/**

*

* @package phpBB3

* @version $Id: session.php 9170 2008-12-04 12:56:12Z toonarmy $

* @copyright (c) 2005 phpBB Group

* @license http://opensource.org/licenses/gpl-license.php GNU Public License

*

*/

/**

* @ignore

*/

if (!defined('IN_PHPBB'))

{

	exit;

}

/**

* Session class

* @package phpBB3

*/

class session

{

	var $cookie_data = array();

	var $page = array();

	var $data = array();

	var $browser = '';

	var $forwarded_for = '';

	var $host = '';

	var $session_id = '';

	var $ip = '';

	var $load = 0;

	var $time_now = 0;

	var $update_session_page = true;

	/**

	* Extract current session page

	*

	* @param string $root_path current root path (phpbb_root_path)

	*/

	function extract_current_page($root_path)

	{

		$page_array = array();

		// First of all, get the request uri...

		$script_name = (!empty($_SERVER['PHP_SELF'])) ? $_SERVER['PHP_SELF'] : getenv('PHP_SELF');

		$args = (!empty($_SERVER['QUERY_STRING'])) ? explode('&', $_SERVER['QUERY_STRING']) : explode('&', getenv('QUERY_STRING'));

		// If we are unable to get the script name we use REQUEST_URI as a failover and note it within the page array for easier support...

		if (!$script_name)

		{

			$script_name = (!empty($_SERVER['REQUEST_URI'])) ? $_SERVER['REQUEST_URI'] : getenv('REQUEST_URI');

			$script_name = (($pos = strpos($script_name, '?')) !== false) ? substr($script_name, 0, $pos) : $script_name;

			$page_array['failover'] = 1;

		}

		// Replace backslashes and doubled slashes (could happen on some proxy setups)

		$script_name = str_replace(array('\\', '//'), '/', $script_name);

		// Now, remove the sid and let us get a clean query string...

		$use_args = array();

		// Since some browser do not encode correctly we need to do this with some "special" characters...

		// " -> %22, ' => %27, < -> %3C, > -> %3E

		$find = array('"', "'", '<', '>');

		$replace = array('%22', '%27', '%3C', '%3E');

		foreach ($args as $key => $argument)

		{

			if (strpos($argument, 'sid=') === 0)

			{

				continue;

			}

			$use_args[] = str_replace($find, $replace, $argument);

		}

		unset($args);

		// The following examples given are for an request uri of {path to the phpbb directory}/adm/index.php?i=10&b=2

		// The current query string

		$query_string = trim(implode('&', $use_args));

		// basenamed page name (for example: index.php)

		$page_name = basename($script_name);

		$page_name = urlencode(htmlspecialchars($page_name));

		// current directory within the phpBB root (for example: adm)

		$root_dirs = explode('/', str_replace('\\', '/', phpbb_realpath($root_path)));

		$page_dirs = explode('/', str_replace('\\', '/', phpbb_realpath('./')));

		$intersection = array_intersect_assoc($root_dirs, $page_dirs);

		$root_dirs = array_diff_assoc($root_dirs, $intersection);

		$page_dirs = array_diff_assoc($page_dirs, $intersection);

		$page_dir = str_repeat('../', sizeof($root_dirs)) . implode('/', $page_dirs);

		if ($page_dir && substr($page_dir, -1, 1) == '/')

		{

			$page_dir = substr($page_dir, 0, -1);

		}

		// Current page from phpBB root (for example: adm/index.php?i=10&b=2)

		$page = (($page_dir) ? $page_dir . '/' : '') . $page_name . (($query_string) ? "?$query_string" : '');

		// The script path from the webroot to the current directory (for example: /phpBB3/adm/) : always prefixed with / and ends in /

		$script_path = trim(str_replace('\\', '/', dirname($script_name)));

		// The script path from the webroot to the phpBB root (for example: /phpBB3/)

		$script_dirs = explode('/', $script_path);

		array_splice($script_dirs, -sizeof($page_dirs));

		$root_script_path = implode('/', $script_dirs) . (sizeof($root_dirs) ? '/' . implode('/', $root_dirs) : '');

