From 55c72617c6a582f25f3769872ad09d0494049a5f Mon Sep 17 00:00:00 2001 From: Bernhard Posselt Date: Mon, 25 Feb 2013 18:37:05 +0100 Subject: [PATCH] set http 500 when session could not be started to prevent serving of empty files see #1049 --- lib/base.php | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/lib/base.php b/lib/base.php index b5439c00ab..16aa7bff30 100644 --- a/lib/base.php +++ b/lib/base.php @@ -320,8 +320,11 @@ class OC { // set the session name to the instance id - which is unique session_name(OC_Util::getInstanceId()); - // (re)-initialize session - session_start(); + // if session cant be started break with http 500 error + if (session_start() === false){ + header('HTTP/1.1 500 Internal Server Error'); + exit(1); + } // regenerate session id periodically to avoid session fixation if (!isset($_SESSION['SID_CREATED'])) {