Ladem - 2016-07-08 04:01:08
I'll keep quiet about the code that's deprecated and just won't work. You may fix it easily (add return statements for some functions and convert main function to __construct). Yet, there are some things that makes this class unusable:
1) Fingerprint is the same, so why loose CPU power on executing it, every time when class needs to get it?
2) Why anybody would use exec('hostname') to get hostname of server?! It may encourage users to enable that function and that's very unsafe for beginners. Also manual says it's determined by PHP. No, it's not, it's determined by OS and it will work only on *nix machines.
3) The fingerprint can be easily spoofed. There's salt and hostname (which is the same for every class instance), user agent (easily spoofed) and... HTTP_X_FORWARDED_FOR. That's not IP, but HTTP header. If user have IP 1.2.3.4, then to steal session you just need set this header to the 1.2.3.4 and it will take higher priority than real hacker's IP.
4) Polluting class scope with variables that should be local method variables
5) Keeping sensitive data (passwords etc.) in the class file
6) Strange constructions, like date( "d.m.Y" ) . " " . date( "H:i:s" )
7) Cookie domain for www.example.com will be .example.com, but for abc.example.com will be abc.example.com - why?
Well, a lot of stuff like that. So you need to rewrite many things.
It would make a good skeleton, but you can't fix it yourself, i.e. copyright law forbids any changes, as it's not a free license.
So please, please. Stay away, because you are making a nice attack vector, when you are using it.
