#42804 [Opn->Bgs]: session-ID sent to foreign sites
| From: | jani@php.net | Date: | Mon, 01 Oct 2007 10:42:45 +0000 |
| Subject: | #42804 [Opn->Bgs]: session-ID sent to foreign sites | ||
| References: | 1 | Groups: | php.bugs |
| Request: | Send a blank email to php-bugs+get-118009@lists.php.net to get a copy of this message | ||
ID: 42804
Updated by: jani@php.net
Reported By: mpub at meiners-online dot de
-Status: Open
+Status: Bogus
Bug Type: Session related
Operating System: Linux
PHP Version: 5.2.4
New Comment:
That's one more reason NOT to use trans-sid stuff. If you want total
control, don't use it. (using cookies is much better anyway..please
refer to the manual http://php.net/session for more info)
Previous Comments:
------------------------------------------------------------------------
[2007-09-30 22:05:34] mpub at meiners-online dot de
Description:
------------
If I set session.use_trans_sid to 1 and form=xxx is included in
url_rewriter.tags, a hidden input field with the session-ID is added to
every form. It seems to me that the output handler doesn't care if the
action-attribute of the form is an absolute URL as it does when
rewriting URLs. So, the session-ID is sent to foreign sites.
Reproduce code:
---------------
ini_set('session.use_trans_sid', '1');
ini_set('url_rewriter.tags',
'a=href,area=href,frame=src,input=src,form=action,fieldset=');
...
if (strlen(session_id()) < 1)
session_start();
...
------------------------------------------------------------------------
--
Edit this bug report at http://bugs.php.net/?id=42804&edit=1