note 93603 modified in function.session-start by danbrown
| From: | danbrown@php.net | Date: | Thu, 17 Sep 2009 21:36:28 +0000 |
| Subject: | note 93603 modified in function.session-start by danbrown | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-160810@lists.php.net to get a copy of this message | ||
Here is a potential security problem where client requests can access the session variables of
others. Note: this is not a bug in PHP.
http://bugs.php.net/bug.php?id=38260
Here is the workaround.
<?php
session_start();
if (session_id() == 'deleted') {
session_regenerate_id(true);
}
?>
--was--
Here is a potential security problem where client requests can access the session variables of
others. Note: this is not a bug in PHP.
http://bugs.php.net/bug.php?id=38260
Here is the workaround.
session_start();
if (session_id() == 'deleted') {
session_regenerate_id(true);
}
http://php.net/manual/en/function.session-start.php