#29333 [Csd]: output_buffering + trans_sess_id can corrupt session

ID: 29333 Updated by: alan_k@php.net Reported By: alan at akbkhome dot com Status: Closed Bug Type: Output Control Operating System: linux debian & redhat PHP Version: 4.3.8 New Comment: thanks illia - awsome work Previous Comments: ------------------------------------------------------------------------ [2004-07-23 05:32:28] iliaa@php.net This bug has been fixed in CVS. Snapshots of the sources are packaged every three hours; this change will be in the next snapshot. You can grab the snapshot at http://snaps.php.net/. Thank you for the report, and for helping us make PHP better. ------------------------------------------------------------------------ [2004-07-22 18:36:57] alan_k@php.net Relivant changes (as far as I can see) that may have caused this (possible) http://cvs.php.net/diff.php/php-src/main/output.c?r1=1.142.2.15&r2=1.142&ty=u (unlikely) http://cvs.php.net/diff.php/php-src/ext/standard/url_scanner_ex.re?r1=1.63.2.6&r2=1.63&ty=u ------------------------------------------------------------------------ [2004-07-22 17:30:59] alan_k@php.net Note: this code worked perfectly on 4.3.1 ------------------------------------------------------------------------ [2004-07-22 17:26:04] alan at akbkhome dot com Description: ------------ if output_buffering is set to 4096 and trans_sess_id is used, the output may be broken: In the reproduce example, the trans_sess_id writes <a href="/translators/index.php/calendar/view" ?phpsessid="fa562d5bb14df890e6db68627ea76442"> Reproduce code: --------------- http://www.akbkhome.com/svn/test_trans/.htaccess http://www.akbkhome.com/svn/test_trans/test.php http://www.akbkhome.com/svn/test_trans/home.html.en.php htaccess includes: php_value session.use_cookies 0 php_value session.use_trans_sid 1 php_value output_buffering 4098 test.php just sets up enough variables to render the HTML home.html.en.php is just a HTML which happens to have the url link in the right place to reproduce the bug. Expected result: ---------------- on the "View your personal calendar": <a href="/translators/index.php/calendar/view?phpsessid=fa562d5bb14df890e6db68627ea76442"> Actual result: -------------- on the "View your personal calendar": <a href="/translators/index.php/calendar/view" ?phpsessid="fa562d5bb14df890e6db68627ea76442"> ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=29333&edit=1