PHP 4.0 Bug #6987 Updated: Session ID being modified mid-session

ID: 6987 User Update by: mosch@overtone.org Status: Open Bug Type: *Session related Description: Session ID being modified mid-session I changed session.referer_check to 0 after being pointed at the code in session.c around line 882. This caused the session identifier to be lost all the time rather than just between test4nc and test5nc. Previous Comments: --------------------------------------------------------------------------- [2000-10-03 03:37:49] mosch@overtone.org this is reproducable with the latest version out of CVS as of 2 Octobre 2000. --------------------------------------------------------------------------- [2000-10-03 03:35:50] mosch@overtone.org ========= description in the given sample scripts, the given session identifier is lost between test4nc.php and test5nc.php reliably. At this point the session gets a new identifier, and continues, obviously losing any data stored in the previous session. ========= configure info './configure' '--with-imap' '--with-solid' '--with-gettext' '--enable-debug' '--enable-debugger' '--enable-snmp' '--enable-track-vars' '--enable-trans-sid' '--without-gd' '--with-apxs=/usr/local/sbin/apxs' '--disable-magic-quotes' '--enable-short-tags' '--without-mysql' '--without-tsrm-pthreads' ========= php.ini [PHP] engine = On short_open_tag = On asp_tags = Off precision = 14 y2k_compliance = On output_buffering = Off implicit_flush = Off allow_call_time_pass_reference = Off safe_mode = Off safe_mode_exec_dir = safe_mode_allowed_env_vars = PHP_ safe_mode_protected_env_vars = LD_LIBRARY_PATH disable_functions = highlight.string = #DD0000 highlight.comment = #FF8000 highlight.keyword = #007700 highlight.bg = #FFFFFF highlight.default = #0000BB highlight.html = #000000 expose_php = On max_execution_time = 60 memory_limit = 67108864 error_reporting = E_ALL & ~E_NOTICE display_errors = On log_errors = Off track_errors = Off warn_plus_overloading = Off variables_order = "EGPCS" register_globals = On register_argc_argv = Off track_vars = On magic_quotes_gpc = On magic_quotes_runtime = Off magic_quotes_sybase = Off auto_prepend_file = auto_append_file = default_mimetype = "text/html" default_charset = "iso-8859-1" include_path = .:/usr/local/www/data/include doc_root = user_dir = upload_max_filesize = 1 extension_dir = ./ enable_dl = On [Syslog] define_syslog_variables = Off [mail function] sendmail_path = /usr/sbin/sendmail [Debugger] debugger.host = localhost debugger.port = 7869 debugger.enabled = False [SQL] sql.safe_mode = Off [ODBC] uodbc.allow_persistent = On uodbc.check_persistent = On uodbc.max_persistent = 10 uodbc.max_links = 10 uodbc.defaultbinmode = 1 [Session] session.save_handler = files ; handler used to store/retrieve data session.save_path = /tmp ; argument passed to save_handler ; in the case of files, this is the ; path where data files are stored session.use_cookies = 0 session.name = TICS session.auto_start = 0 ; initialize session on request startup session.cookie_lifetime = 0 ; lifetime in seconds of cookie ; or if 0, until browser is restarted session.cookie_path = / ; the path the cookie is valid for session.cookie_domain = ; the domain the cookie is valid for session.serialize_handler = php ; handler used to serialize data ; php is the standard serializer of PHP session.gc_probability = 1 ; percentual probability that the ; 'garbage collection' process is started ; on every session initialization session.gc_maxlifetime = 1440 ; after this number of seconds, stored ; data will be seen as 'garbage' and ; cleaned up by the gc process session.referer_check = 1 session.entropy_length = 16 session.entropy_file = /dev/urandom session.cache_limiter = nocache ; set to {nocache,private,public} to session.cache_expire = 180 ======== unique information none that i'm aware of... it's a fairly basic setup. ======== script to duplicate problem. -test1nc.php <? session_start(); session_id("SOMETHING"); if (!session_is_registered("bleh")) { session_register("bleh"); } $bleh = 6; print "I set bleh to 6n"; $href = "test2nc.php"; print '<a href="' . $href . '">test2</a>'; ?> -test2nc.php <? session_start(); Header("Location: test3nc.php?" . sid ); ?> -test3nc.php <? session_start(); print "bleh is $bleh n"; $href = "test4nc.php"; print '<a href="' . $href . '">test4</a>'; ?> -test4nc.php <? session_start(); ?> Hooray, Y2K! <form action="test5nc.php" method="post"> <input type=text name=foo maxlength=14> <input type=submit name="Continue" value=" Continue "> </form> -test5nc.php <? session_start(); print "foo is $foo <br>n"; print "bleh is $bleh n"; $href = "test6nc.php"; print "<form action="$href" method="post">n"; print "<input type="text" name="username" size="10">n"; print "<input type="submit" name="go" value="next">n"; print "</form>n"; ?> -test6nc.php<? session_start(); print "foo is $foo <br>n"; print "bleh is $bleh n"; $href = "test6nc.php"; print "<form action="$href" method="post">n"; print "<input type="text" name="username" size="10">n"; print "<input type="submit" name="go" value="next">n"; print "</form>n"; ?> --------------------------------------------------------------------------- Full Bug description available at: http://bugs.php.net/?id=6987