#49326 [NoF->Opn]: output_buffering and use_trans_sid can corrupt session

From: Date: Tue, 15 Sep 2009 14:41:47 +0000
Subject: #49326 [NoF->Opn]: output_buffering and use_trans_sid can corrupt session
References: 1  Groups: php.bugs 
Request: Send a blank email to php-bugs+get-142370@lists.php.net to get a copy of this message 
 ID:               49326
 User updated by:  k dot triendl at m-box dot at
 Reported By:      k dot triendl at m-box dot at
-Status:           No Feedback
+Status:           Open
 Bug Type:         Output Control
 Operating System: windows xp sp3
 PHP Version:      5.2.10
 New Comment:

Reproduce code:
---------------
I've prepared a test case without external requirements:
http://www.m-box.at/phpbug_49326/phpbug_49326.php.txt
http://www.m-box.at/phpbug_49326/phpbug_49326.html.inc

phpbug_49326.php.txt is the php script, remove the .txt extension;
phpbug_49326.html.inc is the file included by the php script.
Be sure to set 'output_buffering' to 4096 in the php.ini or the
.htaccess file.

Expected result:
----------------
correct link to 'Impressum':
<a
href="imprint.m-box?setmgrname=mboxobj&amp;fcardid=4&amp;reffcardid=3&amp;PHPSESSID=bouq4a3sddqfeqp4hrobr4bur0>Impressum</a>

Actual result:
--------------
incorrect link to 'Impressum':
<a
href="imprint.m-box?setmgrname=mboxobj&amp;fcardid=4&amp;reffcardid=3"?PHPSESSID=bouq4a3sddqfeqp4hrobr4bur0>Impressum</a>


Previous Comments:
------------------------------------------------------------------------

[2009-09-12 01:00:01] php-bugs at lists dot php dot net

No feedback was provided for this bug for over a week, so it is
being suspended automatically. If you are able to provide the
information that was originally requested, please do so and change
the status of the bug back to "Open".

------------------------------------------------------------------------

[2009-09-04 11:41:36] jani@php.net

Please provide a proper test case which does not have any external
requirements.

------------------------------------------------------------------------

[2009-08-21 21:46:10] k dot triendl at m-box dot at

Description:
------------
If output_buffering is set to 4096 and session.use_trans_sid is used,
the output may be broken:

<a href="index.php"?PHPSESSID=fa562d5bb14df890e6db68627ea76442>


I've found that the same bug was reported in 2003 for php-4.3.8 (which
was fixed back then) and filed under #29333:
http://bugs.php.net/bug.php?id=29333.
The problem is reproducable with the code that Alan has still on his
website.

I hope it's ok to refer to bug #29333.

Reproduce code:
---------------
As described in #29333

Expected result:
----------------
As described in #29333

Actual result:
--------------
As described in #29333


------------------------------------------------------------------------


-- 
Edit this bug report at http://bugs.php.net/?id=49326&edit=1

Thread (7 messages)

« previous php.bugs (#142370) next »