note 38249 deleted from ref.session by betz

Note Submitter: spagmoid at yahoo dot NOSPAMcom ---- WARNING: Yet another dangerous/possibly faulty thing has been added to the session handler, without adequate explanation of it's effects. referer_check sounds like a great idea - but if you don't understand what it really does, your site could have problems that are very difficult to track down. Especially if you have 2 sites that link back and forth. Consider this: you have a user logged in, happily enjoying a cookie-based session. He clicks on a link to another site. He then clicks a link that returns him to your site, and finds that he is locked out. His session has been reset, even though the SID was not in the URL, it was safely in a cookie. Now consider that he had another browser window open, filling out a 5-page form. When he submits, it will all be lost. A combination of factors on my site has resulted in 10% of new signups being completely LOCKED OUT the last few weeks. For now, DO NOT USE referer_check. You could easily write your own, that only checks the URL/POST for the session info, rather than the cookie. Then you would also be able to log when it happens. I think this "feature" should be removed - sessions are too important and fragile to be toyed around with.