From: Yasuo Ohgaki <yohgaki@php.net>
Date: Tue, 20 Aug 2013 09:30:30 +0000 (+0900)
Subject: Add session.use_strict_mode description to php.ini-*
X-Git-Tag: php-5.5.6RC1~18^2
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=4cd9796be78bfb1cc88b5ed71cbd61e56937b8e7;p=php

Add session.use_strict_mode description to php.ini-*
---

diff --git a/php.ini-development b/php.ini-development
index 7197dae6fc..43ab1de26a 100644
--- a/php.ini-development
+++ b/php.ini-development
@@ -1398,6 +1398,14 @@ session.save_handler = files
 ; http://php.net/session.save-path
 ;session.save_path = "/tmp"
 
+; Whether to use strict session mode.
+; Strict session mode does not accept uninitialized session ID and regenerate
+; session ID if browser sends uninitialized session ID. Strict mode protects
+; applications from session fixation via session adoption vulnerability. It is
+; disabled by default for maximum compatibility, but enabling it is encouraged.
+; https://wiki.php.net/rfc/strict_sessions
+session.use_strict_mode = 0
+
 ; Whether to use cookies.
 ; http://php.net/session.use-cookies
 session.use_cookies = 1
diff --git a/php.ini-production b/php.ini-production
index 5590d2c448..0014c4e251 100644
--- a/php.ini-production
+++ b/php.ini-production
@@ -1398,6 +1398,14 @@ session.save_handler = files
 ; http://php.net/session.save-path
 ;session.save_path = "/tmp"
 
+; Whether to use strict session mode.
+; Strict session mode does not accept uninitialized session ID and regenerate
+; session ID if browser sends uninitialized session ID. Strict mode protects
+; applications from session fixation via session adoption vulnerability. It is
+; disabled by default for maximum compatibility, but enabling it is encouraged.
+; https://wiki.php.net/rfc/strict_sessions
+session.use_strict_mode = 0
+
 ; Whether to use cookies.
 ; http://php.net/session.use-cookies
 session.use_cookies = 1