PhpDig.net - Bug with PHPDIG_SESSID

PhpDig.net (http://www.phpdig.net/forum/index.php)

- Bug Tracker (http://www.phpdig.net/forum/forumdisplay.php?f=27)

- - Bug with PHPDIG_SESSID_VAR? (http://www.phpdig.net/forum/showthread.php?t=1540)

Bug with PHPDIG_SESSID_VAR?

It seems that the session ID remover have a small bug.

With the original configuration:
define('PHPDIG_SESSID_VAR','PHPSESSID,s');
every variable passed in the URL ending with one value of PHPDIG_SESSID_VAR are disregarded.

I add a problem with index.php?series=001 turned into index.php?serie.

Where is the function that uses PHPDIG_SESSID_VAR? :chicken:

I can confirm this bug. The function is phpdigSessionRemoveIt in robot_functions.php (line 1776):

PHP Code:


		
			
function phpdigSessionRemoveIt($what,$eval) {

    $what = trim($what);

    $eval = ereg_replace($what.'=[a-zA-Z0-9.,;=/-]*','',$eval);

    $eval = str_replace("&amp;&amp;","&amp;",$eval);

    $eval = str_replace("?&amp;","?",$eval);

    $eval = eregi_replace("&amp;$","",$eval);

    $eval = str_replace("&&","&",$eval);

    $eval = eregi_replace("[?][&]","?",$eval);

    $eval = eregi_replace("&$","",$eval);

    $eval = ereg_replace("[?]$","",$eval); // remove trailing question mark

    return $eval;

}

My regex skills are kind of rusty at the moment, but shouldn't the second line of the function be something more like:

PHP Code:


		
			
    $eval = ereg_replace('([?&])'.$what.'=[a-zA-Z0-9.,;=/-]*','\\1',$eval);