iliaa Sun Jan 15 16:51:34 2006 UTC
Modified files:
/php-src/ext/session session.c
Log:
MFB51: Added a check for special characters in the session name.
http://cvs.php.net/viewcvs.cgi/php-src/ext/session/session.c?r1=1.425&r2=1.426&diff_format=u
Index: php-src/ext/session/session.c
diff -u php-src/ext/session/session.c:1.425 php-src/ext/session/session.c:1.426
--- php-src/ext/session/session.c:1.425 Sun Jan 1 13:09:53 2006
+++ php-src/ext/session/session.c Sun Jan 15 16:51:34 2006
@@ -17,7 +17,7 @@
+----------------------------------------------------------------------+
*/
-/* $Id: session.c,v 1.425 2006/01/01 13:09:53 sniper Exp $ */
+/* $Id: session.c,v 1.426 2006/01/15 16:51:34 iliaa Exp $ */
#ifdef HAVE_CONFIG_H
#include "config.h"
@@ -743,6 +743,12 @@
char *val;
int vallen;
+ /* check session name for invalid characters */
+ if (PS(id) && strpbrk(PS(id), "\r\n\t <>'\"\\")) {
+ efree(PS(id));
+ PS(id) = NULL;
+ }
+
if (!PS(mod)) {
php_error_docref(NULL TSRMLS_CC, E_ERROR, "No storage module
chosen - failed to initialize session.");
return;
--
PHP CVS Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php
