From: number3@windogs.com
Operating system: Linux 2.4.18
PHP version: 4.2.2
PHP Bug Type: Session related
Bug description: PHPSESSID, The Session Key is chagned in same page
Hi,
i have used the php session with pgsql handler, for user authencation.
but I find that the php session key, PHPSESSID is changed same page. that
sistuation is not always, but a few time.
my debug code below.
--------------------------------------------
session_register("userinfo");
$q_update = "UPDATE session SET userid = '".$userinfo->id."' WHERE
sesskey
= '".$PHPSESSID."'";
pg_exec($conn, $q_update);
--------------------------------------------
the register value "userinfo" is class var.
in debug result, the empty PHPSESSID value, not null value value is
recorded.
and Session key is threr changed.
1. orginal sesskey
2. empty sesskey
3. new sesskey
That result in no login because sesskey is changed.
why that cause ?
addition, why be The PHPSESSID empty value ?
that is not normal. that situtaion result in session share.
1. user A -> login with sesskey1(sucess)
2. user B -> login with sesskey2(sucess)
3. user A -> logout and new sesskey in empty value
4. user B -> logout and new sesskey in empty value
5. so A and B share same sesskey.
After that sistuation,
6. user A login sucessful, and
user B load other page, that user B have user A's session value, so user A
and B share session with empty sesskey.
That is prevented from php session lib that empty value of sesskey no
permitted.
thanks for advanced.
--
Edit bug report at http://bugs.php.net/?id=18855&edit=1
--
Fixed in CVS: http://bugs.php.net/fix.php?id=18855&r=fixedcvs
Fixed in release: http://bugs.php.net/fix.php?id=18855&r=alreadyfixed
Need backtrace: http://bugs.php.net/fix.php?id=18855&r=needtrace
Try newer version: http://bugs.php.net/fix.php?id=18855&r=oldversion
Not developer issue: http://bugs.php.net/fix.php?id=18855&r=support
Expected behavior: http://bugs.php.net/fix.php?id=18855&r=notwrong
Not enough info: http://bugs.php.net/fix.php?id=18855&r=notenoughinfo
Submitted twice: http://bugs.php.net/fix.php?id=18855&r=submittedtwice
register_globals: http://bugs.php.net/fix.php?id=18855&r=globals