Merge branch 'hotfix/tokenSalt' into gray

@@ -354,7 +354,6 @@ class AbstractAction extends Controller_Abstract
             $useSession = false;
             $useSession = false;
         }
         }
         //$useSession = false;
         //$useSession = false;
-
         if (!$this->_uid) {
         if (!$this->_uid) {
             $cookie = $this->getCookie('_UID');
             $cookie = $this->getCookie('_UID');
             // 兼容老的
             // 兼容老的
@@ -363,11 +362,9 @@ class AbstractAction extends Controller_Abstract
                 $cookieList[1] = intval(Encryption::decrypt($cookieList[1]));
                 $cookieList[1] = intval(Encryption::decrypt($cookieList[1]));
                 if (isset($cookieList[1]) && $cookieList[1]) {
                 if (isset($cookieList[1]) && $cookieList[1]) {
                     if ($useSession) {
                     if ($useSession) {
-                        $token = $this->getSession('_TOKEN');
-                        if (empty($token)) {
-                            $token = $this->getCookie('_TOKEN');
-                        }
-                        if ($token === Helpers::makeToken($cookieList[1])) {
+                        $token = $this->getCookie('_TOKEN');
+                        $salt = substr($token, -8);
+                        if ($cookieList[3] === Helpers::makeToken($cookieList[1] . $salt)) {
                             $this->_uid = $cookieList[1];
                             $this->_uid = $cookieList[1];
                         }
                         }
                     } else {
                     } else {