- Changed "session.use_only_cookies" to be on by default.

diff --git a/ext/session/session.c b/ext/session/session.c
index 34d7794d39e43f6f8176d157fd62d56fe2b4896b..fd32a77a61b161bd4ae554b8a4fdfe769e041ecb 100644 (file)
--- a/ext/session/session.c
+++ b/ext/session/session.c
@@ -167,7 +167,7 @@ PHP_INI_BEGIN()
        STD_PHP_INI_ENTRY("session.cookie_domain",      "",          PHP_INI_ALL, OnUpdateString, cookie_domain,      php_ps_globals,    ps_globals)
        STD_PHP_INI_BOOLEAN("session.cookie_secure",    "",          PHP_INI_ALL, OnUpdateBool,   cookie_secure,      php_ps_globals,    ps_globals)
        STD_PHP_INI_BOOLEAN("session.use_cookies",      "1",         PHP_INI_ALL, OnUpdateBool,   use_cookies,        php_ps_globals,    ps_globals)
-       STD_PHP_INI_BOOLEAN("session.use_only_cookies", "0",         PHP_INI_ALL, OnUpdateBool,   use_only_cookies,   php_ps_globals,    ps_globals)
+       STD_PHP_INI_BOOLEAN("session.use_only_cookies", "1",         PHP_INI_ALL, OnUpdateBool,   use_only_cookies,   php_ps_globals,    ps_globals)
        STD_PHP_INI_ENTRY("session.referer_check",      "",          PHP_INI_ALL, OnUpdateString, extern_referer_chk, php_ps_globals,    ps_globals)
        STD_PHP_INI_ENTRY("session.entropy_file",       "",          PHP_INI_ALL, OnUpdateString, entropy_file,       php_ps_globals,    ps_globals)
        STD_PHP_INI_ENTRY("session.entropy_length",     "0",         PHP_INI_ALL, OnUpdateLong,    entropy_length,     php_ps_globals,    ps_globals)

diff --git a/php.ini-dist b/php.ini-dist
index de3c031e8d20aee309b7280cd066781777fd369d..eefaf9f22bf43f77bf1061c03a8036fec1d22852 100644 (file)
--- a/php.ini-dist
+++ b/php.ini-dist
@@ -895,8 +895,8 @@ session.save_handler = files
 session.use_cookies = 1
 
 ; This option enables administrators to make their users invulnerable to
-; attacks which involve passing session ids in URLs; defaults to 0.
-; session.use_only_cookies = 1
+; attacks which involve passing session ids in URLs; defaults to 1.
+session.use_only_cookies = 1
 
 ; Name of the session (used as cookie name).
 session.name = PHPSESSID

diff --git a/php.ini-recommended b/php.ini-recommended
index ba1ce7f38eb55c3d7647412ab34d8dca2851e116..cb4d0c1938cd41303c0c1c3f7225710c84c9596a 100644 (file)
--- a/php.ini-recommended
+++ b/php.ini-recommended
@@ -952,8 +952,8 @@ session.save_handler = files
 session.use_cookies = 1
 
 ; This option enables administrators to make their users invulnerable to
-; attacks which involve passing session ids in URLs; defaults to 0.
-; session.use_only_cookies = 1
+; attacks which involve passing session ids in URLs; defaults to 1.
+session.use_only_cookies = 1
 
 ; Name of the session (used as cookie name).
 session.name = PHPSESSID