<?php

	// Session configuration script for PHP session management (sessions.php)
	// Copyright 2006 Arlo Leach (http://www.arlomedia.com)

	// 2006-04-01 - initial development
	// 2007-08-31 - changed session.cookie_name to session.name to make that option work
	// 2008-05-29 - added session_end() function since the build-in session_destroy() function doesn't automatically delete the cookie

	$lifetime = 0;	 									// minutes until cookie expires; 0 for this session only
	$path = EDITOR_SUBDIRECTORY; 						// limit cookie access to a subdirectory of your site
	$secure = USE_SSL; 									// require an SSL connection
	$domain = SITE_DOMAIN;			 					// start with a dot to cover all subdomains
	$cookie_name = "EditorSession";						// this will appear when you view the cookie list in the browser
	
	// change the PHP settings if we've requested settings that differ from the defaults
	if ($lifetime !== 0) {
		ini_set("session.cookie_lifetime", ($lifetime * 60) + 0); // add or subtract a value here to correct for server time zones
	}
	if ($path != "/") {
		ini_set("session.cookie_path", $path);
	}
	if ($secure !== 0) {
		ini_set("session.cookie_secure", $secure);
	}
	if ($domain != $_SERVER["HTTP_HOST"]) {
		ini_set("session.cookie_domain", $domain);
	}
	if ($cookie_name != "PHPSESSID") {
		ini_set("session.name", $cookie_name);
	}
	
	// suppress the automatic appending of an SID to internal URLs, to avoid messy search engine indexing
	// this also helps avoid session fixation attacks by preventing PHP from accepting a SID added to a URL
	ini_set("session.use_only_cookies", $cookie_name);
	
	// initialize the session
	session_start();
	
	// end the session AND delete the cookie
	function session_end() {
		GLOBAL $cookie_name, $path;
		$_SESSION = Array();
		setcookie($cookie_name, "", time()-42000, $path);
		session_destroy();
	}

?>
