diff --git a/lib/Cleantalk/ApbctWP/Variables/AltSessions.php b/lib/Cleantalk/ApbctWP/Variables/AltSessions.php index 9e68edeb3..b46b1628d 100644 --- a/lib/Cleantalk/ApbctWP/Variables/AltSessions.php +++ b/lib/Cleantalk/ApbctWP/Variables/AltSessions.php @@ -54,9 +54,9 @@ class AltSessions public static function getID() { + // Accept-Language is omitted: XHR and document POST often send different headers. $id = Helper::ipGet() - . Server::getString('HTTP_USER_AGENT') - . Server::getString('HTTP_ACCEPT_LANGUAGE'); + . Server::getString('HTTP_USER_AGENT'); return substr(hash('sha256', $id), -16); } diff --git a/tests/ApbctWP/Variables/TestAltSessionsGetID.php b/tests/ApbctWP/Variables/TestAltSessionsGetID.php new file mode 100644 index 000000000..f312873b9 --- /dev/null +++ b/tests/ApbctWP/Variables/TestAltSessionsGetID.php @@ -0,0 +1,69 @@ +serverBackup = $_SERVER; + Server::getInstance()->variables = array(); + + $_SERVER['HTTP_USER_AGENT'] = 'phpunit-user-agent'; + $_SERVER['REMOTE_ADDR'] = '127.0.0.1'; + } + + protected function tearDown(): void + { + $_SERVER = $this->serverBackup; + Server::getInstance()->variables = array(); + + parent::tearDown(); + } + + public function testGetIDIgnoresAcceptLanguage() + { + $_SERVER['HTTP_ACCEPT_LANGUAGE'] = 'en-US'; + $short = AltSessions::getID(); + + Server::getInstance()->variables = array(); + $_SERVER['HTTP_ACCEPT_LANGUAGE'] = 'en-US,en;q=0.9'; + $full = AltSessions::getID(); + + Server::getInstance()->variables = array(); + $_SERVER['HTTP_ACCEPT_LANGUAGE'] = 'de-DE,de;q=0.9'; + $other = AltSessions::getID(); + + Server::getInstance()->variables = array(); + unset($_SERVER['HTTP_ACCEPT_LANGUAGE']); + $empty = AltSessions::getID(); + + $this->assertSame($short, $full); + $this->assertSame($short, $other); + $this->assertSame($short, $empty); + $this->assertSame(16, strlen($short)); + } + + public function testGetIDDiffersWhenUserAgentDiffers() + { + $_SERVER['HTTP_ACCEPT_LANGUAGE'] = 'en-US,en;q=0.9'; + $first = AltSessions::getID(); + + Server::getInstance()->variables = array(); + $_SERVER['HTTP_USER_AGENT'] = 'phpunit-user-agent-other'; + $second = AltSessions::getID(); + + $this->assertNotSame($first, $second); + } +}