Quite out of the blue on a client site running 1.7.0, all pages loaded after the initial visit rendered the dreaded "Disallowed Key Characters" message.
Upon some investigation, I determined it was the exp_tracker cookie that was triggering this. Its value is being set to a%3A1%3A%7Bi%3A0%3Bs%3A5%3A%22index%22%3B%7D
(as an example), which is not passing the Input class' clean_input_keys()
function, triggering the error.
So, why this crazy value for the exp_tracker
cookie, and why all-of-a-sudden? It continues to get set like this. For now my fix is to comment-out the filtering of the $_COOKIE
array.
But, possibly related, I can also no longer login to the control panel - with or without the cookie filtering removed. I log-in, my session ID is set, but I just immediately return to the login screen, no error.
Are these related? Anyone seen this before?