Merge pull request #1040 from sarciszewski/patch-1

Fix #1034 (CVE-2015-2171)
slimphp · Mar 2, 2015 · e434525 · e434525
2 parents 2d80935 + 9fa6514
commit e434525
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/Slim/Middleware/SessionCookie.php b/Slim/Middleware/SessionCookie.php
@@ -124,7 +124,7 @@ protected function loadSession()
 
         if ($value) {
             try {
-                $_SESSION = unserialize($value);
+                $_SESSION = json_decode($value, true);
             } catch (\Exception $e) {
                 $this->app->getLog()->error('Error unserializing session cookie value! ' . $e->getMessage());
             }
@@ -138,7 +138,7 @@ protected function loadSession()
      */
     protected function saveSession()
     {
-        $value = serialize($_SESSION);
+        $value = json_encode($_SESSION);
 
         if (strlen($value) > 4096) {
             $this->app->getLog()->error('WARNING! Slim\Middleware\SessionCookie data size is larger than 4KB. Content save failed.');