Extend session information to allow extra security when accessing private content. Use nginx auth_request to secure storage area from unmanaged use.

1 files changed, 5 insertions, 0 deletions

diff --git a/includes/bit_setup_inc.php b/includes/bit_setup_inc.php
index 0c1a476..1d0bc91 100755
--- a/includes/bit_setup_inc.php
+++ b/includes/bit_setup_inc.php
@@ -132,8 +132,13 @@ if( empty( $gBitUser ) || !$gBitUser->isValid() ) {
 		if( empty($gBitUser) ) {
 			$gBitUser = new RolePermUser();
 			// maybe do something...
+			unset( $_SESSION['user_role'] );
 		}
 	}
+} else {
+	if (empty($_SESSION['user_role'])) {
+		$_SESSION['user_role'] = 3;
+	}
 }
 
 $gBitSmarty->assign( 'gBitUser', $gBitUser );