zid/my_address can be set to anything after authentication
Created by: waitman
Zotlabs/Web/WebServer.php
$_SESSION['my_address'] = $_GET['zid'];
sets my_address session var to whatever is in the parameter. IMHO if my_address already exists and does not match zid parameter it should kill the authentication and re-authenticate. Otherwise my_address is not trustworthy.
change for review (this seems to work on my install but might break something?)
if((x($_GET,'zid')) && (! \App::$install)) {
\App::$query_string = strip_zids(\App::$query_string);
if(! local_channel()) {
if ((is_array($_GET)) && (array_key_exists('zid',$_GET)) && ($_SESSION['my_address']!=$_GET['zid']))
{
$_SESSION['authenticated']=0;
$_SESSION['my_address'] = $_GET['zid'];
}
zid_init();
}
}