Edit report at https://bugs.php.net/bug.php?id=71186&edit=1
ID: 71186
Updated by: yohgaki@php.net
Reported by: akauffman at ne4u dot com
Summary: session.hash_function - algorithm changes
-Status: Assigned
+Status: Feedback
Type: Bug
Package: Session related
Operating System: any
PHP Version: 7.0.1
Assigned To: yohgaki
Block user comment: N
Private report: N
New Comment:
3v4l does not support/allow to change session.use_strict_mode=1
https://3v4l.org/KD6I3
I cannot reproduce problem. Try this phpt file and see if you have problem.
You can run single test as follows from PHP source root.
./run-tests.php ext/session/tests/bug71186.phpt
===== test file - save this code as "ext/session/tests/bug71186.phpt" =====
--TEST--
Bug #71186 session.hash_function - algorithm changes
--SKIPIF--
<?php include('skipif.inc'); ?>
--INI--
session.hash_function=sha512
session.save_handler=files
--FILE--
<?php
ob_start();
ini_set('session.use_strict_mode', 1);
session_start();
$orig = session_id();
session_regenerate_id();
$new = session_id();
var_dump(strlen($orig),strlen($new));
session_commit();
ini_set('session.hash_function','sha1');
session_id('invalid');
session_start();
$orig = session_id();
session_regenerate_id();
$new = session_id();
var_dump(strlen($orig),strlen($new));
?>
--EXPECT--
int(128)
int(128)
int(40)
int(40)
Previous Comments:
------------------------------------------------------------------------
[2015-12-22 07:22:32] yohgaki@php.net
Related To: Bug #71186
------------------------------------------------------------------------
[2015-12-22 06:01:40] yohgaki@php.net
https://3v4l.org/hkZM7
It seems something wrong in hash function setting.
------------------------------------------------------------------------
[2015-12-21 20:16:36] akauffman at ne4u dot com
Description:
------------
Setting session.hash_function via php.ini does not remain consistent, it goes back to default
algorithm after session_regenerate_id(). You must use ini_set in the script for the hashing
algorithm to remain consistent.
BTW - This bug seems to have been reintroduced.
Test script:
---------------
<?php
//ini_set('session.hash_function','sha512');
session_start();
$orig = session_id();
session_regenerate_id();
$new = session_id();
echo("$orig <br> $new");
?>
Expected result:
----------------
Hashing algorithm remains sha512.
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=71186&edit=1