fixes #945 - Piwik sets the session.name to 'PIWIK_SESSID'; define('PIWIK_SESSION_NAME', ...) in bootstrap.php to override; session namespaces now prefixed by Piwik_. We regenerate session ID at login/logout to mitigate session fixation attacks.

git-svn-id: http://dev.piwik.org/svn/trunk@1460 59fd770c-687e-43c8-a1e3-f5a4ff64c105

1 files changed, 5 insertions, 0 deletions

diff --git a/index.php b/index.php
index e613bb7741..01529119bf 100644
--- a/index.php
+++ b/index.php
@@ -14,6 +14,11 @@ if(file_exists('bootstrap.php'))
 	require_once 'bootstrap.php';
 }
 
+if(!defined('PIWIK_SESSION_NAME'))
+{
+	define('PIWIK_SESSION_NAME', 'PIWIK_SESSID');
+}
+@ini_set('session.name', PIWIK_SESSION_NAME);
 error_reporting(E_ALL|E_NOTICE);
 if(!defined('PIWIK_DISPLAY_ERRORS') || PIWIK_DISPLAY_ERRORS)
 {