php sessions from same ip address - php

Question

Went to work at a customer's place today and really messed things up. Here is a brief history of what happened.
I created a simple cms for a customer and usually, before I went to the customer, I tested everything by myself, localhost without any problems.
As soon as I transferred the site to a real host and started testing at the customer's place, 2 weird things happened (I have to say that we were both hooked up by cable to the same router so both our external IP addresses must have been the same):
First, when I logged into the cms with chrome, all of a sudden at some point Firefox was also logged in as well without me ever login in via Firefox.
The weirdest thing is that the customer at some point was also logged in it seems without ever loggin in from her computer...
What happened is that some toolbars that onlyh show up in "admin mode" all of a sudden were "added" to the real page content via a save I probably done.
I think we both somehow used the same session ID or something similar and it messed up my code / cms.
Here is the code I currently use for loggins:
I first have this at the top of my page:
if(!isset($_SESSION)){
session_name("sitesession");
session_set_cookie_params(0);
session_start();
}
// make sure user login attempts are no more than 3 times
if (!isset($_SESSION['ip'])){
$_SESSION['ip'] = $_SERVER['REMOTE_ADDR'];
}
if (!isset($_SESSION['logintriesleft'])){
$_SESSION['logintriesleft'] = 3;
}
then later on in the page, i "require_once" the login script which has the following in it:
if (isset($theaction) and ($theaction=="adminlogin")){
$email = $_REQUEST['email'];
$magickey = $_REQUEST['magickey'];
$sth = $DB_con->prepare('SELECT magickey FROM admin_users WHERE email = :email LIMIT 1');
$sth->bindParam(':email', $email);
$sth->execute();
$user = $sth->fetch(PDO::FETCH_OBJ);
if (is_null($user->magickey) || hash_equals($user->magickey, crypt($magickey, $user->magickey))==false) {
$_SESSION['logintriesleft'] = --$_SESSION['logintriesleft'];
if ($_SESSION['logintriesleft'] > 0){
echo '<script>javascript:alert("Bad Login ('.$_SESSION['logintriesleft'].' more tries left before getting banned)...Please Try Again");</script>';
echo '<script>javascript:location.replace("'.$_SESSION['baseurl'].'");</script>';
}else{
echo '<script>javascript:alert("Too many bad login attempts. Contact the website administrator to reactivate your account");</script>';
echo '<script>javascript:location.replace("http://google.ca");</script>';
}
}
else {
$_SESSION["admin"] = "true";
$_SESSION["edit_content"] = "true";
echo '<script>javascript:alert("Successful login! Redirecting you back to the main page!");</script>';
echo '<script>javascript:location.replace("'.$_SESSION['baseurl'].$_SESSION['currentpage'].'");</script>';
break;
}
}
?>
and my logout code is like so:
case "logout":
$_SESSION = array(); // unset all of the session variables
// also delete the session cookie. This will destroy the session, not just the session data!
if (ini_get("session.use_cookies")) {
$params = session_get_cookie_params();
setcookie(session_name(), '', time() - 42000,
$params["path"], $params["domain"],
$params["secure"], $params["httponly"]
);
}
// Finally, destroy the session.
session_destroy();
echo '<script>javascript:alert("Your are now logged out. Goodbye!");</script>';
echo '<script>javascript:location.replace("//www.google.ca");</script>';
break;
I do think my first piece of code is at fault here probably when looking up the ip address of the user but I'm not sure. Like I said, I've never experienced any issues like this until we were two of us on the same router accessing my site on an external host.
Any ideas what might have gone wrong?
Thanks for all your help.