note 93603 deleted from function.session-start by danbrown
| From: | danbrown@php.net | Date: | Thu, 17 Sep 2009 21:36:47 +0000 |
| Subject: | note 93603 deleted from function.session-start by danbrown | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-160811@lists.php.net to get a copy of this message | ||
Note Submitter: bencollver at gmail dot com
----
Here is a potential security problem where client requests can access the session variables of
others. Note: this is not a bug in PHP.
http://bugs.php.net/bug.php?id=38260
Here is the workaround.
<?php
session_start();
if (session_id() == 'deleted') {
session_regenerate_id(true);
}
?>