    function _checkLoginNew()
    {
        $oPlugin = new Plugins_Authentication();

        $aCredentials = $oPlugin->_getCredentials(false);

        if (!PEAR::isError($aCredentials)) {
            phpAds_SessionRegenerateId();

            $doUser = $oPlugin->checkPassword($aCredentials['username'], $aCredentials['password']);

            if ($doUser) {
                phpAds_SessionDataRegister(OA_Auth::getSessionData($doUser));
            }
        }

        phpAds_SessionDataStore();
    }
Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.