|
楼主 |
发表于 2013-6-8 12:00:29
|
显示全部楼层
本帖最后由 sfks8282 于 2013-6-8 12:35 编辑
if ($this->sess_encrypt_cookie == TRUE)//用加密方式正常
{
$session = $this->CI->encrypt->decode($session);
}
else//非加密方式有问题,字符串一样,但是MD5值不同。。。
{
// encryption was not used, so we need to check the md5 hash
$hash = substr($session, strlen($session)-32); // get last 32 chars
$session = substr($session, 0, strlen($session)-32);
// Does the md5 hash match? This is to prevent manipulation of session data in userspace
if ($hash !== md5($session.$this->encryption_key))//这里不相等
{
log_message('error', 'The session cookie data did not match what was expected. This could be a possible hacking attempt.');
$this->sess_destroy();
return FALSE;
}
} |
|