[TEP-COMMIT] CVS: catalog/catalog/includes/classes session.php,1.1,1.2 session_compatible.php,1.1,1.2

Update of /cvsroot/tep/catalog/catalog/includes/classes
In directory sc8-pr-cvs1:/tmp/cvs-serv2509/includes/classes

Modified Files:
	session.php session_compatible.php 
Log Message:
redirect the user to the index page when a malformed session ID is in use,
to generate a new session ID

the session ID regeneration method ($osC_Session->recreate()) is not being
used as it cannot be used with PHP < 4.1 servers - redirecting the user
to start a new session ID remains compatible to all PHP servers


Index: session.php
===================================================================
RCS file: /cvsroot/tep/catalog/catalog/includes/classes/session.php,v
retrieving revision 1.1
retrieving revision 1.2
diff -u -d -r1.1 -r1.2
--- session.php	17 Nov 2003 16:55:21 -0000	1.1
+++ session.php	17 Dec 2003 15:33:21 -0000	1.2
@@ -39,7 +39,35 @@
 
 // class methods
     function start() {
-      if (session_start()) {
+      if (PHP_VERSION < 4.1) {
+        global $_GET, $_POST, $_COOKIE;
+      }
+
+      $sane_session_id = true;
+
+      if (isset($_GET[$this->name])) {
+        if (preg_match('/^[a-zA-Z0-9]+$/', $_GET[$this->name]) == false) {
+          unset($_GET[$this->name]);
+
+          $sane_session_id = false;
+        }
+      } elseif (isset($_POST[$this->name])) {
+        if (preg_match('/^[a-zA-Z0-9]+$/', $_POST[$this->name]) == false) {
+          unset($_POST[$this->name]);
+
+          $sane_session_id = false;
+        }
+      } elseif (isset($_COOKIE[$this->name])) {
+        if (preg_match('/^[a-zA-Z0-9]+$/', $_COOKIE[$this->name]) == false) {
+          unset($_COOKIE[$this->name]);
+
+          $sane_session_id = false;
+        }
+      }
+
+      if ($sane_session_id == false) {
+        tep_redirect(tep_href_link(FILENAME_DEFAULT, '', 'NONSSL', false));
+      } elseif (session_start()) {
         $this->setStarted(true);
 
         $this->setID();

Index: session_compatible.php
===================================================================
RCS file: /cvsroot/tep/catalog/catalog/includes/classes/session_compatible.php,v
retrieving revision 1.1
retrieving revision 1.2
diff -u -d -r1.1 -r1.2
--- session_compatible.php	17 Nov 2003 16:55:21 -0000	1.1
+++ session_compatible.php	17 Dec 2003 15:33:21 -0000	1.2
@@ -39,7 +39,35 @@
 
 // class methods
     function start() {
-      if (session_start()) {
+      if (PHP_VERSION < 4.1) {
+        global $_GET, $_POST, $_COOKIE;
+      }
+
+      $sane_session_id = true;
+
+      if (isset($_GET[$this->name])) {
+        if (preg_match('/^[a-zA-Z0-9]+$/', $_GET[$this->name]) == false) {
+          unset($_GET[$this->name]);
+
+          $sane_session_id = false;
+        }
+      } elseif (isset($_POST[$this->name])) {
+        if (preg_match('/^[a-zA-Z0-9]+$/', $_POST[$this->name]) == false) {
+          unset($_POST[$this->name]);
+
+          $sane_session_id = false;
+        }
+      } elseif (isset($_COOKIE[$this->name])) {
+        if (preg_match('/^[a-zA-Z0-9]+$/', $_COOKIE[$this->name]) == false) {
+          unset($_COOKIE[$this->name]);
+
+          $sane_session_id = false;
+        }
+      }
+
+      if ($sane_session_id == false) {
+        tep_redirect(tep_href_link(FILENAME_DEFAULT, '', 'NONSSL', false));
+      } elseif (session_start()) {
         $this->setStarted(true);
 
         $this->setID();



-------------------------------------------------------
This SF.net email is sponsored by: IBM Linux Tutorials.
Become an expert in LINUX or just sharpen your skills.  Sign up for IBM's
Free Linux Tutorials.  Learn everything from the bash shell to sys admin.
Click now! http://ads.osdn.com/?ad_id=1278&alloc_id=3371&op=click