Bug #80774 [NEW]: session_name() problem with backslash
From: chirpinternet at gmail dot com
Operating system: Debian
PHP version: 7.3.27
Package: Session related
Bug Type: Bug
Bug description:session_name() problem with backslash
Description:
------------
We have a trait for handling sessions, which includes (abbreviated):
trait SessionOpenCloseTrait {
protected function open_session($name) {
session_name($name);
session_start();
}
}
Other classes invoke this using __CLASS__ as the $name parameter:
class SecureToken {
use SessionOpenCloseTrait;
public function __construct() {
$this->open_session(__CLASS__);
}
}
When namespaced, __CLASS__ contains a backslash (e.g.
"Parent\SecureToken"). This has not been a problem until a security
upgrade took us from 7.3.19 to 7.3.27. After the upgrade the SESSION
was being written to the server as normal, but no longer accessible on
subsequent requests. *Possibly* due to encoding of the cookie name.
To fix this, we had to remove the '\':
protected function open_session($name) {
+ $name = str_replace("\\", "", $name);
session_name($name);
session_start();
}
--
Edit bug report at https://bugs.php.net/bug.php?id=80774&edit=1
--
Fix committed: https://bugs.php.net/fix.php?id=80774&r=fixed
Fixed in release: https://bugs.php.net/fix.php?id=80774&r=alreadyfixed
Need backtrace: https://bugs.php.net/fix.php?id=80774&r=needtrace
Need Reproduce Script: https://bugs.php.net/fix.php?id=80774&r=needscript
Try newer version: https://bugs.php.net/fix.php?id=80774&r=oldversion
Not developer issue: https://bugs.php.net/fix.php?id=80774&r=support
Expected behavior: https://bugs.php.net/fix.php?id=80774&r=notwrong
Not enough info: https://bugs.php.net/fix.php?id=80774&r=notenoughinfo
Submitted twice: https://bugs.php.net/fix.php?id=80774&r=submittedtwice
register_globals: https://bugs.php.net/fix.php?id=80774&r=globals
PHP version support discontinued: https://bugs.php.net/fix.php?id=80774&r=phptooold
Daylight Savings: https://bugs.php.net/fix.php?id=80774&r=dst
IIS Stability: https://bugs.php.net/fix.php?id=80774&r=isapi
Install GNU Sed: https://bugs.php.net/fix.php?id=80774&r=gnused
Floating point limitations: https://bugs.php.net/fix.php?id=80774&r=float
No Zend Extensions: https://bugs.php.net/fix.php?id=80774&r=nozend
MySQL Configuration Error: https://bugs.php.net/fix.php?id=80774&r=mysqlcfg
Thread (4 messages)
- chirpinternet at gmail dot com