php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #6987 Session ID being modified mid-session
Submitted: 2000-10-03 03:35 UTC Modified: 2000-10-27 16:53 UTC
From: mosch at overtone dot org Assigned:
Status: Closed Package: Session related
PHP Version: 4.0.2 OS: FreeBSD 4.1-STABLE Sept 11
Private report: No CVE-ID: None
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: mosch at overtone dot org
New email:
PHP Version: OS:

 

 [2000-10-03 03:35 UTC] mosch at overtone dot org
========= description
in the given sample scripts, the given session identifier is lost between test4nc.php and test5nc.php reliably.  At this point the session gets a new identifier, and continues, obviously losing any data stored in the previous session.

========= configure info
'./configure' '--with-imap' '--with-solid' '--with-gettext' '--enable-debug' '--enable-debugger' '--enable-snmp' '--enable-track-vars' '--enable-trans-sid' '--without-gd' '--with-apxs=/usr/local/sbin/apxs' '--disable-magic-quotes' '--enable-short-tags' '--without-mysql' '--without-tsrm-pthreads'
========= php.ini

[PHP]                                                                         engine                  =       On
short_open_tag  =       On
asp_tags                =       Off
precision               =       14
y2k_compliance  =       On
output_buffering        = Off
implicit_flush = Off
allow_call_time_pass_reference  = Off

safe_mode               = Off
safe_mode_exec_dir      =
safe_mode_allowed_env_vars = PHP_
safe_mode_protected_env_vars = LD_LIBRARY_PATH
disable_functions       =

highlight.string        =       #DD0000
highlight.comment       =       #FF8000
highlight.keyword       =       #007700
highlight.bg            =       #FFFFFF
highlight.default       =       #0000BB
highlight.html          =       #000000

expose_php      =       On

max_execution_time = 60
memory_limit = 67108864

error_reporting =       E_ALL & ~E_NOTICE
display_errors  =       On
log_errors              =       Off
track_errors    =       Off
warn_plus_overloading   =       Off


variables_order         =       "EGPCS"
register_globals        =       On
register_argc_argv      =       Off
track_vars              =       On

magic_quotes_gpc        =   On
magic_quotes_runtime    =   Off
magic_quotes_sybase     =       Off

auto_prepend_file       =
auto_append_file        =

default_mimetype = "text/html"
default_charset = "iso-8859-1"

include_path    = .:/usr/local/www/data/include
doc_root                =
user_dir                =
upload_max_filesize = 1
extension_dir   =       ./
enable_dl               = On
[Syslog]
define_syslog_variables = Off

[mail function]
sendmail_path   = /usr/sbin/sendmail   

[Debugger]
debugger.host   =       localhost
debugger.port   =       7869
debugger.enabled        =       False  

[SQL]
sql.safe_mode   =       Off

[ODBC]
uodbc.allow_persistent  =       On
uodbc.check_persistent  =       On
uodbc.max_persistent    =       10
uodbc.max_links         =       10 
uodbc.defaultbinmode    =       1

[Session]
session.save_handler      = files   ; handler used to store/retrieve data
session.save_path         = /tmp    ; argument passed to save_handler
                                    ; in the case of files, this is the
                                    ; path where data files are stored
session.use_cookies       = 0
session.name              = TICS
session.auto_start        = 0       ; initialize session on request startup
session.cookie_lifetime   = 0       ; lifetime in seconds of cookie
                                    ; or if 0, until browser is restarted
session.cookie_path       = /       ; the path the cookie is valid for
session.cookie_domain     =         ; the domain the cookie is valid for
session.serialize_handler = php     ; handler used to serialize data
                                    ; php is the standard serializer of PHP
session.gc_probability    = 1       ; percentual probability that the
                                    ; 'garbage collection' process is started
                                    ; on every session initialization
session.gc_maxlifetime    = 1440    ; after this number of seconds, stored
                                    ; data will be seen as 'garbage' and
                                    ; cleaned up by the gc process
session.referer_check     = 1
session.entropy_length    = 16
session.entropy_file      = /dev/urandom
session.cache_limiter     = nocache ; set to {nocache,private,public} to
session.cache_expire      = 180

======== unique information

none that i'm aware of... it's a fairly basic setup.

======== script to duplicate problem.

-test1nc.php
<?
session_start();

session_id("SOMETHING");

if (!session_is_registered("bleh"))
{
        session_register("bleh");
}
$bleh = 6;

print "I set bleh to 6\n";

$href = "test2nc.php";

print '<a href="' . $href . '">test2</a>';

?>

-test2nc.php
<?
session_start();

Header("Location: test3nc.php?" . sid );

?>

-test3nc.php
<?
session_start();

print "bleh is $bleh \n";

$href = "test4nc.php";

print '<a href="' . $href . '">test4</a>';

?>

-test4nc.php
<?
session_start();

?>
Hooray, Y2K!
<form action="test5nc.php" method="post">
<input type=text name=foo maxlength=14>
<input type=submit name="Continue" value=" Continue ">
</form>

-test5nc.php
<?
session_start();

print "foo is $foo <br>\n";
print "bleh is $bleh \n";

$href = "test6nc.php";
print "<form action=\"$href\" method=\"post\">\n";
print "<input type=\"text\" name=\"username\" size=\"10\">\n";
print "<input type=\"submit\" name=\"go\" value=\"next\">\n";
print "</form>\n";

?>

-test6nc.php<?
session_start();

print "foo is $foo <br>\n";
print "bleh is $bleh \n";

$href = "test6nc.php";
print "<form action=\"$href\" method=\"post\">\n";
print "<input type=\"text\" name=\"username\" size=\"10\">\n";
print "<input type=\"submit\" name=\"go\" value=\"next\">\n";
print "</form>\n";

?>

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2000-10-03 03:37 UTC] mosch at overtone dot org
this is reproducable with the latest version out of CVS as of 2 Octobre 2000.
 [2000-10-03 04:00 UTC] mosch at overtone dot org
I changed session.referer_check to 0 after being pointed at the code in session.c around line 882.  This caused the session identifier to be lost all the time rather than just between test4nc and test5nc.
 [2000-10-03 04:11 UTC] mosch at overtone dot org
I changed session.referer_check to 0 after being pointed at the code in session.c around line 882.  This caused the session identifier to be lost all the time rather than just between test4nc and test5nc.
 [2000-10-27 16:53 UTC] sas@php.net
We add a hidden field in forms now.
 
PHP Copyright © 2001-2025 The PHP Group
All rights reserved.
Last updated: Tue Jul 01 04:01:36 2025 UTC