Accept two past time slots for auth cookie validation; don't encode user-agent into session auth hash (#1488449)

1 files changed, 1 insertions, 1 deletions

diff --git a/program/include/rcube.php b/program/include/rcube.php
index 55dc4ee77..8bd9b76be 100644
--- a/program/include/rcube.php
+++ b/program/include/rcube.php
@@ -476,7 +476,7 @@ class rcube
             $this->session->set_keep_alive($keep_alive);
         }
 
-        $this->session->set_secret($this->config->get('des_key') . $_SERVER['HTTP_USER_AGENT']);
+        $this->session->set_secret($this->config->get('des_key') . dirname($_SERVER['SCRIPT_NAME']));
         $this->session->set_ip_check($this->config->get('ip_check'));
     }