note 64084 deleted from function.session-start by bjori
| From: | bjori@php.net | Date: | Fri, 07 Apr 2006 06:57:49 +0000 |
| Subject: | note 64084 deleted from function.session-start by bjori | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-107484@lists.php.net to get a copy of this message | ||
Note Submitter: admin at ndevix dot com
Reason: bad code
----
As for passing the session id to a pop up you may want to consider this in case of browser
hijacking.
on the page the pop up is launched from have
<?
session_start();
$_SESSION['ip']=$_SERVER['REMOTE_ADDR'];
?>
window.open('popup.php?u=<?php echo session_id(); ?>', '700x500',
'toolbar=no, status=no, scrollbars=yes, location=no, menubar=no, directories=no, width=700,
height=500');
and on the pop up have
<?
session_start();
if($_SESSION['uid']=='') {
session_id(strip_tags($_GET['u']));
session_start();
if($_SESSION['ip']!==$_SERVER['REMOTE_ADDR']) {
session_destroy();
echo 'HACKER!!!.. Your ip was logged and we are now going to watch you.';
exit();
}
}
?>
then continue on with pop up code. Hope this helps people worried about security.