitblit/wicket/pages/RootPage.java b/src/com/gitblit/wicket/pages/RootPage.java
index cbf9cfe1aa39ffb293d2182b24c5a311ce5eef71..bad0140b7b5a452b4cbaa5428653859fc4999086 100644 (file)
--- a/src/com/gitblit/wicket/pages/RootPage.java
+++ b/src/com/gitblit/wicket/pages/RootPage.java
@@ -195,7 +195,10 @@ public abstract class RootPage extends BasePage {
        private void loginUser(UserModel user) {\r
                if (user != null) {\r
                        // Set the user into the session\r
-                       GitBlitWebSession.get().setUser(user);\r
+                       GitBlitWebSession session = GitBlitWebSession.get();\r
+                       // issue 62: fix session fixation vulnerability\r
+                       session.replaceSession();\r
+                       session.setUser(user);\r
 \r
                        // Set Cookie\r
                        if (GitBlit.getBoolean(Keys.web.allowCookieAuthentication, false)) {\r