		// We are on the base level (phpBB root == webroot), lets adjust the variables a bit...

		if (!$root_script_path)

		{

			$root_script_path = ($page_dir) ? str_replace($page_dir, '', $script_path) : $script_path;

		}

		$script_path .= (substr($script_path, -1, 1) == '/') ? '' : '/';

		$root_script_path .= (substr($root_script_path, -1, 1) == '/') ? '' : '/';

		$page_array += array(

			'page_name'			=> $page_name,

			'page_dir'			=> $page_dir,

			'query_string'		=> $query_string,

			'script_path'		=> str_replace(' ', '%20', htmlspecialchars($script_path)),

			'root_script_path'	=> str_replace(' ', '%20', htmlspecialchars($root_script_path)),

			'page'				=> $page,

			'forum'				=> (isset($_REQUEST['f']) && $_REQUEST['f'] > 0) ? (int) $_REQUEST['f'] : 0,

		);

		return $page_array;

	}

	/**

	* Get valid hostname/port. HTTP_HOST is used, SERVER_NAME if HTTP_HOST not present.

	*/

	function extract_current_hostname()

	{

		global $config;

		// Get hostname

		$host = (!empty($_SERVER['HTTP_HOST'])) ? $_SERVER['HTTP_HOST'] : ((!empty($_SERVER['SERVER_NAME'])) ? $_SERVER['SERVER_NAME'] : getenv('SERVER_NAME'));

		// Should be a string and lowered

		$host = (string) strtolower($host);

		// If host is equal the cookie domain or the server name (if config is set), then we assume it is valid

		if ((isset($config['cookie_domain']) && $host === $config['cookie_domain']) || (isset($config['server_name']) && $host === $config['server_name']))

		{

			return $host;

		}

		// Is the host actually a IP? If so, we use the IP... (IPv4)

		if (long2ip(ip2long($host)) === $host)

		{

			return $host;

		}

		// Now return the hostname (this also removes any port definition). The http:// is prepended to construct a valid URL, hosts never have a scheme assigned

		$host = @parse_url('http://' . $host);

		$host = (!empty($host['host'])) ? $host['host'] : '';

		// Remove any portions not removed by parse_url (#)

		$host = str_replace('#', '', $host);

		// If, by any means, the host is now empty, we will use a "best approach" way to guess one

		if (empty($host))

		{

			if (!empty($config['server_name']))

			{

				$host = $config['server_name'];

			}

			else if (!empty($config['cookie_domain']))

			{

				$host = (strpos($config['cookie_domain'], '.') === 0) ? substr($config['cookie_domain'], 1) : $config['cookie_domain'];

			}

			else

			{

				// Set to OS hostname or localhost

				$host = (function_exists('php_uname')) ? php_uname('n') : 'localhost';

			}

		}

		// It may be still no valid host, but for sure only a hostname (we may further expand on the cookie domain... if set)

		return $host;

	}

	/**

	* Start session management

	*

	* This is where all session activity begins. We gather various pieces of

	* information from the client and server. We test to see if a session already

	* exists. If it does, fine and dandy. If it doesn't we'll go on to create a

	* new one ... pretty logical heh? We also examine the system load (if we're

	* running on a system which makes such information readily available) and

	* halt if it's above an admin definable limit.

	*

	* @param bool $update_session_page if true the session page gets updated.

	*			This can be set to circumvent certain scripts to update the users last visited page.

	*/

	function session_begin($update_session_page = true)

	{

		global $phpEx, $SID, $_SID, $_EXTRA_URL, $db, $config, $phpbb_root_path;

		// Give us some basic information

		$this->time_now				= time();

		$this->cookie_data			= array('u' => 0, 'k' => '');

		$this->update_session_page	= $update_session_page;

		$this->browser				= (!empty($_SERVER['HTTP_USER_AGENT'])) ? htmlspecialchars((string) $_SERVER['HTTP_USER_AGENT']) : '';

		$this->referer				= (!empty($_SERVER['HTTP_REFERER'])) ? htmlspecialchars((string) $_SERVER['HTTP_REFERER']) : '';

