[Typo3-dev] security suggestion for tipafriend ext

[Andreas Otto]

Hi Kasper,

On Tuesday 08 June 2004 23:55, Kasper Skårhøj wrote:
> I don't think the session thing here improves anything - after all a
> spammer wouldn't accept cookies and thus no sessions...

Well, this depends on how you utilise the native PHP session functions. AFAIK 
Chi Hoang is using native sessions in his improvements.

On Tuesday 08 June 2004 16:26, Chi Hoang wrote:
> In class.tx_tipafriend.php in function main_tipafriend($content,$conf) I
> added this lines at the beginning:
>
> session_start();
>
> if(!isset($_SESSION["tips"])) {
>    $_SESSION["tips"]=0;
> } else {
>    $_SESSION["tips"]+=1;
> }

And because he is using native sessions no cookies will be needed if you 
enable session.use_trans_sid in the php.ini.


Cheers,
Andreas

-- 
Andreas Otto <andreas at php4win.de>
Using PHP on Windows? www.php4win.de