diff --git a/application/Utils.php b/application/Utils.php index cb03f11c7..aa5cc193d 100755 --- a/application/Utils.php +++ b/application/Utils.php @@ -156,7 +156,7 @@ function is_session_id_valid($sessionId) return false; } - if (!preg_match('/^[a-z0-9]{2,32}$/i', $sessionId)) { + if (!preg_match('/^[-,a-z0-9]{1,128}$/i', $sessionId)) { return false; } diff --git a/index.php b/index.php index d615da1f5..e0a389cb3 100755 --- a/index.php +++ b/index.php @@ -92,16 +92,18 @@ // Prevent PHP form using sessionID in URL if cookies are disabled. ini_set('session.use_trans_sid', false); -// Regenerate session id if invalid or not defined in cookie. -if (isset($_COOKIE['shaarli']) && !is_session_id_valid($_COOKIE['shaarli'])) { - $_COOKIE['shaarli'] = uniqid(); -} session_name('shaarli'); // Start session if needed (Some server auto-start sessions). if (session_id() == '') { session_start(); } +// Regenerate session id if invalid or not defined in cookie. +if (isset($_COOKIE['shaarli']) && !is_session_id_valid($_COOKIE['shaarli'])) { + session_regenerate_id(true); + $_COOKIE['shaarli'] = session_id(); +} + include "inc/rain.tpl.class.php"; //include Rain TPL raintpl::$tpl_dir = $GLOBALS['config']['RAINTPL_TPL']; // template directory raintpl::$cache_dir = $GLOBALS['config']['RAINTPL_TMP']; // cache directory diff --git a/tests/UtilsTest.php b/tests/UtilsTest.php index 5175dde03..0de061b47 100755 --- a/tests/UtilsTest.php +++ b/tests/UtilsTest.php @@ -156,7 +156,7 @@ public function testCheckSupportedPHPVersion52() */ public function testIsSessionIdValid() { - $this->assertTrue(is_session_id_valid('azertyuiop123456789AZERTYUIOP1aA')); + $this->assertTrue(is_session_id_valid('iXJWB-H1w439c02a4ff8770d3a652d344-QhXGZlJsBPQnaeAGaG,SmZFcYxYsxtjXdlslXQn8UyHB0ZkGZeiN5ZAsUsR38YcICkTe1197k7pt5g7b10nq2sqp4bfssf')); } /** @@ -167,5 +167,6 @@ public function testIsSessionIdInvalid() $this->assertFalse(is_session_id_valid('')); $this->assertFalse(is_session_id_valid(array())); $this->assertFalse(is_session_id_valid('c0ZqcWF3VFE2NmJBdm1HMVQ0ZHJ3UmZPbTFsNGhkNHI=')); + $this->assertFalse(is_session_id_valid('c0asFsAfSffsAOfsdvZqcWF3VFE2d43asfNmJBdm1HMV3a8AsQ0ZHJ3UmZPbTFsNGhkNHI=')); } }