php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Request #23827 trans sid don't takes care about MIME type of generated content
Submitted: 2003-05-27 03:49 UTC Modified: 2012-03-31 04:38 UTC
From: flying at dom dot natm dot ru Assigned:
Status: Wont fix Package: Session related
PHP Version: 4.3.1 OS: All
Private report: No CVE-ID: None
View Developer Edit
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: flying at dom dot natm dot ru
New email:
PHP Version: OS:

 

 [2003-05-27 03:49 UTC] flying at dom dot natm dot ru 
 When enable-trans-sid is ON in php.ini - PHP transforms all generated contents, regardless of its actual type, but it should only do it for HTML (XHTML, WML and so on) contents.
 For example take a look at this example:

<?php
header('Content-type: text/plain');
session_start();
echo '<html><body><a href="test.php">test</a></body></html>';
?>

 Generated content is HTML, but actual type of generated content is text/plain and hence it have nothing to do with sessions. But content transformation still occurs and resulted output is:

<html><body><a href="test.php?PHPSESSID=135a5afcbbf97014a56caf4bd8c4200b">test</a></body></html>

instead of expected:

<html><body><a href="test.php">test</a></body></html>

 Even more interesting things may appear when somebody will try to output som mixed code+text content when there will be something like HTML link.

 Suggested way to fix is to add a parameter to php.ini where will be listed MIME types of content, which should be transformed.

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2003-05-27 11:43 UTC] sniper@php.net 
Not really bug, but a feature request. 
Fast solution: Never use trans-sid, it's unsafe anyway.
 [2011-01-01 01:33 UTC] jani@php.net
-Package: Feature/Change Request +Package: Session related
 [2012-03-31 04:38 UTC] yohgaki@php.net
-Status: Open +Status: Wont fix
 [2012-03-31 04:38 UTC] yohgaki@php.net 
With output buffer, header() can may be called anywhere. 
Therefore, fixing this involves rewriting output buffers which is not feasible.

You should control it via session.use_trans_sid.
 
PHP Copyright © 2001-2025 The PHP Group
All rights reserved. 		Last updated: Fri May 09 15:01:27 2025 UTC