Added fatal error to Session class when no encryption key is set in the config file, for additional assurance that session manipulation can be prevented
diff --git a/system/libraries/Session.php b/system/libraries/Session.php
index cf6dc96..f413c0d 100644
--- a/system/libraries/Session.php
+++ b/system/libraries/Session.php
@@ -65,6 +65,11 @@
$this->$key = (isset($params[$key])) ? $params[$key] : $this->CI->config->item($key);
}
+ if ($this->encryption_key == '')
+ {
+ show_error('In order to use the Session class you are required to set an encryption key in your config file.');
+ }
+
// Load the string helper so we can use the strip_slashes() function
$this->CI->load->helper('string');