From 3d80bd0cdf65b18bca2fdf5ba2538e31e992d253 Mon Sep 17 00:00:00 2001 From: Ilia Alshanetsky Date: Sun, 15 Jan 2006 16:51:18 +0000 Subject: [PATCH] Added a check for special characters in the session name. --- NEWS | 1 + ext/session/session.c | 6 ++++++ 2 files changed, 7 insertions(+) diff --git a/NEWS b/NEWS index b78ffd6246..50dddc5e29 100644 --- a/NEWS +++ b/NEWS @@ -1,6 +1,7 @@ PHP NEWS ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| ?? ??? 2006, PHP 5.1.3 +- Added a check for special characters in the session name. (Ilia) - Added "consumed" stream filter. (Marcus) - Added new mysqli constants for BIT and NEW_DECIMAL field types: MYSQLI_TYPE_NEWDECIMAL and MYSQLI_TYPE_BIT. FR #36007. (Georg) diff --git a/ext/session/session.c b/ext/session/session.c index 1afd6ba51b..2d13421f6c 100644 --- a/ext/session/session.c +++ b/ext/session/session.c @@ -741,6 +741,12 @@ static void php_session_initialize(TSRMLS_D) char *val; int vallen; + /* check session name for invalid characters */ + if (PS(id) && strpbrk(PS(id), "\r\n\t <>'\"\\")) { + efree(PS(id)); + PS(id) = NULL; + } + if (!PS(mod)) { php_error_docref(NULL TSRMLS_CC, E_ERROR, "No storage module chosen - failed to initialize session."); return; -- 2.50.1