From 0de9cf1e73fe2b09990f4611057bb06788adfa3b Mon Sep 17 00:00:00 2001 From: Ilia Alshanetsky Date: Sun, 15 Jan 2006 16:51:34 +0000 Subject: [PATCH] MFB51: Added a check for special characters in the session name. --- ext/session/session.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/ext/session/session.c b/ext/session/session.c index d618b4c251..3a136ac075 100644 --- a/ext/session/session.c +++ b/ext/session/session.c @@ -743,6 +743,12 @@ static void php_session_initialize(TSRMLS_D) char *val; int vallen; + /* check session name for invalid characters */ + if (PS(id) && strpbrk(PS(id), "\r\n\t <>'\"\\")) { + efree(PS(id)); + PS(id) = NULL; + } + if (!PS(mod)) { php_error_docref(NULL TSRMLS_CC, E_ERROR, "No storage module chosen - failed to initialize session."); return; -- 2.40.0