Changeset 370

Timestamp:

May 11, 2010 10:28:59 PM (14 years ago)

Author:

quinn

Message:

Now logging all remote-ip mismatch errors, even if in a trusted network.

File:

• trunk/lib/Auth_SQL.inc.php (modified) (2 diffs)

trunk/lib/Auth_SQL.inc.php

@@ -551 +551 @@
         $this->_authentication_tested = true;
 
-        // Some users will access from networks with a changing IP number (i.e. behind a proxy server). These users must be allowed entry by adding their IP to the list of trusted_networks.
+        // Some users will access from networks with a changing IP number (i.e. behind a proxy server). 
+        // These users must be allowed entry by adding their IP to the list of trusted_networks, or their usernames to the list of match_remote_ip_exempt_usernames.
         if ($trusted_net = ipInRange(getRemoteAddr(), $this->_params['trusted_networks'])) {
             $user_in_trusted_network = true;
@@ -621 +622 @@
                 $expire_reasons[] = 'idle_timeout expired';
             }
-            if ($_SESSION['_auth_sql'][$this->_ns]['remote_ip'] != getRemoteAddr() && !$user_in_trusted_network) {
-                if ($this->getParam('match_remote_ip') && !$this->get('match_remote_ip_exempt')) {
+            if ($_SESSION['_auth_sql'][$this->_ns]['remote_ip'] != getRemoteAddr()) {
+                if ($this->getParam('match_remote_ip') && !$this->get('match_remote_ip_exempt') && !$user_in_trusted_network) {
+                    // There are three cases when a remote IP match will be the cause of a session termination:
+                    //   1. match_remote_ip config is enabled
+                    //   2. user is not match_remote_ip_exempt (set in the user_data, or in the match_remote_ip_exempt_usernames list)
+                    //   3. the user is connecting from a trusted network (their IP is listed in the trusted_networks or from *.proxy.aol.com)
                     $expire_reasons[] = sprintf('remote_ip not matched (%s != %s)', $_SESSION['_auth_sql'][$this->_ns]['remote_ip'], getRemoteAddr());
                 } else {