[HttpFoundation] fixed a potential security problem in Request

2011-04-21 20:00:27 +02:00 · 2011-04-21 20:00:27 +02:00 · c5497c7c67
commit c5497c7c67
parent 40e6030aff
1 changed files with 2 additions and 1 deletions
--- a/src/Symfony/Component/HttpFoundation/Request.php
+++ b/src/Symfony/Component/HttpFoundation/Request.php
@ -311,7 +311,8 @@ class Request

    public function hasSession()
    {
-        return $this->cookies->has(session_name());
+        // the check for $this->session avoids malicious users trying to fake a session cookie with proper name
+        return $this->cookies->has(session_name()) && null !== $this->session;
    }

    public function setSession(Session $session)