diff --git a/phpBB/docs/CHANGELOG.html b/phpBB/docs/CHANGELOG.html
index 1c489b338f..794dc4fc44 100644
--- a/phpBB/docs/CHANGELOG.html
+++ b/phpBB/docs/CHANGELOG.html
@@ -127,6 +127,7 @@
[Fix] Correctly describe founder permissions on trace-information (Bug #37235 - Patch by nickvergessen)
[Fix] Correct the width value for poll_center.gif omitted in imageset.cfg for subsilver2. (Bug #43005 - Patch by rxu)
[Fix] Correctly load complex language variable using acp_language (Bug #45735 - Patch by leviatan21)
+ [Fix] Fixed reapply_sid() to correctly strip session id in certain circumstances (Bug #43125 - Patch by leviatan21)
[Change] Change the data format of the default file ACM to be more secure from tampering and have better performance.
[Change] Add index on log_time to the log table to prevent slowdown on boards with many log entries. (Bug #44665 - Patch by bantu)
[Change] Template engine now permits to a limited extent variable includes.
diff --git a/phpBB/includes/functions.php b/phpBB/includes/functions.php
index dd82f9e53d..14e1dde92f 100644
--- a/phpBB/includes/functions.php
+++ b/phpBB/includes/functions.php
@@ -2261,17 +2261,12 @@ function reapply_sid($url)
}
// Remove previously added sid
- if (strpos($url, '?sid=') !== false)
+ if (strpos($url, 'sid=') !== false)
{
- $url = preg_replace('/(\?)sid=[a-z0-9]+(&|&)?/', '\1', $url);
- }
- else if (strpos($url, '&sid=') !== false)
- {
- $url = preg_replace('/&sid=[a-z0-9]+(&)?/', '\1', $url);
- }
- else if (strpos($url, '&sid=') !== false)
- {
- $url = preg_replace('/&sid=[a-z0-9]+(&)?/', '\1', $url);
+ // All kind of links
+ $url = preg_replace('/(\?)?(&|&)?sid=[a-z0-9]+/', '', $url);
+ // if the sid was the first param, make the old second as first ones
+ $url = preg_replace("/$phpEx(&|&)+?/", "$phpEx?", $url);
}
return append_sid($url);