| Subject: | Apache::Session::File should detaint session id to run in taint mode |
You can't use Apache::Session::File in taint mode. Deleting the session
does not work, because even if you untaint your cookie value when tying
the session, it gets the session id internally from {_session_id} and
since this is input from a file, it cannot be used in unlink.
($id) = $id =~ m{ \A ([a-z0-9]+) \z }mxs;
Looks like someone else ran into this problem and described it here:
http://www.mail-archive.com/modperl@apache.org/msg33173.html