* Fix the vulnerability that induces users to click on links with sessionID to bypass authentication.

framework/base/helper.class.php

@@ -762,6 +762,10 @@ class baseHelper
             register_shutdown_function('session_write_close');
         }
         session_start();
+
+        global $app;
+        if(isset($_SESSION['user']))  $app->user = $_SESSION['user'];
+        if(!isset($_SESSION['user'])) unset($app->user);
     }
 
     /**

module/file/control.php

@@ -132,7 +132,6 @@ class file extends control
      */
     public function download($fileID, $mouse = '')
     {
-        if(session_id() != $this->app->sessionID) helper::restartSession($this->app->sessionID);
         $file = $this->file->getById($fileID);
         if(empty($file))
         {

www/index.php

@@ -74,4 +74,6 @@ if(!$app->setParams()) return;
 $common->checkPriv();
 $common->checkIframe();
 
+if(session_id() != $app->sessionID) helper::restartSession($app->sessionID);
+
 echo $app->outputPage();