MyBB Community Forums

MySessions

Description:
With this plugin, users can view all of their account's current sessions and log out any sessions they find suspicious. Admins can view all sessions. Based on the functionality found in Gmail and Deviantart.

The below screenshot shows the usercp?action=mysessions page. The useragent "1'" was made by Nathan as he was testing the plugin for vulnerabilities, of which he found some and I fixed immediately

IP address links go to *the ip address*.ipaddress.com. If the plugin can, it will display the hostname and location of the IP address.



If there are multiple sessions for the same account, a warning shows up (which can be dismissed)



Install:
This plugin adds one database table and edits one template.

Upgrade:
From 1.0 to 1.1: re-upload mysessions.php
From 1.0, 1.1 to 1.2: re-upload mysessions.php, deactivate and reactivate. This is needed to add a new column, uid, to the mysessions_kill table.

Change log:
1.0: Initial release
1.1: Minor bug fixes, and feature Multiple Sessions Alerts added
1.2 Added features:

• Cancel kill request
  
• Search by IP/username
  

Miscellaneous bug fixes
Fully commented code
[b]1.3:[b] SQLi problem affecting 1.2 fixed

Support:

Support will be given on MyBB Security.

http://www.mybbsecurity.net/topic-mysessions

Download:

Please download from MyBB Security to keep download counts accurate.

http://www.mybbsecurity.net/topic-mysessions

Will definetely at-least try it out.

It's been security audited by Nathan Malcolm so you know it's secure

Looks great Paul.

(2012-03-08, 03:44 AM)Paul H. Wrote: [ -> ]It's been security audited by Nathan Malcolm so you know it's secure

Hahaha

I may put this on my forum in the future. It seems like it could have a benefit for high-powered accounts, as they could stop another session if needed.

Finally! Somebody who takes security seriously! Installing!

Updated to 1.3.1.

Upgrade instructions?

(2012-03-08, 03:22 AM)Paul H. Wrote: [ -> ]Upgrade:
From 1.0 to 1.1: re-upload mysessions.php
From 1.0, 1.1 to 1.2, 1.3.x: re-upload mysessions.php, deactivate and reactivate. This is needed to add a new column, uid, to the mysessions_kill table.

Can I know how a complex password looks like? I thought my email password was enough complex :s