note 106394 deleted from function.session-start by peehaa

Note Submitter: max_bilyk at yahoo dot com ---- An interesting bug/misfunction was discovered when using Flash-based file uploader (in my case jQuery plugin Uploadify, but also found similar problem reports about SWFupload). Problem occurs with PHP 5.2 (and probably later as well) when it is compiled with Suhosin patch. The problem is that session_start() does not load session data into $_SESSION variable when it gets request from Flash, and in this case $_SESSION variable becomes empty and at the end of script execution erases session data when script execution ends (PHP saves this empty $_SESSION to file). The fact that Flash is using its own session management is solved by passing via POST/GET correct session ID, but erasing session data is definitely a problem. The reason for the problem is method of session data encryption - Suhosin uses user-agent data as a part of encryption key. And in case client machine makes requests from two different user-agents (browser + flash) Suhosin generates different session decryption key which is unable to decrypt session data (and notice that there's no message about this fact in any log-file). So the solution for such case may be either by disabling encryption of session data by putting such directive in php.ini: suhosin.session.encrypt=Off or, alternatively, still keep session data encrypted but exclude user-agent data from encryption key by using this directive in php.ini: suhosin.session.cryptua=Off