Regenerate the session id every time through login::_auth() to avoid session trapping.

1 files changed, 3 insertions, 0 deletions

diff --git a/modules/user/controllers/login.php b/modules/user/controllers/login.php
index 7853f725..6ee2e69d 100644
--- a/modules/user/controllers/login.php
+++ b/modules/user/controllers/login.php
@@ -69,6 +69,9 @@ class Login_Controller extends Controller {
       log::info("user", t("User %name logged in", array("name" => $user->name)));
     }
 
+    // Either way, regenerate the session id to avoid session trapping
+    Session::instance()->regenerate();
+
     return array($valid, $form);
   }
 }
\ No newline at end of file