diff options
| author | Yasuo Ohgaki <yohgaki@php.net> | 2002-07-19 09:45:07 +0000 |
|---|---|---|
| committer | Yasuo Ohgaki <yohgaki@php.net> | 2002-07-19 09:45:07 +0000 |
| commit | fd428a4882177fbc49d73794bfcff3d05556fc07 (patch) | |
| tree | da1ce12f8a3442860e1117e781d96a0b6eb67238 | |
| parent | 70a5d29ecef065a67d07ff1b526df601157e9d98 (diff) | |
| download | php-git-fd428a4882177fbc49d73794bfcff3d05556fc07.tar.gz | |
This option should be left enabled by default by mistake.
--enable-trans-sid option is removed and this option should
be disabled by default in php.ini.
1) It's insecure by nature
2) It may not work well always
3) It wasn't enabled by default used be
4) It risks security and user should enable it after realizing
it's security risks.
| -rw-r--r-- | php.ini-dist | 6 | ||||
| -rw-r--r-- | php.ini-recommended | 6 |
2 files changed, 8 insertions, 4 deletions
diff --git a/php.ini-dist b/php.ini-dist index 7bae2ec1f5..ec0fb08625 100644 --- a/php.ini-dist +++ b/php.ini-dist @@ -784,8 +784,10 @@ session.cache_limiter = nocache ; Document expires after n minutes. session.cache_expire = 180 -; use transient sid support if enabled by compiling with --enable-trans-sid. -session.use_trans_sid = 1 +; trans sid support is disabled by default. +; Use of trans sid may risk your users security. It may not be +; feasible to use this option for some sites. Use this option with caution. +session.use_trans_sid = 0 url_rewriter.tags = "a=href,area=href,frame=src,input=src,form=fakeentry" diff --git a/php.ini-recommended b/php.ini-recommended index f3cd3989ed..663b8d9f71 100644 --- a/php.ini-recommended +++ b/php.ini-recommended @@ -791,8 +791,10 @@ session.cache_limiter = nocache ; Document expires after n minutes. session.cache_expire = 180 -; use transient sid support if enabled by compiling with --enable-trans-sid. -session.use_trans_sid = 1 +; trans sid support is disabled by default. +; Use of trans sid may risk your users security. It may not be +; feasible to use this option for some sites. Use this option with caution. +session.use_trans_sid = 0 url_rewriter.tags = "a=href,area=href,frame=src,input=src,form=fakeentry" |