Re: trans-sid warning?
| From: | Rasmus Lerdorf | Date: | Sun, 18 Aug 2002 22:13:10 +0000 |
| Subject: | Re: trans-sid warning? | ||
| References: | 1 | Groups: | php.dev |
| Request: | Send a blank email to php-dev+get-87043@lists.php.net to get a copy of this message | ||
> Il 23:54, domenica 18 agosto 2002, Rasmus Lerdorf ha scritto:
> > Hrm.. Wait a second though, Giancarlo is saying that if the user passes
> > in a session id himself and that session does not exist, then that will be
> > the session id he will be given if a session is created on that request.
> > Is that correct, Giancarlo?
> >
>
> Well, yor browser has to be 'virgin' with regards to that cookie.
> You musn't have received one already. to be an available victim
Even if you haven't received a cookie already, I don't think you can set
the session id the way you describe. Can you get PHP to create
/tmp/sess_123 given my example?
-Rasmus