php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Bug #46250 wrong session id passed to read handler
Submitted: 2008-10-07 23:45 UTC Modified: 2008-10-18 17:47 UTC
From: axel dot starck at contec dot ca Assigned:
Status: Not a bug Package: Session related
PHP Version: 5.3.0alpha2 OS: Linux RedHat 8, 2.4.20-20.8cus
Private report: No CVE-ID: None
View Developer Edit
 [2008-10-07 23:45 UTC] axel dot starck at contec dot ca 
Description:
------------
we have our own db base session handler.
it looks like with v5.3.0 the session id passed to the read handler is not not the one passed as parameter to the script.
the code is in production for years. switching back to v5.2.6
solves the problem. see code/trace snipped below


Reproduce code:
---------------
error_log ("-1-".$_SERVER["REQUEST_URI"]."--".print_r ($_REQUEST, true)."--");
....
function sess_read ($id)
{
  error_log ("--sess_read (id=$id)--");
  ...................
}
.........
session_set_save_handler ('sess_open', 'sess_close', 'sess_read', 'sess_write', 'sess_destroy', 'sess_gc');

if (session_start ()) error_log ("session_start:GOOD");
else                  error_log ("session_start:BAAD");
error_log ("-2-SID:".SID."--".print_r ($_SESSION, true)."--");

-----------------------------------------------------------------------------
[07-Oct-2008 16:29:53] -1-/projects/svn/ui/base/index.php?HORNET=d72592f9adf5b04c74bb269a799aef53--Array
(
    [HORNET] => d72592f9adf5b04c74bb269a799aef53
)
--
[07-Oct-2008 16:29:53] --sess_read (id=22cf7b3c5d839f71bc5ae12e608c1675)--
[07-Oct-2008 16:29:53] session_start:GOOD
[07-Oct-2008 16:29:53] -2-SID:HORNET=22cf7b3c5d839f71bc5ae12e608c1675--Array
(
)
--

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2008-10-08 18:19 UTC] jani@php.net 
Is the same php.ini used for both? Check all the session.* ini 
options in both versions phpinfo() output..
 [2008-10-08 21:45 UTC] axel dot starck at contec dot ca 
found it:

; This option enables administrators to make their users invulnerable to
; attacks which involve passing session ids in URLs; defaults to 0.
; session.use_only_cookies = 1

use_only_cookies defaults to 0 in 5.2.6
but defaults to 1 in 5.3.0alpha2
setting it to 0 solves the problem

session.use_only_cookies = 0
 [2008-10-16 01:00 UTC] php-bugs at lists dot php dot net 
No feedback was provided for this bug for over a week, so it is
being suspended automatically. If you are able to provide the
information that was originally requested, please do so and change
the status of the bug back to "Open".
 [2008-10-18 17:47 UTC] felipe@php.net 
.
 
PHP Copyright © 2001-2025 The PHP Group
All rights reserved. 		Last updated: Sat Nov 22 01:00:02 2025 UTC