Issues

ZF-4226: The cookie domain has a problem in Zend_Http_Cookie

Description

See [http://framework.zend.com/issues/browse/ZF-4213]

There is a error when check the domain of a cookie, I finally found that exists an error in the comparition way.

Valid domain are:

.zend.com => must catch zend.com and anything.zend.com .www.zend.com => must catch www.zend.com and anything.www.zend.com, this's not work right now.

Invalid domain are:

.com.ar .or com. or .com => the script doesn't check this. zend.com without initial dot.

This is the code that fails online 235:


        // Domain is validated using tail match, while path is validated using head match
        $domain_preg = preg_quote($this->getDomain(), '/');
        if (! preg_match('/'.$domain_preg.'$/i', $uri->getHost())) return false;

Here's a improve solution:


        // Domain is validated using tail match, while path is validated using head match
        $domain_preg = preg_quote($uri->getHost(), '/');
        if (! preg_match('/\.'.$domain_preg.'$/i', $this->getDomain())) return false;

Regards.

Comments

This is somewhat improved after fixing ZF-5221 in rev. 17079 - but we still can't filter out .com or .co.ar domains - that would require quite a lot of work. I am also not sure it's the work of the cookie jar to filter those - maybe if Zend_Http_Client.