@@ -93,7 +93,7 @@ zend_class_entry *php_session_update_timestamp_iface_entry;
93
93
return FAILURE; \
94
94
}
95
95
96
- #define SESSION_FORBIDDEN_CHARS "=,;.[ \t\r\n\013\014 "
96
+ #define SESSION_FORBIDDEN_CHARS "=,;.[ \t\r\n\v\f "
97
97
98
98
#define APPLY_TRANS_SID (PS(use_trans_sid) && !PS(use_only_cookies))
99
99
@@ -703,14 +703,14 @@ static bool is_session_name_valid(const zend_string *name, int diagnostic_type)
703
703
{
704
704
if (ZSTR_LEN (name ) == 0 ) {
705
705
if (diagnostic_type ) {
706
- php_error_docref (NULL , diagnostic_type , "session.name \"%s\" cannot be empty" , ZSTR_VAL (name ));
706
+ php_error_docref (NULL , diagnostic_type , "session.name \"%s\" must not be empty" , ZSTR_VAL (name ));
707
707
}
708
708
return false;
709
709
}
710
710
/* NUL bytes are not allowed */
711
711
if (zend_str_has_nul_byte (name )) {
712
712
if (diagnostic_type ) {
713
- php_error_docref (NULL , diagnostic_type , "session.name \"%s\" cannot contain NUL bytes" , ZSTR_VAL (name ));
713
+ php_error_docref (NULL , diagnostic_type , "session.name \"%s\" must not contain any null bytes" , ZSTR_VAL (name ));
714
714
}
715
715
return false;
716
716
}
@@ -719,15 +719,15 @@ static bool is_session_name_valid(const zend_string *name, int diagnostic_type)
719
719
(TL;DR: name is stored in HashTable so numeric string is converted to int key, but lookup looks for string key). */
720
720
if (is_numeric_str_function (name , NULL , NULL )) {
721
721
if (diagnostic_type ) {
722
- php_error_docref (NULL , diagnostic_type , "session.name \"%s\" cannot be numeric" , ZSTR_VAL (name ));
722
+ php_error_docref (NULL , diagnostic_type , "session.name \"%s\" must not be numeric" , ZSTR_VAL (name ));
723
723
}
724
724
return false;
725
725
}
726
726
/* Prevent broken Set-Cookie header, because the session_name might be user supplied */
727
- if (strpbrk (ZSTR_VAL (name ), "=,; \t\r\n\013\014 " ) != NULL ) { /* man isspace for \013 and \014 */
727
+ if (strpbrk (ZSTR_VAL (name ), "=,; \t\r\n\v\f " ) != NULL ) { /* man isspace for \v and \f */
728
728
if (diagnostic_type ) {
729
- php_error_docref (NULL , diagnostic_type , "session.name \"%s\" cannot contain any of the following "
730
- "'=,; \\t\\r\\n\\013\\014 '" , ZSTR_VAL (name ));
729
+ php_error_docref (NULL , diagnostic_type , "session.name \"%s\" must not contain any of the following "
730
+ "'=,; \\t\\r\\n\\v\\f '" , ZSTR_VAL (name ));
731
731
}
732
732
return false;
733
733
}
0 commit comments