diff --git a/Sources/Session.php b/Sources/Session.php index 1f57cf7d6c..415e8d6567 100644 --- a/Sources/Session.php +++ b/Sources/Session.php @@ -95,11 +95,20 @@ public function read(string $session_id): string */ public function write(string $session_id, string $data): bool { + // Any action that is not dependent on data within the session may be added to this array + static $no_writes = ['dlattach']; + // Don't bother writing the session if cookies are disabled if (empty($_COOKIE)) { return true; } + // Don't bother writing the session for users just browsing + // If verification is required, always write the session + if ((empty($_REQUEST['action']) || \in_array($_REQUEST['action'], $no_writes, true)) && !empty(Config::$scripturl) && empty(Utils::$context['require_verification'])) { + return true; + } + if (preg_match('~^[A-Za-z0-9,-]{16,64}$~', $session_id) == 0) { return false; }