cvs: php4(PHP_4_2_0) / php.ini-dist php.ini-recommended /ext/session session.c

yohgaki Wed Aug 14 18:35:37 2002 EDT Modified files: (Branch: PHP_4_2_0) /php4 php.ini-dist php.ini-recommended /php4/ext/session session.c Log: MFH. Trans SID related changes. Index: php4/php.ini-dist diff -u php4/php.ini-dist:1.112.2.3 php4/php.ini-dist:1.112.2.4 --- php4/php.ini-dist:1.112.2.3 Fri Jul 19 05:47:05 2002 +++ php4/php.ini-dist Wed Aug 14 18:35:36 2002 @@ -746,8 +746,14 @@ session.cache_expire = 180 ; trans sid support is disabled by default. -; Use of trans sid may risk your users security. It may not be -; feasible to use this option for some sites. Use this option with caution. +; Use of trans sid may risk your users security. +; Use this option with caution. +; - User may send URL contains active session ID +; to other person via. email/irc/etc. +; - URL that contains active session ID may be stored +; in publically accessible computer. +; - User may access your site with the same session ID +; always using URL stored in browser's history or bookmarks. session.use_trans_sid = 0 url_rewriter.tags = "a=href,area=href,frame=src,input=src,form=fakeentry" Index: php4/php.ini-recommended diff -u php4/php.ini-recommended:1.66.2.4 php4/php.ini-recommended:1.66.2.5 --- php4/php.ini-recommended:1.66.2.4 Fri Jul 19 05:47:06 2002 +++ php4/php.ini-recommended Wed Aug 14 18:35:36 2002 @@ -753,8 +753,14 @@ session.cache_expire = 180 ; trans sid support is disabled by default. -; Use of trans sid may risk your users security and it may not be -; feasible to use it for some sites. Use this option with caution. +; Use of trans sid may risk your users security. +; Use this option with caution. +; - User may send URL contains active session ID +; to other person via. email/irc/etc. +; - URL that contains active session ID may be stored +; in publically accessible computer. +; - User may access your site with the same session ID +; always using URL stored in browser's history or bookmarks. session.use_trans_sid = 0 url_rewriter.tags = "a=href,area=href,frame=src,input=src,form=fakeentry" Index: php4/ext/session/session.c diff -u php4/ext/session/session.c:1.292.2.1 php4/ext/session/session.c:1.292.2.2 --- php4/ext/session/session.c:1.292.2.1 Tue Apr 23 14:10:06 2002 +++ php4/ext/session/session.c Wed Aug 14 18:35:36 2002 @@ -17,7 +17,7 @@ +----------------------------------------------------------------------+ */ -/* $Id: session.c,v 1.292.2.1 2002/04/23 18:10:06 sas Exp $ */ +/* $Id: session.c,v 1.292.2.2 2002/08/14 22:35:36 yohgaki Exp $ */ #ifdef HAVE_CONFIG_H #include "config.h" @@ -154,7 +154,7 @@ STD_PHP_INI_ENTRY("session.entropy_length", "0", PHP_INI_ALL, OnUpdateInt, entropy_length, php_ps_globals, ps_globals) STD_PHP_INI_ENTRY("session.cache_limiter", "nocache", PHP_INI_ALL, OnUpdateString, cache_limiter, php_ps_globals, ps_globals) STD_PHP_INI_ENTRY("session.cache_expire", "180", PHP_INI_ALL, OnUpdateInt, cache_expire, php_ps_globals, ps_globals) - STD_PHP_INI_ENTRY("session.use_trans_sid", "1", PHP_INI_ALL, OnUpdateBool, use_trans_sid, php_ps_globals, ps_globals) + STD_PHP_INI_ENTRY("session.use_trans_sid", "0", PHP_INI_ALL, OnUpdateBool, use_trans_sid, php_ps_globals, ps_globals) /* Commented out until future discussion */ /* PHP_INI_ENTRY("session.encode_sources", "globals,track", PHP_INI_ALL, NULL) */ PHP_INI_END()