Wikia/app — pull request #4741 by Grunny (2014-09-11 15:55:15+00:00)
Title: (CE-1030) Add support for "stay logged in" to RestrictSessions

Adds support for the "stay logged in" login option to RestrictSessions.
This option sets a token cookie which is checked against the user's
current token to determine whether or not to restore the session data
from the cookie. This cookie is only set on the login request as part
of User::setCookies.

In this change, if the user is staff and this cookie is set and matches
the user token but the session isn't set, we set the current IP on the
session.

This change also prevents staff sessions from being restored from
just a session cookie. At present, the session can be restored from
just the session cookie, even if none of the user cookies set on
login are available.

In order to compare the cookie in a way that isn't vulnerable to timing
attacks, I backported the PHP 5.6 shim for the hash_equals function from
the current version of MediaWiki. This can also be used elsewhere if
needed.

@michalroszka