From 1e5778174c01aa3f5f3320ae800f8ee6112b336f Mon Sep 17 00:00:00 2001
From: Daniel Lee <dan.limerick@gmail.com>
Date: Mon, 7 Aug 2017 10:00:29 +0200
Subject: [PATCH] login: regenerates session id on login

---
 pkg/api/login.go          | 1 +
 pkg/middleware/session.go | 8 ++++++++
 2 files changed, 9 insertions(+)

diff --git a/pkg/api/login.go b/pkg/api/login.go
index baec5f5f6c0..a9fcbee8e8e 100644
--- a/pkg/api/login.go
+++ b/pkg/api/login.go
@@ -143,6 +143,7 @@ func loginUserWithUser(user *m.User, c *middleware.Context) {
 		c.SetSuperSecureCookie(user.Rands+user.Password, setting.CookieRememberName, user.Login, days, setting.AppSubUrl+"/")
 	}
 
+	c.Session.RegenerateId(c)
 	c.Session.Set(middleware.SESS_KEY_USERID, user.Id)
 }
 
diff --git a/pkg/middleware/session.go b/pkg/middleware/session.go
index a6af63d18de..4de111ff3d2 100644
--- a/pkg/middleware/session.go
+++ b/pkg/middleware/session.go
@@ -103,6 +103,8 @@ type SessionStore interface {
 	Destory(*Context) error
 	// init
 	Start(*Context) error
+	// RegenerateId regenerates the session id
+	RegenerateId(*Context) error
 }
 
 type SessionWrapper struct {
@@ -116,6 +118,12 @@ func (s *SessionWrapper) Start(c *Context) error {
 	return err
 }
 
+func (s *SessionWrapper) RegenerateId(c *Context) error {
+	var err error
+	s.session, err = s.manager.RegenerateId(c.Context)
+	return err
+}
+
 func (s *SessionWrapper) Set(k interface{}, v interface{}) error {
 	if s.session != nil {
 		return s.session.Set(k, v)