#49326 [Opn]: output_buffering breaks transparent unsecure automatic SID adding

From: Date: Wed, 16 Sep 2009 08:02:02 +0000
Subject: #49326 [Opn]: output_buffering breaks transparent unsecure automatic SID adding
References: 1  Groups: php.bugs 
Request: Send a blank email to php-bugs+get-142406@lists.php.net to get a copy of this message 
 ID:               49326
 Updated by:       jani@php.net
 Reported By:      k dot triendl at m-box dot at
 Status:           Open
 Bug Type:         Output Control
 Operating System: windows xp sp3
 PHP Version:      5.2.10
 New Comment:

You should really add the SID "manually" anyway, using 
session.use_trans_sid should be avoided always when your site is 
anything else but some intranet. (might be fixed, propably won't be 
ever)


Previous Comments:
------------------------------------------------------------------------

[2009-09-15 14:41:46] k dot triendl at m-box dot at

Reproduce code:
---------------
I've prepared a test case without external requirements:
http://www.m-box.at/phpbug_49326/phpbug_49326.php.txt
http://www.m-box.at/phpbug_49326/phpbug_49326.html.inc

phpbug_49326.php.txt is the php script, remove the .txt extension;
phpbug_49326.html.inc is the file included by the php script.
Be sure to set 'output_buffering' to 4096 in the php.ini or the
.htaccess file.

Expected result:
----------------
correct link to 'Impressum':
<a
href="imprint.m-box?setmgrname=mboxobj&amp;fcardid=4&amp;reffcardid=3&amp;PHPSESSID=bouq4a3sddqfeqp4hrobr4bur0>Impressum</a>

Actual result:
--------------
incorrect link to 'Impressum':
<a
href="imprint.m-box?setmgrname=mboxobj&amp;fcardid=4&amp;reffcardid=3"?PHPSESSID=bouq4a3sddqfeqp4hrobr4bur0>Impressum</a>

------------------------------------------------------------------------

[2009-09-04 11:41:36] jani@php.net

Please provide a proper test case which does not have any external
requirements.

------------------------------------------------------------------------

[2009-08-21 21:46:10] k dot triendl at m-box dot at

Description:
------------
If output_buffering is set to 4096 and session.use_trans_sid is used,
the output may be broken:

<a href="index.php"?PHPSESSID=fa562d5bb14df890e6db68627ea76442>


I've found that the same bug was reported in 2003 for php-4.3.8 (which
was fixed back then) and filed under #29333:
http://bugs.php.net/bug.php?id=29333.
The problem is reproducable with the code that Alan has still on his
website.

I hope it's ok to refer to bug #29333.

Reproduce code:
---------------
As described in #29333

Expected result:
----------------
As described in #29333

Actual result:
--------------
As described in #29333


------------------------------------------------------------------------


-- 
Edit this bug report at http://bugs.php.net/?id=49326&edit=1

Thread (7 messages)

« previous php.bugs (#142406) next »