cvs: php4 / php.ini-dist php.ini-recommended

yohgaki Fri Jul 19 05:45:08 2002 EDT Modified files: /php4 php.ini-dist php.ini-recommended Log: This option should be left enabled by default by mistake. --enable-trans-sid option is removed and this option should be disabled by default in php.ini. 1) It's insecure by nature 2) It may not work well always 3) It wasn't enabled by default used be 4) It risks security and user should enable it after realizing it's security risks. Index: php4/php.ini-dist diff -u php4/php.ini-dist:1.136 php4/php.ini-dist:1.137 --- php4/php.ini-dist:1.136 Wed Jul 17 21:36:17 2002 +++ php4/php.ini-dist Fri Jul 19 05:45:07 2002 @@ -784,8 +784,10 @@ ; Document expires after n minutes. session.cache_expire = 180 -; use transient sid support if enabled by compiling with --enable-trans-sid. -session.use_trans_sid = 1 +; trans sid support is disabled by default. +; Use of trans sid may risk your users security. It may not be +; feasible to use this option for some sites. Use this option with caution. +session.use_trans_sid = 0 url_rewriter.tags = "a=href,area=href,frame=src,input=src,form=fakeentry" Index: php4/php.ini-recommended diff -u php4/php.ini-recommended:1.89 php4/php.ini-recommended:1.90 --- php4/php.ini-recommended:1.89 Wed Jul 17 21:36:17 2002 +++ php4/php.ini-recommended Fri Jul 19 05:45:07 2002 @@ -791,8 +791,10 @@ ; Document expires after n minutes. session.cache_expire = 180 -; use transient sid support if enabled by compiling with --enable-trans-sid. -session.use_trans_sid = 1 +; trans sid support is disabled by default. +; Use of trans sid may risk your users security. It may not be +; feasible to use this option for some sites. Use this option with caution. +session.use_trans_sid = 0 url_rewriter.tags = "a=href,area=href,frame=src,input=src,form=fakeentry"