if (!headers_sent()) {
session_start();
// Prevent session fixation by only allowing sessions that have been sent by the server.
// Any session that does not contain our unique token will be regarded as foreign/fixated
// and be regenerated with a system-generated SID.
// Patch by David Vieira-Kurz of majorsecurity.de
if (!isset($_SESSION['SERVER_GENERATED_SID'])) {
session_regenerate_id(true);
session_start(); // <<<<<<<<<<<<<<<<<<< line 20
header('X-Session-Reinit: true');
$_SESSION['SERVER_GENERATED_SID'] = true;
}
}
Try to put a "@" in front of that session_start? It seems to only be a PHP notice, and thus can be suppressed.
Regards,
Garvin
# Garvin Hicking (s9y Developer)
# Did I help you? Consider making me happy: http://wishes.garv.in/
# or use my PayPal account "paypal {at} supergarv (dot) de"
# My "other" hobby: http://flickr.garv.in/