Req #72744 [NEW]: https://wiki.php.net/rfc/session-id-without-hashing

From: spam2 at rhsoft dot net Operating system: PHP version: Next Minor Version Package: Session related Bug Type: Feature/Change Request Bug description:https://wiki.php.net/rfc/session-id-without-hashing Description: ------------ > Compatible defaults: session.sid_length=32, session.sid_bits_per_character=4 > (128 bits session ID. No BC break) that is not true in case of smarter sysadmins which swicthed away from the MD5 default years ago and hence in case the sesstings are present in "php.ini" it should change it's default behavior to *really* be compatible ____________________________ session.entropy_length = 32 session.hash_function = 1 session.hash_bits_per_character = 6 SecRule REQUEST_COOKIES_NAMES|ARGS_NAMES "(^PHPSESSID$|JSESSIONID$|ASPSESSIONID$|ASP\.NET_SessionId$)" "id:'133',phase:2,capture,logdata:'%{TX.0}',block,msg:'Invalid SessionID name not allowed'" SecRule ARGS_NAMES "(^LOUNGE_ID$|PANEL_ID$)""id:'134',phase:2,capture,logdata:'%{TX.0}',block,msg:'LOUNGE_ID not allowed via GET or POST'" SecRule REQUEST_COOKIES:LOUNGE_ID|REQUEST_COOKIES:PANEL_ID "!@rx ^[-a-z0-9,]{27}$" "id:'135',phase:2,logdata:'%{matched_var}',t:urlDecodeUni,t:lowercase,block,msg:'Unexpected value for LOUNGE_ID'" -- Edit bug report at https://bugs.php.net/bug.php?id=72744&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=72744&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=72744&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=72744&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=72744&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=72744&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=72744&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=72744&r=needscript Try newer version: https://bugs.php.net/fix.php?id=72744&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=72744&r=support Expected behavior: https://bugs.php.net/fix.php?id=72744&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=72744&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=72744&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=72744&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=72744&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=72744&r=dst IIS Stability: https://bugs.php.net/fix.php?id=72744&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=72744&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=72744&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=72744&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=72744&r=mysqlcfg