Jasig/phpCAS — Issue #17: Illegal PHP session id characters in renameSession (Client.php).
Author: erwans
Created: 2012-01-05 17:26:48+00:00
State: open

Method "renameSession" in Client class use service ticket (ST) for PHP sessionid creation. This method delete invalid PHP session id characters from ST before session creation :
```PHP
$session_id = preg_replace('/[^\w]/', '', $ticket);
phpCAS :: trace("Session ID: ".$session_id);
session_id($session_id);
```

PHP session id only accept a-zA-Z09,- (http://www.php.net/manual/en/function.session-id.php) but preg_replace('/[^\w]/', '', $ticket) preserve underscore '_' (http://www.pcre.org/pcre.txt).

We use in our organisation a CAS compatible authentification portal. This CAS server create ST that may contains underscore. Those ST are rejected by phpCAS (in a GRR application instance).
Below an extract from our debug log (phpCAS 1.2.0 but still exist in Github) :
```
=> CASClient::renameSession('ST-AAGVnLK1pEvI5TgciG9lDQzvh*eHoZx5lVG1g*3IhiPMXwfVqp4BJ8b_') [client.php:2744]
Session ID: STAAGVnLK1pEvI5TgciG9lDQzvheHoZx5lVG1g3IhiPMXwfVqp4BJ8b_ [client.php:826]
```

Error :
```
Warning: session_start() [function.session-start]: The session id is too long or contains illegal characters, valid characters are a-z, A-Z, 0-9 and '-,' in /usr/share/php/CAS/CAS client.php on line 828.
```

How to fix it?
"renameSession" method should delete all invalid characters before PHP session id creation. It could be done this way (diff notation from phpCAS 1.2.2) :
```
2976c2976
<	$session_id = preg_replace('/[^a-zA-Z0-9\,\-]/', '', $ticket);
>	$session_id = preg_replace('/[^\w]/', '', $ticket);
```

By the way this problem seems to exist in handleLogoutRequests method too.