Merge pull request pressflow#12 from dawehner/6_34

Update to 6.34
catch56 · Nov 21, 2014 · 52453a2 · 52453a2
2 parents c84f7e8 + f62a893
commit 52453a2
Show file tree

Hide file tree

Showing 3 changed files with 6 additions and 2 deletions.
diff --git a/CHANGELOG.txt b/CHANGELOG.txt
@@ -14,6 +14,10 @@ Drupal 6.30, 2014-01-15
 ----------------------
 - Fixed security issues (multiple vulnerabilities), see SA-CORE-2014-001.
 
+Drupal 6.34, 2014-11-19
+----------------------
+- Fixed security issues (session hijacking). See SA-CORE-2014-006.
+
 Drupal 6.33, 2014-08-06
 ----------------------
 - Fixed security issues (denial of service). See SA-CORE-2014-004.

diff --git a/includes/session.inc b/includes/session.inc
@@ -42,7 +42,7 @@ function sess_read($key) {
   register_shutdown_function('session_write_close');
 
   // Handle the case of first time visitors and clients that don't store cookies (eg. web crawlers).
-  if (!isset($_COOKIE[session_name()])) {
+  if (empty($key) || !isset($_COOKIE[session_name()])) {
     $user = drupal_anonymous_user();
     return '';
   }

diff --git a/modules/system/system.module b/modules/system/system.module
@@ -8,7 +8,7 @@
 /**
  * The current system version.
  */
-define('VERSION', '6.33');
+define('VERSION', '6.34');
 
 /**
  * Core API compatibility.