Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:90636
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 74.125.82.51 as permitted sender)
MIME-Version: 1.0
Sender: julienpauli@gmail.com
In-Reply-To: <56958637.5080807@gmail.com>
References: <CAGa2bXZzvkBDkqLF2U3yPSprQwqBdHbW9QCZ-nzjA1G4CM8QkQ@mail.gmail.com>
 <56958637.5080807@gmail.com>
Date: Thu, 14 Jan 2016 11:21:46 +0100
Message-ID: <CAMUwpuRJmVsHCW9VsMTsSgDcAcc1WPjmCHDcwkboN92oL1Q5CQ@mail.gmail.com>
To: Stanislav Malyshev <smalyshev@gmail.com>
Cc: Yasuo Ohgaki <yohgaki@ohgaki.net>, "internals@lists.php.net" <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Subject: Re: [PHP-DEV] Fixing bug #68063
From: jpauli@php.net (Julien Pauli)

On Wed, Jan 13, 2016 at 12:03 AM, Stanislav Malyshev
<smalyshev@gmail.com> wrote:
> Hi!
>
>> I've disallowed empty session ID, but it wasn't a
>> appropriate fix.
>>
>> https://bugs.php.net/bug.php?id=68063
>
> Could you explain a bit more about the part where there are empty IDs
> generated? You say it "is browser's cookie handling" - could you explain
> more about it?
>
>> I made appropriate patch for this issue. It should be
>> applied from PHP 5.5 to master. I attached patch to
>> the bug report. Could you apply it from PHP 5.5? Or
>> shall I commit it from 5.6? then cherry pick?
>
> Is that a security issue? If so, please explain how. If not, it should
> be 5.6+.

IMO, this is not security related.


Julien.Pauli