		$this->forwarded_for		= (!empty($_SERVER['HTTP_X_FORWARDED_FOR'])) ? (string) $_SERVER['HTTP_X_FORWARDED_FOR'] : '';

		$this->host					= $this->extract_current_hostname();

		$this->page					= $this->extract_current_page($phpbb_root_path);

		// if the forwarded for header shall be checked we have to validate its contents

		if ($config['forwarded_for_check'])

		{

			$this->forwarded_for = preg_replace('#, +#', ', ', $this->forwarded_for);

			// split the list of IPs

			$ips = explode(', ', $this->forwarded_for);

			foreach ($ips as $ip)

			{

				// check IPv4 first, the IPv6 is hopefully only going to be used very seldomly

				if (!empty($ip) && !preg_match(get_preg_expression('ipv4'), $ip) && !preg_match(get_preg_expression('ipv6'), $ip))

				{

					// contains invalid data, don't use the forwarded for header

					$this->forwarded_for = '';

					break;

				}

			}

		}

		else

		{

			$this->forwarded_for = '';

		}

		if (isset($_COOKIE[$config['cookie_name'] . '_sid']) || isset($_COOKIE[$config['cookie_name'] . '_u']))

		{

			$this->cookie_data['u'] = request_var($config['cookie_name'] . '_u', 0, false, true);

			$this->cookie_data['k'] = request_var($config['cookie_name'] . '_k', '', false, true);

			$this->session_id 		= request_var($config['cookie_name'] . '_sid', '', false, true);

			$SID = (defined('NEED_SID')) ? '?sid=' . $this->session_id : '?sid=';

			$_SID = (defined('NEED_SID')) ? $this->session_id : '';

			if (empty($this->session_id))

			{

				$this->session_id = $_SID = request_var('sid', '');

				$SID = '?sid=' . $this->session_id;

				$this->cookie_data = array('u' => 0, 'k' => '');

			}

		}

		else

		{

			$this->session_id = $_SID = request_var('sid', '');

			$SID = '?sid=' . $this->session_id;

		}

		$_EXTRA_URL = array();

		// Why no forwarded_for et al? Well, too easily spoofed. With the results of my recent requests

		// it's pretty clear that in the majority of cases you'll at least be left with a proxy/cache ip.

		$this->ip = (!empty($_SERVER['REMOTE_ADDR'])) ? htmlspecialchars($_SERVER['REMOTE_ADDR']) : '';

		$this->load = false;

		// Load limit check (if applicable)

		if ($config['limit_load'] || $config['limit_search_load'])

		{

			if ((function_exists('sys_getloadavg') && $load = sys_getloadavg()) || ($load = explode(' ', @file_get_contents('/proc/loadavg'))))

			{

				$this->load = array_slice($load, 0, 1);

				$this->load = floatval($this->load[0]);

			}

			else

			{

				set_config('limit_load', '0');

				set_config('limit_search_load', '0');

			}

		}

		// Is session_id is set or session_id is set and matches the url param if required

		if (!empty($this->session_id) && (!defined('NEED_SID') || (isset($_GET['sid']) && $this->session_id === $_GET['sid'])))

		{

			$sql = 'SELECT u.*, s.*

				FROM ' . SESSIONS_TABLE . ' s, ' . USERS_TABLE . " u

				WHERE s.session_id = '" . $db->sql_escape($this->session_id) . "'

					AND u.user_id = s.session_user_id";

			$result = $db->sql_query($sql);

			$this->data = $db->sql_fetchrow($result);

			$db->sql_freeresult($result);

			// Did the session exist in the DB?

			if (isset($this->data['user_id']))

			{

				// Validate IP length according to admin ... enforces an IP

				// check on bots if admin requires this

//				$quadcheck = ($config['ip_check_bot'] && $this->data['user_type'] & USER_BOT) ? 4 : $config['ip_check'];

				if (strpos($this->ip, ':') !== false && strpos($this->data['session_ip'], ':') !== false)

				{

					$s_ip = short_ipv6($this->data['session_ip'], $config['ip_check']);

					$u_ip = short_ipv6($this->ip, $config['ip_check']);

