From: Alexander Ebert <ebert@woltlab.com>
Date: Wed, 26 Feb 2014 12:30:58 +0000 (+0100)
Subject: Enforcing sane values for session timeout
X-Git-Tag: 2.0.3~10^2~4
X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=9e9e047e4e3141620f2d6f2ebea35a89a7b9799b;p=GitHub%2FWoltLab%2FWCF.git

Enforcing sane values for session timeout
---

diff --git a/com.woltlab.wcf/option.xml b/com.woltlab.wcf/option.xml
index d11a2671b8..0e350e8971 100644
--- a/com.woltlab.wcf/option.xml
+++ b/com.woltlab.wcf/option.xml
@@ -449,7 +449,7 @@ imagick:wcf.acp.option.image_adapter_type.imagick]]>
 				<categoryname>security.general.session</categoryname>
 				<optiontype>integer</optiontype>
 				<defaultvalue>1800</defaultvalue>
-				<minvalue>1</minvalue>
+				<minvalue>600</minvalue>
 				<maxvalue>86400</maxvalue>
 			</option>
 			<option name="user_online_timeout">
diff --git a/wcfsetup/install/files/acp/update_com.woltlab.wcf_2.0.1.php b/wcfsetup/install/files/acp/update_com.woltlab.wcf_2.0.1.php
deleted file mode 100644
index a4e8449455..0000000000
--- a/wcfsetup/install/files/acp/update_com.woltlab.wcf_2.0.1.php
+++ /dev/null
@@ -1,22 +0,0 @@
-<?php
-use wcf\system\WCF;
-
-/**
- * @author	Alexander Ebert
- * @copyright	2001-2013 WoltLab GmbH
- * @license	GNU Lesser General Public License <http://opensource.org/licenses/lgpl-license.php>
- * @package	com.woltlab.wcf
- * @category	Community Framework
- */
-
-// disable APC if applicable
-$sql = "UPDATE	wcf".WCF_N."_option
-	SET	optionValue = ?
-	WHERE	optionName = ?
-		AND optionValue = ?";
-$statement = WCF::getDB()->prepareStatement($sql);
-$statement->execute(array(
-	'disk',
-	'cache_source_type',
-	'apc'
-));
diff --git a/wcfsetup/install/files/acp/update_com.woltlab.wcf_2.0.3.php b/wcfsetup/install/files/acp/update_com.woltlab.wcf_2.0.3.php
new file mode 100644
index 0000000000..937d786032
--- /dev/null
+++ b/wcfsetup/install/files/acp/update_com.woltlab.wcf_2.0.3.php
@@ -0,0 +1,20 @@
+<?php
+use wcf\system\WCF;
+
+/**
+ * @author	Alexander Ebert
+ * @copyright	2001-2014 WoltLab GmbH
+ * @license	GNU Lesser General Public License <http://opensource.org/licenses/lgpl-license.php>
+ * @package	com.woltlab.wcf
+ * @category	Community Framework
+ */
+// enforce new limits for session timeout (prevents misconfiguration)
+$sql = "UPDATE	wcf".WCF_N."_option
+	SET	optionValue =  MIN(MAX(optionValue, ?), ?)
+	WHERE	optionName = ?";
+$statement = WCF::getDB()->prepareStatement($sql);
+$statement->execute(array(
+	600,
+	86400,
+	'session_timeout'
+));