Enforcing sane values for session timeout

diff --git a/com.woltlab.wcf/option.xml b/com.woltlab.wcf/option.xml
index d11a2671b8d93abfcb23f6726242e1f9e48a3f11..0e350e8971ac776abb6617270d55c316434d81d0 100644 (file)
--- a/com.woltlab.wcf/option.xml
+++ b/com.woltlab.wcf/option.xml
@@ -449,7 +449,7 @@ imagick:wcf.acp.option.image_adapter_type.imagick]]>
                                <categoryname>security.general.session</categoryname>
                                <optiontype>integer</optiontype>
                                <defaultvalue>1800</defaultvalue>
-                               <minvalue>1</minvalue>
+                               <minvalue>600</minvalue>
                                <maxvalue>86400</maxvalue>
                        </option>
                        <option name="user_online_timeout">

diff --git a/wcfsetup/install/files/acp/update_com.woltlab.wcf_2.0.1.php b/wcfsetup/install/files/acp/update_com.woltlab.wcf_2.0.1.php
deleted file mode 100644 (file)
index a4e8449..0000000
--- a/wcfsetup/install/files/acp/update_com.woltlab.wcf_2.0.1.php
+++ /dev/null
@@ -1,22 +0,0 @@
-<?php
-use wcf\system\WCF;
-
-/**
- * @author     Alexander Ebert
- * @copyright  2001-2013 WoltLab GmbH
- * @license    GNU Lesser General Public License <http://opensource.org/licenses/lgpl-license.php>
- * @package    com.woltlab.wcf
- * @category   Community Framework
- */
-
-// disable APC if applicable
-$sql = "UPDATE wcf".WCF_N."_option
-       SET     optionValue = ?
-       WHERE   optionName = ?
-               AND optionValue = ?";
-$statement = WCF::getDB()->prepareStatement($sql);
-$statement->execute(array(
-       'disk',
-       'cache_source_type',
-       'apc'
-));

diff --git a/wcfsetup/install/files/acp/update_com.woltlab.wcf_2.0.3.php b/wcfsetup/install/files/acp/update_com.woltlab.wcf_2.0.3.php
new file mode 100644 (file)
index 0000000..937d786
--- /dev/null
+++ b/wcfsetup/install/files/acp/update_com.woltlab.wcf_2.0.3.php
@@ -0,0 +1,20 @@
+<?php
+use wcf\system\WCF;
+
+/**
+ * @author     Alexander Ebert
+ * @copyright  2001-2014 WoltLab GmbH
+ * @license    GNU Lesser General Public License <http://opensource.org/licenses/lgpl-license.php>
+ * @package    com.woltlab.wcf
+ * @category   Community Framework
+ */
+// enforce new limits for session timeout (prevents misconfiguration)
+$sql = "UPDATE wcf".WCF_N."_option
+       SET     optionValue =  MIN(MAX(optionValue, ?), ?)
+       WHERE   optionName = ?";
+$statement = WCF::getDB()->prepareStatement($sql);
+$statement->execute(array(
+       600,
+       86400,
+       'session_timeout'
+));