Re: Strict session?
| From: | Yasuo Ohgaki | Date: | Fri, 02 Dec 2011 09:51:36 +0000 |
| Subject: | Re: Strict session? | ||
| References: | 1 2 3 4 5 6 7 8 9 10 11 12 13 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-56720@lists.php.net to get a copy of this message | ||
Hi Ferenc,
2011/12/2 Ferenc Kovacs <tyra3l@gmail.com>:
>
> wouldn't it be better if we push the session id validation to the
> application level?
> we should provide a hook both to the C api and to
> the session_set_save_handler.
> of course we can additionally change the default range of valid characters
> for the default session handler implementation, but it would still possible
> for the application developer to change or extend that.
>
It's possible with session_set_save_handler(), but users should
implement all save handlers. session_set_save_handler() could be
modified just to add validation function and choose any chars except
chars invalidated by php_session_initialize()
/* check session name for invalid characters */
if (PS(id) && strpbrk(PS(id), "\r\n\t <>'\"\\")) {
efree(PS(id));
PS(id) = NULL;
}
For example, we may do
bool session_set_save_handler(SESSION_SET_VALIDATE_ID,
"my_validation_id_function");
There are many possible implementations.
Any comments?
Regards,
--
Yasuo Ohgaki
yohgaki@ohgaki.net