punbb/punbb — pull request #77 by drench (2012-04-29 16:44:22+00:00)
Title: Allow uppercase letters, as well as commas and minus signs in session IDs

I am running punbb on the same domain as another application, and I noticed sessions getting clobbered. I realize punbb always sets the hash argument to true when calling random_key(), making the existing regex work, but in my situation, I am deliberately sharing punbb sessions with this other application. The session IDs PHP's file session handler generates can contain uppercase letters, as well as commas and minus signs (see http://www.php.net/manual/en/function.session-id.php).

As a workaround I could write a fn_forum_session_start_start hook to override forum_session_start() but I'd like you to consider loosening the regex as in this patch.