Skip to content

Commit

Permalink
Disallow "." in session.name
Browse files Browse the repository at this point in the history
PHP saves cookie with correct name, but upon deserialization to
$_COOKIE, it replaces "." characters with "_".

This is probably also reason why \SessionHandler is not able to find
a session.

https://harrybailey.com/2009/04/dots-arent-allowed-in-php-cookie-names/
https://bugs.php.net/bug.php?id=75883
  • Loading branch information
ostrolucky committed May 12, 2018
1 parent 00c61da commit 1548744
Showing 1 changed file with 6 additions and 1 deletion.
Expand Up @@ -339,7 +339,12 @@ private function addSessionSection(ArrayNodeDefinition $rootNode)
->children()
->scalarNode('storage_id')->defaultValue('session.storage.native')->end()
->scalarNode('handler_id')->defaultValue('session.handler.native_file')->end()
->scalarNode('name')->end()
->scalarNode('name')
->validate()
->ifTrue(function ($v) { return false !== strpos($v, '.'); })
->thenInvalid('Session name can not contain character "."')
->end()
->end()
->scalarNode('cookie_lifetime')->end()
->scalarNode('cookie_path')->end()
->scalarNode('cookie_domain')->end()
Expand Down

0 comments on commit 1548744

Please sign in to comment.