+ helper: filter the sessionID paramter to fix directory traversal vulnerablity.

2024-04-08 14:59:46 +08:00
parent 66b395e8c0
commit f9834936df
1 changed files with 1 additions and 0 deletions
@@ -743,6 +743,7 @@ class baseHelper
     */
    public static function restartSession($sessionID = '')
    {
+        if(!preg_match('/^\w+$/', $sessionID)) $sessionID = '';
        if(empty($sessionID)) $sessionID = sha1(mt_rand());

        session_write_close();