				}

				else

				{

					$s_ip = implode('.', array_slice(explode('.', $this->data['session_ip']), 0, $config['ip_check']));

					$u_ip = implode('.', array_slice(explode('.', $this->ip), 0, $config['ip_check']));

				}

				$s_browser = ($config['browser_check']) ? trim(strtolower(substr($this->data['session_browser'], 0, 149))) : '';

				$u_browser = ($config['browser_check']) ? trim(strtolower(substr($this->browser, 0, 149))) : '';

				$s_forwarded_for = ($config['forwarded_for_check']) ? substr($this->data['session_forwarded_for'], 0, 254) : '';

				$u_forwarded_for = ($config['forwarded_for_check']) ? substr($this->forwarded_for, 0, 254) : '';

				// referer checks

				// The @ before $config['referer_validation'] suppresses notices present while running the updater

				$check_referer_path = (@$config['referer_validation'] == REFERER_VALIDATE_PATH);

				$referer_valid = true;

				// we assume HEAD and TRACE to be foul play and thus only whitelist GET

				if (@$config['referer_validation'] && isset($_SERVER['REQUEST_METHOD']) && strtolower($_SERVER['REQUEST_METHOD']) !== 'get')

				{

					$referer_valid = $this->validate_referer($check_referer_path);

				}

				if ($u_ip === $s_ip && $s_browser === $u_browser && $s_forwarded_for === $u_forwarded_for && $referer_valid)

				{

					$session_expired = false;

					// Check whether the session is still valid if we have one

					$method = basename(trim($config['auth_method']));

					include_once($phpbb_root_path . 'includes/auth/auth_' . $method . '.' . $phpEx);

					$method = 'validate_session_' . $method;

					if (function_exists($method))

					{

						if (!$method($this->data))

						{

							$session_expired = true;

						}

					}

					if (!$session_expired)

					{

						// Check the session length timeframe if autologin is not enabled.

						// Else check the autologin length... and also removing those having autologin enabled but no longer allowed board-wide.

						if (!$this->data['session_autologin'])

						{

							if ($this->data['session_time'] < $this->time_now - ($config['session_length'] + 60))

							{

								$session_expired = true;

							}

						}

						else if (!$config['allow_autologin'] || ($config['max_autologin_time'] && $this->data['session_time'] < $this->time_now - (86400 * (int) $config['max_autologin_time']) + 60))

						{

							$session_expired = true;

						}

					}

					if (!$session_expired)

					{

						// Only update session DB a minute or so after last update or if page changes

						if ($this->time_now - $this->data['session_time'] > 60 || ($this->update_session_page && $this->data['session_page'] != $this->page['page']))

						{

							$sql_ary = array('session_time' => $this->time_now);

							if ($this->update_session_page)

							{

								$sql_ary['session_page'] = substr($this->page['page'], 0, 199);

								$sql_ary['session_forum_id'] = $this->page['forum'];

							}

							$db->sql_return_on_error(true);

							$sql = 'UPDATE ' . SESSIONS_TABLE . ' SET ' . $db->sql_build_array('UPDATE', $sql_ary) . "

								WHERE session_id = '" . $db->sql_escape($this->session_id) . "'";

							$result = $db->sql_query($sql);

							$db->sql_return_on_error(false);

							// If the database is not yet updated, there will be an error due to the session_forum_id

							// @todo REMOVE for 3.0.2

							if ($result === false)

							{

								unset($sql_ary['session_forum_id']);

								$sql = 'UPDATE ' . SESSIONS_TABLE . ' SET ' . $db->sql_build_array('UPDATE', $sql_ary) . "

									WHERE session_id = '" . $db->sql_escape($this->session_id) . "'";

								$db->sql_query($sql);

							}

						}

						$this->data['is_registered'] = ($this->data['user_id'] != ANONYMOUS && ($this->data['user_type'] == USER_NORMAL || $this->data['user_type'] == USER_FOUNDER)) ? true : false;

						$this->data['is_bot'] = (!$this->data['is_registered'] && $this->data['user_id'] != ANONYMOUS) ? true : false;

						$this->data['user_lang'] = basename($this->data['user_lang']);

						return true;

					}

				}

				else

				{

					// Added logging temporarly to help debug bugs...

					if (defined('DEBUG_EXTRA') && $this->data['user_id'] != ANONYMOUS)

					{

						if ($referer_valid)

						{

							add_log('critical', 'LOG_IP_BROWSER_FORWARDED_CHECK', $u_ip, $s_ip, $u_browser, $s_browser, htmlspecialchars($u_forwarded_for), htmlspecialchars($s_forwarded_for));

						}

						else

						{

							add_log('critical', 'LOG_REFERER_INVALID', $this->referer);

						}

					}

				}

			}

		}

		// If we reach here then no (valid) session exists. So we'll create a new one

		return $this->session_create();

	}

	/**

	* Create a new session

	*

	* If upon trying to start a session we discover there is nothing existing we

	* jump here. Additionally this method is called directly during login to regenerate

	* the session for the specific user. In this method we carry out a number of tasks;

	* garbage collection, (search)bot checking, banned user comparison. Basically

	* though this method will result in a new session for a specific user.

	*/

	function session_create($user_id = false, $set_admin = false, $persist_login = false, $viewonline = true)

	{

		global $SID, $_SID, $db, $config, $cache, $phpbb_root_path, $phpEx;

		$this->data = array();

		/* Garbage collection ... remove old sessions updating user information

		// if necessary. It means (potentially) 11 queries but only infrequently

		if ($this->time_now > $config['session_last_gc'] + $config['session_gc'])

		{

			$this->session_gc();

		}*/

		// Do we allow autologin on this board? No? Then override anything

		// that may be requested here

		if (!$config['allow_autologin'])

		{

			$this->cookie_data['k'] = $persist_login = false;

		}

		/**

		* Here we do a bot check, oh er saucy! No, not that kind of bot

		* check. We loop through the list of bots defined by the admin and

		* see if we have any useragent and/or IP matches. If we do, this is a

		* bot, act accordingly

		*/

		$bot = false;

		$active_bots = $cache->obtain_bots();

		foreach ($active_bots as $row)

		{

			if ($row['bot_agent'] && preg_match('#' . str_replace('\*', '.*?', preg_quote($row['bot_agent'], '#')) . '#i', $this->browser))

			{

				$bot = $row['user_id'];

			}

			// If ip is supplied, we will make sure the ip is matching too...

			if ($row['bot_ip'] && ($bot || !$row['bot_agent']))

			{

				// Set bot to false, then we only have to set it to true if it is matching

				$bot = false;

				foreach (explode(',', $row['bot_ip']) as $bot_ip)

				{

					if (strpos($this->ip, $bot_ip) === 0)

					{

						$bot = (int) $row['user_id'];

						break;

					}

				}

			}

			if ($bot)

			{

				break;

			}

		}

		$method = basename(trim($config['auth_method']));

		include_once($phpbb_root_path . 'includes/auth/auth_' . $method . '.' . $phpEx);

		$method = 'autologin_' . $method;

		if (function_exists($method))

		{

			$this->data = $method();

			if (sizeof($this->data))

			{

				$this->cookie_data['k'] = '';

				$this->cookie_data['u'] = $this->data['user_id'];

			}

		}

		// If we're presented with an autologin key we'll join against it.

		// Else if we've been passed a user_id we'll grab data based on that

		if (isset($this->cookie_data['k']) && $this->cookie_data['k'] && $this->cookie_data['u'] && !sizeof($this->data))

		{

			$sql = 'SELECT u.*

				FROM ' . USERS_TABLE . ' u, ' . SESSIONS_KEYS_TABLE . ' k

				WHERE u.user_id = ' . (int) $this->cookie_data['u'] . '

					AND u.user_type IN (' . USER_NORMAL . ', ' . USER_FOUNDER . ")

					AND k.user_id = u.user_id

					AND k.key_id = '" . $db->sql_escape(md5($this->cookie_data['k'])) . "'";

			$result = $db->sql_query($sql);

			$this->data = $db->sql_fetchrow($result);

			$db->sql_freeresult($result);

