AutoLogin: Check the remote username against logged in user

fixes #6462
Icinga · Jul 30, 2014 · 56a2935 · 56a2935
1 parent e2c761a
commit 56a2935
Showing 1 changed file with 7 additions and 0 deletions.
diff --git a/library/Icinga/Authentication/Manager.php b/library/Icinga/Authentication/Manager.php
@@ -111,6 +111,13 @@ public function persistCurrentUser()
     public function authenticateFromSession()
     {
         $this->user = Session::getSession()->get('user');
+
+        if ($this->user !== null && $this->user->isRemoteUser() === true) {
+            list($originUsername, $field) = $this->user->getRemoteUserInformation();
+            if (array_key_exists($field, $_SERVER) && $_SERVER[$field] !== $originUsername) {
+                $this->removeAuthorization();
+            }
+        }
     }
 
     /**