Add session.use_strict_mode description to php.ini-*

diff --git a/php.ini-development b/php.ini-development
index 7197dae6fc841120575fd0adb779a8b4509e32fa..43ab1de26a757077de1babe30a7abcec1c14ca89 100644 (file)
--- a/php.ini-development
+++ b/php.ini-development
@@ -1398,6 +1398,14 @@ session.save_handler = files
 ; http://php.net/session.save-path
 ;session.save_path = "/tmp"
 
+; Whether to use strict session mode.
+; Strict session mode does not accept uninitialized session ID and regenerate
+; session ID if browser sends uninitialized session ID. Strict mode protects
+; applications from session fixation via session adoption vulnerability. It is
+; disabled by default for maximum compatibility, but enabling it is encouraged.
+; https://wiki.php.net/rfc/strict_sessions
+session.use_strict_mode = 0
+
 ; Whether to use cookies.
 ; http://php.net/session.use-cookies
 session.use_cookies = 1

diff --git a/php.ini-production b/php.ini-production
index 5590d2c4487452aae2be03f641429bc911a6eb6a..0014c4e251c096da8c8015f3c4dd9e9aa08b6e3d 100644 (file)
--- a/php.ini-production
+++ b/php.ini-production
@@ -1398,6 +1398,14 @@ session.save_handler = files
 ; http://php.net/session.save-path
 ;session.save_path = "/tmp"
 
+; Whether to use strict session mode.
+; Strict session mode does not accept uninitialized session ID and regenerate
+; session ID if browser sends uninitialized session ID. Strict mode protects
+; applications from session fixation via session adoption vulnerability. It is
+; disabled by default for maximum compatibility, but enabling it is encouraged.
+; https://wiki.php.net/rfc/strict_sessions
+session.use_strict_mode = 0
+
 ; Whether to use cookies.
 ; http://php.net/session.use-cookies
 session.use_cookies = 1