Refuse session ids that PHP did not make.

2026-09-26 15:27:51 +02:00
parent 30b275b902
commit ed8918e7fd
3 changed files with 15 additions and 0 deletions
@@ -5,6 +5,8 @@ require_once('./get_data.lib.php');
 $queue = get_queue();
 if ($queue) session_cache_limiter('nocache');
 else session_cache_limiter('none');
+// Refuse a session id that PHP did not make, so nobody can plant one
+ini_set('session.use_strict_mode', '1');
 session_set_cookie_params(array('lifetime' => 0, 'path' => '/', 'domain' => cookie_domain(), 'secure' => TRUE, 'httponly' => TRUE, 'samesite' => 'Lax'));
 session_start();
 if (isset($_SESSION['editor']) && editor_exists($_SESSION['editor'])) {