			$bot = false;

		}

		else if ($user_id !== false && !sizeof($this->data))

		{

			$this->cookie_data['k'] = '';

			$this->cookie_data['u'] = $user_id;

			$sql = 'SELECT *

				FROM ' . USERS_TABLE . '

				WHERE user_id = ' . (int) $this->cookie_data['u'] . '

					AND user_type IN (' . USER_NORMAL . ', ' . USER_FOUNDER . ')';

			$result = $db->sql_query($sql);

			$this->data = $db->sql_fetchrow($result);

			$db->sql_freeresult($result);

			$bot = false;

		}

		// If no data was returned one or more of the following occurred:

		// Key didn't match one in the DB

		// User does not exist

		// User is inactive

		// User is bot

		if (!sizeof($this->data) || !is_array($this->data))

		{

			$this->cookie_data['k'] = '';

			$this->cookie_data['u'] = ($bot) ? $bot : ANONYMOUS;

			if (!$bot)

			{

				$sql = 'SELECT *

					FROM ' . USERS_TABLE . '

					WHERE user_id = ' . (int) $this->cookie_data['u'];

			}

			else

			{

				// We give bots always the same session if it is not yet expired.

				$sql = 'SELECT u.*, s.*

					FROM ' . USERS_TABLE . ' u

					LEFT JOIN ' . SESSIONS_TABLE . ' s ON (s.session_user_id = u.user_id)

					WHERE u.user_id = ' . (int) $bot;

			}

			$result = $db->sql_query($sql);

			$this->data = $db->sql_fetchrow($result);

			$db->sql_freeresult($result);

		}

		if ($this->data['user_id'] != ANONYMOUS && !$bot)

		{

			$this->data['session_last_visit'] = (isset($this->data['session_time']) && $this->data['session_time']) ? $this->data['session_time'] : (($this->data['user_lastvisit']) ? $this->data['user_lastvisit'] : time());

		}

		else

		{

			$this->data['session_last_visit'] = $this->time_now;

		}

		// Force user id to be integer...

		$this->data['user_id'] = (int) $this->data['user_id'];

		// At this stage we should have a filled data array, defined cookie u and k data.

		// data array should contain recent session info if we're a real user and a recent

		// session exists in which case session_id will also be set

		// Is user banned? Are they excluded? Won't return on ban, exists within method

		if ($this->data['user_type'] != USER_FOUNDER)

		{

			if (!$config['forwarded_for_check'])

			{

				$this->check_ban($this->data['user_id'], $this->ip);

			}

			else

			{

				$ips = explode(', ', $this->forwarded_for);

				$ips[] = $this->ip;

				$this->check_ban($this->data['user_id'], $ips);

			}

		}

		$this->data['is_registered'] = (!$bot && $this->data['user_id'] != ANONYMOUS && ($this->data['user_type'] == USER_NORMAL || $this->data['user_type'] == USER_FOUNDER)) ? true : false;

		$this->data['is_bot'] = ($bot) ? true : false;

		// If our friend is a bot, we re-assign a previously assigned session

		if ($this->data['is_bot'] && $bot == $this->data['user_id'] && $this->data['session_id'])

		{

			// Only assign the current session if the ip, browser and forwarded_for match...

			if (strpos($this->ip, ':') !== false && strpos($this->data['session_ip'], ':') !== false)

			{

				$s_ip = short_ipv6($this->data['session_ip'], $config['ip_check']);

				$u_ip = short_ipv6($this->ip, $config['ip_check']);

			}

			else

			{

				$s_ip = implode('.', array_slice(explode('.', $this->data['session_ip']), 0, $config['ip_check']));

				$u_ip = implode('.', array_slice(explode('.', $this->ip), 0, $config['ip_check']));

			}

			$s_browser = ($config['browser_check']) ? trim(strtolower(substr($this->data['session_browser'], 0, 149))) : '';

			$u_browser = ($config['browser_check']) ? trim(strtolower(substr($this->browser, 0, 149))) : '';

			$s_forwarded_for = ($config['forwarded_for_check']) ? substr($this->data['session_forwarded_for'], 0, 254) : '';

