yiisoft/yii — Issue #384: CWebUser->changeIdentity does not remove previous session
Author: felix-sigac
Created: 2012-02-22 08:33:02+00:00
State: open

By default, the class CWebUser doesn't clean previous session if the changeIdentity method is called:

protected function changeIdentity($id,$name,$states)
{
Yii::app()->getSession()->regenerateID();
$this->setId($id);
$this->setName($name);
$this->loadIdentityStates($states);
}

This makes a serious security flaw, and a performance issue, because a session file remains in the server but is not more used. This could be fixed adding a config variable to CWebUser, or by default, removing the previous session:

protected function changeIdentity($id,$name,$states)
{
Yii::app()->getSession()->regenerateID($deletePreviouSession);
// or Yii::app()->getSession()->regenerateID(true);
$this->setId($id);
$this->setName($name);
$this->loadIdentityStates($states);
}