note 11159 deleted from function.session-start by jimw
| From: | jimw@php.net | Date: | Fri, 07 Dec 2001 20:25:22 +0000 |
| Subject: | note 11159 deleted from function.session-start by jimw | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-21897@lists.php.net to get a copy of this message | ||
***SECURITY ALERT***
If you have a session variable (e.g. $admin), and don't always have it registered (you only
register it when an admin logs in), people can load page.php?admin=1 and have access to any data
that you show with "if ($admin) {...}"
Solutions:
1. Check for the session variable only with "$HTTP_SESSION_VARS[admin]" OR
2. At the beginning of each page that uses $admin type "$admin =
$HTTP_SESSION_VARS[admin]". That will force $admin to have a session value (or if it's
not set, a null value which is false anyway).
You can also do:
$initvars = array("admin", "sessionvar2", "sessionvar3");
for ($i = 0; $i < sizeOf($array); $i++) {
${$initvars[$i]} = $HTTP_SESSION_VARS[$initvars[$i]];
}
... and include it in every page that uses sessions.