			$u_forwarded_for = ($config['forwarded_for_check']) ? substr($this->forwarded_for, 0, 254) : '';

			if ($u_ip === $s_ip && $s_browser === $u_browser && $s_forwarded_for === $u_forwarded_for)

			{

				$this->session_id = $this->data['session_id'];

				// Only update session DB a minute or so after last update or if page changes

				if ($this->time_now - $this->data['session_time'] > 60 || ($this->update_session_page && $this->data['session_page'] != $this->page['page']))

				{

					$this->data['session_time'] = $this->data['session_last_visit'] = $this->time_now;

					$sql_ary = array('session_time' => $this->time_now, 'session_last_visit' => $this->time_now, 'session_admin' => 0);

					if ($this->update_session_page)

					{

						$sql_ary['session_page'] = substr($this->page['page'], 0, 199);

						$sql_ary['session_forum_id'] = $this->page['forum'];

					}

					$sql = 'UPDATE ' . SESSIONS_TABLE . ' SET ' . $db->sql_build_array('UPDATE', $sql_ary) . "

						WHERE session_id = '" . $db->sql_escape($this->session_id) . "'";

					$db->sql_query($sql);

					// Update the last visit time

					$sql = 'UPDATE ' . USERS_TABLE . '

						SET user_lastvisit = ' . (int) $this->data['session_time'] . '

						WHERE user_id = ' . (int) $this->data['user_id'];

					$db->sql_query($sql);

				}

				$SID = '?sid=';

				$_SID = '';

				return true;

			}

			else

			{

				// If the ip and browser does not match make sure we only have one bot assigned to one session

				$db->sql_query('DELETE FROM ' . SESSIONS_TABLE . ' WHERE session_user_id = ' . $this->data['user_id']);

			}

		}

		$session_autologin = (($this->cookie_data['k'] || $persist_login) && $this->data['is_registered']) ? true : false;

		$set_admin = ($set_admin && $this->data['is_registered']) ? true : false;

		// Create or update the session

		$sql_ary = array(

			'session_user_id'		=> (int) $this->data['user_id'],

			'session_start'			=> (int) $this->time_now,

			'session_last_visit'	=> (int) $this->data['session_last_visit'],

			'session_time'			=> (int) $this->time_now,

			'session_browser'		=> (string) trim(substr($this->browser, 0, 149)),

			'session_forwarded_for'	=> (string) $this->forwarded_for,

			'session_ip'			=> (string) $this->ip,

			'session_autologin'		=> ($session_autologin) ? 1 : 0,

			'session_admin'			=> ($set_admin) ? 1 : 0,

			'session_viewonline'	=> ($viewonline) ? 1 : 0,

		);

		if ($this->update_session_page)

		{

			$sql_ary['session_page'] = (string) substr($this->page['page'], 0, 199);

			$sql_ary['session_forum_id'] = $this->page['forum'];

		}

		$db->sql_return_on_error(true);

		$sql = 'DELETE

			FROM ' . SESSIONS_TABLE . '

			WHERE session_id = \'' . $db->sql_escape($this->session_id) . '\'

				AND session_user_id = ' . ANONYMOUS;

		if (!defined('IN_ERROR_HANDLER') && (!$this->session_id || !$db->sql_query($sql) || !$db->sql_affectedrows()))

		{

			// Limit new sessions in 1 minute period (if required)

			if (empty($this->data['session_time']) && $config['active_sessions'])

			{

//				$db->sql_return_on_error(false);

				$sql = 'SELECT COUNT(session_id) AS sessions

					FROM ' . SESSIONS_TABLE . '

					WHERE session_time >= ' . ($this->time_now - 60);

				$result = $db->sql_query($sql);

				$row = $db->sql_fetchrow($result);

				$db->sql_freeresult($result);

				if ((int) $row['sessions'] > (int) $config['active_sessions'])

				{

					header('HTTP/1.1 503 Service Unavailable');

					trigger_error('BOARD_UNAVAILABLE');

				}

			}

		}

		// Since we re-create the session id here, the inserted row must be unique. Therefore, we display potential errors.