PHP :: Bug #6123 :: Transparent Session ID (SID) miss substitution.

Bug #6123	Transparent Session ID (SID) miss substitution.
Submitted:	2000-08-12 09:38 UTC	Modified:	2000-08-12 09:41 UTC
From:	geoff at zone12 dot com	Assigned:
Status:	Closed	Package:	Session related
PHP Version:	4.0.1pl2	OS:	Linux 2.2.10
Private report:	No	CVE-ID:	None

View Add Comment Developer Edit

[2000-08-12 09:38 UTC] geoff at zone12 dot com

the code:
<A HREF="/contact/info.php?ID=<? print "1"; ?>"> blah </A>
is morphed into:
<A HREF="/contact/info.php?ID=&PHPSESSID=d420a697e7b1a7af11007fac138a49a61"> blah </A>

On line 167 of "url_scanner.re" the pattern matching thing stops after it sees the second quote.. could this be what's happening?  (I guess the code's being substituted before the php stuff is removed.)

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports

[2000-08-12 09:41 UTC] sterling@php.net

Fixed in CVS.

	php.net \| support \| documentation \| report a bug \| advanced search \| search howto \| statistics \| random bug \| login
go to bug id or search bugs for


Copyright © 2001-2024 The PHP Group All rights reserved.	Last updated: Fri Apr 19 01:01:28 2024 UTC