Skip to content

modSessionHandler returning empty result set when session.hash_function = 1 in php.ini #7646

@mjansen

Description

@mjansen

mjansen created Redmine issue ID 7646

Cannot login after installing beta3 when the php.ini setting session.hash_function = sha256 (Default in OpenSuSE 12.1) because the SELECT query that should return the modSession instance inserted for a particular user session is returning an empty result set. Here is an example debug log from an affected installation: [2009-09-05 16:26:29] (DEBUG @ /2.0/manager/index.php) Fetched empty result set from statement: SELECT modSession.id AS modSession_id, modSession.access AS modSession_access, modSession.data AS modSession_data FROM modx_session AS modSession WHERE modSession.id = ? with bindings: Array
(
[0] => Array
(
[value] => 3c65ed5a65680f56d7c8d648292c8a51d918a286
[type] => 2
[length] => 0
) ) [2009-09-05 16:26:29] (INFO @ /2.0/manager/index.php) There was an error retrieving or creating session id: 3c65ed5a65680f56d7c8d648292c8a51d918a286

Altering modx_session.id from CHARACTER(40) to CHARACTER(52) fixes the problem.

May i recommend adding a check to make sure the id to inserted does not exceed the columns size? This is one nasty bug that could potentially cost you guys many users less experienced and determined.

Mike

Metadata

Metadata

Assignees

No one assigned

    Labels

    area-securitybugThe issue in the code or project, which should be addressed.

    Type

    No type

    Projects

    No projects

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions