#50424 [Opn->Fbk]: PHPSESSID being exposed in code even if trans.sid is set or not
| From: | jani@php.net | Date: | Wed, 09 Dec 2009 10:59:22 +0000 |
| Subject: | #50424 [Opn->Fbk]: PHPSESSID being exposed in code even if trans.sid is set or not | ||
| References: | 1 | Groups: | php.bugs |
| Request: | Send a blank email to php-bugs+get-145570@lists.php.net to get a copy of this message | ||
ID: 50424
Updated by: jani@php.net
Reported By: donauinsel at hotmail dot com
-Status: Open
+Status: Feedback
Bug Type: Session related
Operating System: Windows 2003
PHP Version: 5.2.12RC3
New Comment:
Exactly what PHP version are you using? What does phpinfo() say about
the session settings?
Previous Comments:
------------------------------------------------------------------------
[2009-12-09 10:19:08] donauinsel at hotmail dot com
Description:
------------
On Windows 2003 it seems, that PHPSESSID is exposed into HTML Code even
if session.use_trans_sid is set or not (but it should be disabled by
deefault). PHPSESSID going into all links so url rewriter tags seems to
be skipped for some reason. This behavior happens while useing ISAPI
mode.
Reproduce code:
---------------
I cannot give enough information for reproducable code but it seems to
happen when using a template engine which EVAL's the template.
------------------------------------------------------------------------
--
Edit this bug report at http://bugs.php.net/?id=50424&edit=1