#36328 [Opn]: Random vhosts and .htaccess configuration leaks
ID: 36328
User updated by: technophreak at gammae dot com
-Summary: Random vhosts and .htaccess ini propagation
Reported By: technophreak at gammae dot com
Status: Open
Bug Type: Apache2 related
Operating System: Fedora Core 4
PHP Version: 5.1.2
New Comment:
Changed the Summary to something people will expect to look for if they
have the same problem.
Previous Comments:
------------------------------------------------------------------------
[2006-02-08 02:48:54] technophreak at gammae dot com
Description:
------------
Problem is similar to BUG #25753
I am running Apache 2.0.55
I have seen this bug with PHP 5.0.5 also.
Some configuration gets leaked into random vhosts.
Reproduce code:
---------------
Let's have 3 different web sites using 3 vhosts.
One of those vhost, lets call it vhost A, I set a .htaccess file into
the document_root folder:
php_flag session.use_trans_sid on
php_flag session.use_cookies off
-
If I load a page wich has a session ID already set in the cookies in
Vhost B or C, the session ID will be changed as if I would load the
page with no cookie.
Here is a really simple code: <? print session_id(); ?>
Note: This happens maybe 1 time on 50 so you have to refresh the page a
lot of times.
Expected result:
----------------
Should print ALWAYS the same session ID as long as the session doesnt
expire.
Actual result:
--------------
Sometimes, the session ID changes because session does not use cookies
because the VHOST A .htaccess leaked to VHOST B.
------------------------------------------------------------------------
--
Edit this bug report at http://bugs.php.net/?id=36328&edit=1
Thread (6 messages)