PHP 4.0 Bug #6987: Session ID being modified mid-session

From: mosch@overtone.org Operating system: FreeBSD 4.1-STABLE Sept 11 PHP version: 4.0.2 PHP Bug Type: *Session related Bug description: Session ID being modified mid-session ========= description in the given sample scripts, the given session identifier is lost between test4nc.php and test5nc.php reliably. At this point the session gets a new identifier, and continues, obviously losing any data stored in the previous session. ========= configure info './configure' '--with-imap' '--with-solid' '--with-gettext' '--enable-debug' '--enable-debugger' '--enable-snmp' '--enable-track-vars' '--enable-trans-sid' '--without-gd' '--with-apxs=/usr/local/sbin/apxs' '--disable-magic-quotes' '--enable-short-tags' '--without-mysql' '--without-tsrm-pthreads' ========= php.ini [PHP] engine = On short_open_tag = On asp_tags = Off precision = 14 y2k_compliance = On output_buffering = Off implicit_flush = Off allow_call_time_pass_reference = Off safe_mode = Off safe_mode_exec_dir = safe_mode_allowed_env_vars = PHP_ safe_mode_protected_env_vars = LD_LIBRARY_PATH disable_functions = highlight.string = #DD0000 highlight.comment = #FF8000 highlight.keyword = #007700 highlight.bg = #FFFFFF highlight.default = #0000BB highlight.html = #000000 expose_php = On max_execution_time = 60 memory_limit = 67108864 error_reporting = E_ALL & ~E_NOTICE display_errors = On log_errors = Off track_errors = Off warn_plus_overloading = Off variables_order = "EGPCS" register_globals = On register_argc_argv = Off track_vars = On magic_quotes_gpc = On magic_quotes_runtime = Off magic_quotes_sybase = Off auto_prepend_file = auto_append_file = default_mimetype = "text/html" default_charset = "iso-8859-1" include_path = .:/usr/local/www/data/include doc_root = user_dir = upload_max_filesize = 1 extension_dir = ./ enable_dl = On [Syslog] define_syslog_variables = Off [mail function] sendmail_path = /usr/sbin/sendmail [Debugger] debugger.host = localhost debugger.port = 7869 debugger.enabled = False [SQL] sql.safe_mode = Off [ODBC] uodbc.allow_persistent = On uodbc.check_persistent = On uodbc.max_persistent = 10 uodbc.max_links = 10 uodbc.defaultbinmode = 1 [Session] session.save_handler = files ; handler used to store/retrieve data session.save_path = /tmp ; argument passed to save_handler ; in the case of files, this is the ; path where data files are stored session.use_cookies = 0 session.name = TICS session.auto_start = 0 ; initialize session on request startup session.cookie_lifetime = 0 ; lifetime in seconds of cookie ; or if 0, until browser is restarted session.cookie_path = / ; the path the cookie is valid for session.cookie_domain = ; the domain the cookie is valid for session.serialize_handler = php ; handler used to serialize data ; php is the standard serializer of PHP session.gc_probability = 1 ; percentual probability that the ; 'garbage collection' process is started ; on every session initialization session.gc_maxlifetime = 1440 ; after this number of seconds, stored ; data will be seen as 'garbage' and ; cleaned up by the gc process session.referer_check = 1 session.entropy_length = 16 session.entropy_file = /dev/urandom session.cache_limiter = nocache ; set to {nocache,private,public} to session.cache_expire = 180 ======== unique information none that i'm aware of... it's a fairly basic setup. ======== script to duplicate problem. -test1nc.php <? session_start(); session_id("SOMETHING"); if (!session_is_registered("bleh")) { session_register("bleh"); } $bleh = 6; print "I set bleh to 6\n"; $href = "test2nc.php"; print '<a href="' . $href . '">test2</a>'; ?> -test2nc.php <? session_start(); Header("Location: test3nc.php?" . sid ); ?> -test3nc.php <? session_start(); print "bleh is $bleh \n"; $href = "test4nc.php"; print '<a href="' . $href . '">test4</a>'; ?> -test4nc.php <? session_start(); ?> Hooray, Y2K! <form action="test5nc.php" method="post"> <input type=text name=foo maxlength=14> <input type=submit name="Continue" value=" Continue "> </form> -test5nc.php <? session_start(); print "foo is $foo <br>\n"; print "bleh is $bleh \n"; $href = "test6nc.php"; print "<form action=\"$href\" method=\"post\">\n"; print "<input type=\"text\" name=\"username\" size=\"10\">\n"; print "<input type=\"submit\" name=\"go\" value=\"next\">\n"; print "</form>\n"; ?> -test6nc.php<? session_start(); print "foo is $foo <br>\n"; print "bleh is $bleh \n"; $href = "test6nc.php"; print "<form action=\"$href\" method=\"post\">\n"; print "<input type=\"text\" name=\"username\" size=\"10\">\n"; print "<input type=\"submit\" name=\"go\" value=\"next\">\n"; print "</form>\n"; ?>