Skip to content

prevent 'my_address' being set with bogus info

Mario requested to merge waitman:patch-4 into dev

Created by: waitman

After a user has authenticated, it is possible to set my_address in $_SESSION to 'anything' using zid= parameter in URL - if user is authenticated then zid is never validated but the session variable is updated. This change kills the authenticated switch if a person sends a new zid through for processing, which will trigger remote authentication.

Merge request reports