#36328 [NoF->Opn]: Random vhosts and .htaccess configuration leaks
ID: 36328
User updated by: technophreak at gammae dot com
Reported By: technophreak at gammae dot com
-Status: No Feedback
+Status: Open
Bug Type: Apache2 related
Operating System: Fedora Core 4
-PHP Version: 5.0.5
+PHP Version: 5.1.2, Latest CVS
New Comment:
I've just tried with BUILD Apr 30 2006 16:49:02 in Latest CVS, same
problem occurs.
Similar bug report: #36257
Previous Comments:
------------------------------------------------------------------------
[2006-02-19 01:00:04] php-bugs at lists dot php dot net
No feedback was provided for this bug for over a week, so it is
being suspended automatically. If you are able to provide the
information that was originally requested, please do so and change
the status of the bug back to "Open".
------------------------------------------------------------------------
[2006-02-11 13:23:33] sniper@php.net
Please try using this CVS snapshot:
http://snaps.php.net/php5.1-latest.tar.gz
For Windows:
http://snaps.php.net/win32/php5.1-win32-latest.zip
------------------------------------------------------------------------
[2006-02-08 15:55:35] technophreak at gammae dot com
Changed the Summary to something people will expect to look for if they
have the same problem.
------------------------------------------------------------------------
[2006-02-08 02:48:54] technophreak at gammae dot com
Description:
------------
Problem is similar to BUG #25753
I am running Apache 2.0.55
I have seen this bug with PHP 5.0.5 also.
Some configuration gets leaked into random vhosts.
Reproduce code:
---------------
Let's have 3 different web sites using 3 vhosts.
One of those vhost, lets call it vhost A, I set a .htaccess file into
the document_root folder:
php_flag session.use_trans_sid on
php_flag session.use_cookies off
-
If I load a page wich has a session ID already set in the cookies in
Vhost B or C, the session ID will be changed as if I would load the
page with no cookie.
Here is a really simple code: <? print session_id(); ?>
Note: This happens maybe 1 time on 50 so you have to refresh the page a
lot of times.
Expected result:
----------------
Should print ALWAYS the same session ID as long as the session doesnt
expire.
Actual result:
--------------
Sometimes, the session ID changes because session does not use cookies
because the VHOST A .htaccess leaked to VHOST B.
------------------------------------------------------------------------
--
Edit this bug report at http://bugs.php.net/?id=36328&edit=1
Thread (6 messages)