php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #6987 Session ID being modified mid-session
Submitted: 2000-10-03 03:35 UTC Modified: 2000-10-27 16:53 UTC
From: mosch at overtone dot org Assigned:
Status: Closed Package: Session related
PHP Version: 4.0.2 OS: FreeBSD 4.1-STABLE Sept 11
Private report: No CVE-ID: None
View Add Comment Developer Edit
Welcome! If you don't have a Git account, you can't do anything here.
You can add a comment by following this link or if you reported this bug, you can edit this bug over here.
(description)
Block user comment
Status: Assign to:
Package:
Bug Type:
Summary:
From: mosch at overtone dot org
New email:
PHP Version: OS:

 

 [2000-10-03 03:35 UTC] mosch at overtone dot org
========= description
in the given sample scripts, the given session identifier is lost between test4nc.php and test5nc.php reliably.  At this point the session gets a new identifier, and continues, obviously losing any data stored in the previous session.

========= configure info
'./configure' '--with-imap' '--with-solid' '--with-gettext' '--enable-debug' '--enable-debugger' '--enable-snmp' '--enable-track-vars' '--enable-trans-sid' '--without-gd' '--with-apxs=/usr/local/sbin/apxs' '--disable-magic-quotes' '--enable-short-tags' '--without-mysql' '--without-tsrm-pthreads'
========= php.ini

[PHP]                                                                         engine                  =       On
short_open_tag  =       On
asp_tags                =       Off
precision               =       14
y2k_compliance  =       On
output_buffering        = Off
implicit_flush = Off
allow_call_time_pass_reference  = Off

safe_mode               = Off
safe_mode_exec_dir      =
safe_mode_allowed_env_vars = PHP_
safe_mode_protected_env_vars = LD_LIBRARY_PATH
disable_functions       =

highlight.string        =       #DD0000
highlight.comment       =       #FF8000
highlight.keyword       =       #007700
highlight.bg            =       #FFFFFF
highlight.default       =       #0000BB
highlight.html          =       #000000

expose_php      =       On

max_execution_time = 60
memory_limit = 67108864

error_reporting =       E_ALL & ~E_NOTICE
display_errors  =       On
log_errors              =       Off
track_errors    =       Off
warn_plus_overloading   =       Off


variables_order         =       "EGPCS"
register_globals        =       On
register_argc_argv      =       Off
track_vars              =       On

magic_quotes_gpc        =   On
magic_quotes_runtime    =   Off
magic_quotes_sybase     =       Off

auto_prepend_file       =
auto_append_file        =

default_mimetype = "text/html"
default_charset = "iso-8859-1"

include_path    = .:/usr/local/www/data/include
doc_root                =
user_dir                =
upload_max_filesize = 1
extension_dir   =       ./
enable_dl               = On
[Syslog]
define_syslog_variables = Off

[mail function]
sendmail_path   = /usr/sbin/sendmail   

[Debugger]
debugger.host   =       localhost
debugger.port   =       7869
debugger.enabled        =       False  

[SQL]
sql.safe_mode   =       Off

[ODBC]
uodbc.allow_persistent  =       On
uodbc.check_persistent  =       On
uodbc.max_persistent    =       10
uodbc.max_links         =       10 
uodbc.defaultbinmode    =       1

[Session]
session.save_handler      = files   ; handler used to store/retrieve data
session.save_path         = /tmp    ; argument passed to save_handler
                                    ; in the case of files, this is the
                                    ; path where data files are stored
session.use_cookies       = 0
session.name              = TICS
session.auto_start        = 0       ; initialize session on request startup
session.cookie_lifetime   = 0       ; lifetime in seconds of cookie
                                    ; or if 0, until browser is restarted
session.cookie_path       = /       ; the path the cookie is valid for
session.cookie_domain     =         ; the domain the cookie is valid for
session.serialize_handler = php     ; handler used to serialize data
                                    ; php is the standard serializer of PHP
session.gc_probability    = 1       ; percentual probability that the
                                    ; 'garbage collection' process is started
                                    ; on every session initialization
session.gc_maxlifetime    = 1440    ; after this number of seconds, stored
                                    ; data will be seen as 'garbage' and
                                    ; cleaned up by the gc process
session.referer_check     = 1
session.entropy_length    = 16
session.entropy_file      = /dev/urandom
session.cache_limiter     = nocache ; set to {nocache,private,public} to
session.cache_expire      = 180

======== unique information

none that i'm aware of... it's a fairly basic setup.

======== script to duplicate problem.

-test1nc.php
<?
session_start();

session_id("SOMETHING");

if (!session_is_registered("bleh"))
{
        session_register("bleh");
}
$bleh = 6;

print "I set bleh to 6\n";

$href = "test2nc.php";

print '<a href="' . $href . '">test2</a>';

?>

-test2nc.php
<?
session_start();

Header("Location: test3nc.php?" . sid );

?>

-test3nc.php
<?
session_start();

print "bleh is $bleh \n";

$href = "test4nc.php";

print '<a href="' . $href . '">test4</a>';

?>

-test4nc.php
<?
session_start();

?>
Hooray, Y2K!
<form action="test5nc.php" method="post">
<input type=text name=foo maxlength=14>
<input type=submit name="Continue" value=" Continue ">
</form>

-test5nc.php
<?
session_start();

print "foo is $foo <br>\n";
print "bleh is $bleh \n";

$href = "test6nc.php";
print "<form action=\"$href\" method=\"post\">\n";
print "<input type=\"text\" name=\"username\" size=\"10\">\n";
print "<input type=\"submit\" name=\"go\" value=\"next\">\n";
print "</form>\n";

?>

-test6nc.php<?
session_start();

print "foo is $foo <br>\n";
print "bleh is $bleh \n";

$href = "test6nc.php";
print "<form action=\"$href\" method=\"post\">\n";
print "<input type=\"text\" name=\"username\" size=\"10\">\n";
print "<input type=\"submit\" name=\"go\" value=\"next\">\n";
print "</form>\n";

?>

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2000-10-03 03:37 UTC] mosch at overtone dot org
this is reproducable with the latest version out of CVS as of 2 Octobre 2000.
 [2000-10-03 04:00 UTC] mosch at overtone dot org
I changed session.referer_check to 0 after being pointed at the code in session.c around line 882.  This caused the session identifier to be lost all the time rather than just between test4nc and test5nc.
 [2000-10-03 04:11 UTC] mosch at overtone dot org
I changed session.referer_check to 0 after being pointed at the code in session.c around line 882.  This caused the session identifier to be lost all the time rather than just between test4nc and test5nc.
 [2000-10-27 16:53 UTC] sas@php.net
We add a hidden field in forms now.
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Sun Apr 28 23:01:32 2024 UTC