From 9e9e047e4e3141620f2d6f2ebea35a89a7b9799b Mon Sep 17 00:00:00 2001
From: Alexander Ebert <ebert@woltlab.com>
Date: Wed, 26 Feb 2014 13:30:58 +0100
Subject: [PATCH] Enforcing sane values for session timeout

---
 com.woltlab.wcf/option.xml                       |  2 +-
 ....0.1.php => update_com.woltlab.wcf_2.0.3.php} | 16 +++++++---------
 2 files changed, 8 insertions(+), 10 deletions(-)
 rename wcfsetup/install/files/acp/{update_com.woltlab.wcf_2.0.1.php => update_com.woltlab.wcf_2.0.3.php} (61%)

diff --git a/com.woltlab.wcf/option.xml b/com.woltlab.wcf/option.xml
index d11a2671b8..0e350e8971 100644
--- a/com.woltlab.wcf/option.xml
+++ b/com.woltlab.wcf/option.xml
@@ -449,7 +449,7 @@ imagick:wcf.acp.option.image_adapter_type.imagick]]>
 				<categoryname>security.general.session</categoryname>
 				<optiontype>integer</optiontype>
 				<defaultvalue>1800</defaultvalue>
-				<minvalue>1</minvalue>
+				<minvalue>600</minvalue>
 				<maxvalue>86400</maxvalue>
 			</option>
 			<option name="user_online_timeout">
diff --git a/wcfsetup/install/files/acp/update_com.woltlab.wcf_2.0.1.php b/wcfsetup/install/files/acp/update_com.woltlab.wcf_2.0.3.php
similarity index 61%
rename from wcfsetup/install/files/acp/update_com.woltlab.wcf_2.0.1.php
rename to wcfsetup/install/files/acp/update_com.woltlab.wcf_2.0.3.php
index a4e8449455..937d786032 100644
--- a/wcfsetup/install/files/acp/update_com.woltlab.wcf_2.0.1.php
+++ b/wcfsetup/install/files/acp/update_com.woltlab.wcf_2.0.3.php
@@ -3,20 +3,18 @@ use wcf\system\WCF;
 
 /**
  * @author	Alexander Ebert
- * @copyright	2001-2013 WoltLab GmbH
+ * @copyright	2001-2014 WoltLab GmbH
  * @license	GNU Lesser General Public License <http://opensource.org/licenses/lgpl-license.php>
  * @package	com.woltlab.wcf
  * @category	Community Framework
  */
-
-// disable APC if applicable
+// enforce new limits for session timeout (prevents misconfiguration)
 $sql = "UPDATE	wcf".WCF_N."_option
-	SET	optionValue = ?
-	WHERE	optionName = ?
-		AND optionValue = ?";
+	SET	optionValue =  MIN(MAX(optionValue, ?), ?)
+	WHERE	optionName = ?";
 $statement = WCF::getDB()->prepareStatement($sql);
 $statement->execute(array(
-	'disk',
-	'cache_source_type',
-	'apc'
+	600,
+	86400,
+	'session_timeout'
 ));
-- 
2.20.1