Fix #1034 (CVE-2015-2171)

slimphp · Mar 2, 2015 · 9fa6514 · 9fa6514
1 parent 2d80935
commit 9fa6514
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/Slim/Middleware/SessionCookie.php b/Slim/Middleware/SessionCookie.php
@@ -124,7 +124,7 @@ protected function loadSession()
 
         if ($value) {
             try {
-                $_SESSION = unserialize($value);
+                $_SESSION = json_decode($value, true);
             } catch (\Exception $e) {
                 $this->app->getLog()->error('Error unserializing session cookie value! ' . $e->getMessage());
             }
@@ -138,7 +138,7 @@ protected function loadSession()
      */
     protected function saveSession()
     {
-        $value = serialize($_SESSION);
+        $value = json_encode($_SESSION);
 
         if (strlen($value) > 4096) {
             $this->app->getLog()->error('WARNING! Slim\Middleware\SessionCookie data size is larger than 4KB. Content save failed.');