php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Request #23827 trans sid don't takes care about MIME type of generated content
Submitted: 2003-05-27 03:49 UTC Modified: 2012-03-31 04:38 UTC
From: flying at dom dot natm dot ru Assigned:
Status: Wont fix Package: Session related
PHP Version: 4.3.1 OS: All
Private report: No CVE-ID: None
View Add Comment Developer Edit
Have you experienced this issue?
Rate the importance of this bug to you:

 [2003-05-27 03:49 UTC] flying at dom dot natm dot ru 
 When enable-trans-sid is ON in php.ini - PHP transforms all generated contents, regardless of its actual type, but it should only do it for HTML (XHTML, WML and so on) contents.
 For example take a look at this example:

<?php
header('Content-type: text/plain');
session_start();
echo '<html><body><a href="test.php">test</a></body></html>';
?>

 Generated content is HTML, but actual type of generated content is text/plain and hence it have nothing to do with sessions. But content transformation still occurs and resulted output is:

<html><body><a href="test.php?PHPSESSID=135a5afcbbf97014a56caf4bd8c4200b">test</a></body></html>

instead of expected:

<html><body><a href="test.php">test</a></body></html>

 Even more interesting things may appear when somebody will try to output som mixed code+text content when there will be something like HTML link.

 Suggested way to fix is to add a parameter to php.ini where will be listed MIME types of content, which should be transformed.

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2003-05-27 11:43 UTC] sniper@php.net 
Not really bug, but a feature request. 
Fast solution: Never use trans-sid, it's unsafe anyway.
 [2011-01-01 01:33 UTC] jani@php.net
-Package: Feature/Change Request +Package: Session related
 [2012-03-31 04:38 UTC] yohgaki@php.net
-Status: Open +Status: Wont fix
 [2012-03-31 04:38 UTC] yohgaki@php.net 
With output buffer, header() can may be called anywhere. 
Therefore, fixing this involves rewriting output buffers which is not feasible.

You should control it via session.use_trans_sid.
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved. 		Last updated: Sat Apr 20 06:01:28 2024 UTC