Language: PHP
Label: vulnerable
CWE: CWE-384 \u2014 Session Fixation
Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.

Code:
    public function testLogin()
    {
        $email    = 'email@domain.com';
        $password = 'pass';
        $ip       = '127.0.0.1';

        $admin = new \Model_Admin();
        $admin->loadBean(new \DummyBean());
        $admin->id    = 1;
        $admin->email = $email;
        $admin->name  = 'Admin';
        $admin->role  = 'admin';


        $emMock = $this->getMockBuilder('\Box_EventManager')
            ->getMock();
        $emMock->expects($this->atLeastOnce())
            ->method('fire')
            ->will($this->returnValue(true));

        $dbMock = $this->getMockBuilder('\Box_Database')
            ->getMock();
        $dbMock->expects($this->atLeastOnce())
            ->method('findOne')
            ->will($this->returnValue($admin));

        $sessionMock = $this->getMockBuilder('\Box_Session')
            ->disableOriginalConstructor()
            ->getMock();
        $sessionMock->expects($this->atLeastOnce())
            ->method('set')
            ->will($this->returnValue(null));

        $authMock = $this->getMockBuilder('\Box_Authorization')->disableOriginalConstructor()->getMock();
        $authMock->expects($this->atLeastOnce())
            ->method('authorizeUser')
            ->with($admin, $password)
            ->willReturn($admin);

        $di                   = new \Pimple\Container();
        $di['events_manager'] = $emMock;
        $di['db']             = $dbMock;
        $di['session']        = $sessionMock;
        $di['logger']         = new \Box_Log();
        $di['auth']           = $authMock;

        $service = new \Box\Mod\Staff\Service();
        $service->setDi($di);

        $result = $service->login($email, $password, $ip);

        $expected = array(
            'id'    => 1,
            'email' => $email,
            'name'  => 'Admin',
            'role'  => 'admin',
        );

        $this->assertEquals($expected, $result);
    }