diff --git a/application/config/config.sample.php b/application/config/config.sample.php index 2e0c2fbef..3496763c5 100644 --- a/application/config/config.sample.php +++ b/application/config/config.sample.php @@ -439,7 +439,8 @@ $config['encryption_key'] = 'flossie1234555541'; | 'sess_expiration' | | The number of SECONDS you want the session to last. -| Minimum is 43200 seconds (12 hours) for security reasons. +| Default: 43200 seconds (12 hours). +| Setting to 0 means use the default value of 43200 seconds (12 hours). | | 'sess_save_path' | diff --git a/install/config/config.php b/install/config/config.php index 38255098b..8f323063a 100644 --- a/install/config/config.php +++ b/install/config/config.php @@ -439,7 +439,8 @@ $config['encryption_key'] = '%encryptionkey%'; | 'sess_expiration' | | The number of SECONDS you want the session to last. -| Minimum is 43200 seconds (12 hours) for security reasons. +| Default: 43200 seconds (12 hours). +| Setting to 0 means use the default value of 43200 seconds (12 hours). | | 'sess_save_path' | diff --git a/system/libraries/Session/Session.php b/system/libraries/Session/Session.php index 0d64c34ab..d0c795af9 100644 --- a/system/libraries/Session/Session.php +++ b/system/libraries/Session/Session.php @@ -244,7 +244,9 @@ class CI_Session { */ protected function _configure(&$params) { - // We force a minimum expiration time of 43200 seconds (12 hours) for security reasons + // We force a minimum expiration time of 43200 seconds (12 hours) for security reasons in case + // the config value is set to 0. This prevents hijacking of sessions on shared computers over a long period of time. + // Lower values then 43200 seconds are still allowed, but 0 is not. $expiration = config_item('sess_expiration') == 0 ? 43200 : config_item('sess_expiration'); if (isset($params['cookie_lifetime']))