Bug #19874
Typo3 4.1.8: fe_session_data regression due to session fixation (bug 10146)
| Status: | Resolved | Start date: | 2009-01-21 | |
|---|---|---|---|---|
| Priority: | Should have | Due date: | ||
| Assigned To: | Michael Stucki | % Done: | 0% |
|
| Category: | Communication | Spent time: | - | |
| Target version: | - | |||
| TYPO3 Version: | 4.1 | Is Regression: | ||
| PHP Version: | 5.1 | Sprint Focus: | ||
| Complexity: |
Description
In bug 10146 (which I cannot access, but is referenced in the changelog), session fixation has been fixed, so that a new session ID gets generated on each request, if there is no user logged in (the new isExistingSessionRecord checks for this).
However, this renders the fe_session_data table (through $fe_user::setKey('ses', ..)) for anonymous visitors useless: as long as you're not authenticated you'll get a new Session ID on each request and therefore any data stored in the session is lost.
I think the fix might be to expand the isExistingSessionRecord method to also look for entries with the current session ID in fe_session_data (instead of only fe_sessions).
This has been reported to fail with 4.2.4, too.
(issue imported from #M10211)
Related issues