Drupal 6.34

pressflow · Nov 19, 2014 · 01c9f61 · 01c9f61
1 parent c71b15f
commit 01c9f61
Show file tree

Hide file tree

Showing 3 changed files with 6 additions and 2 deletions.
diff --git a/CHANGELOG.txt b/CHANGELOG.txt
@@ -1,4 +1,8 @@
 
+Drupal 6.34, 2014-11-19
+----------------------
+- Fixed security issues (session hijacking). See SA-CORE-2014-006.
+
 Drupal 6.33, 2014-08-06
 ----------------------
 - Fixed security issues (denial of service). See SA-CORE-2014-004.

diff --git a/includes/session.inc b/includes/session.inc
@@ -41,7 +41,7 @@ function sess_read($key) {
   register_shutdown_function('session_write_close');
 
   // Handle the case of first time visitors and clients that don't store cookies (eg. web crawlers).
-  if (!isset($_COOKIE[session_name()])) {
+  if (empty($key) || !isset($_COOKIE[session_name()])) {
     $user = drupal_anonymous_user();
     return '';
   }

diff --git a/modules/system/system.module b/modules/system/system.module
@@ -8,7 +8,7 @@
 /**
  * The current system version.
  */
-define('VERSION', '6.33');
+define('VERSION', '6.34');
 
 /**
  * Core API compatibility.