From: Stanislav Malyshev <stas@php.net>
Date: Mon, 5 Aug 2013 03:04:42 +0000 (-0700)
Subject: add news about session fix
X-Git-Tag: php-5.6.0alpha1~341^2
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=e59143e8966c0b6aa07ca72b6ad27f64baad0a01;p=php

add news about session fix
---

diff --git a/NEWS b/NEWS
index 82d4ca1572..c01b43ed7b 100644
--- a/NEWS
+++ b/NEWS
@@ -1,5 +1,12 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
+?? ??? 2013, PHP 5.5.3
+
+- Sessions:
+  . Implemented strict sessions RFC (https://wiki.php.net/rfc/strict_sessions)
+    which protects against session fixation attacks and session collisions.    
+    (Yasuo Ohgaki)
+
 ?? ??? 2013, PHP 5.5.2
 
 - Core:
diff --git a/UPGRADING b/UPGRADING
index 14e19aa583..4985665a0f 100755
--- a/UPGRADING
+++ b/UPGRADING
@@ -412,6 +412,11 @@ None
     ext/mysqli to be used with the new auth protocol, although at
     coarser level.
 
+- Sessions:
+  - Added session.use_strict_mode in 5.5.3, which prevents session
+    fixation attacks and session collisions. 
+    See also https://wiki.php.net/rfc/strict_sessions
+
 - Zend OPcache (See http://php.net/manual/en/book.opcache.php)
   - Added the following directives:
     - opcache.enable (default "1")