Bug #71243 [Ana]: session_start() returns true, even for invalid session ids

Edit report at https://bugs.php.net/bug.php?id=71243&edit=1 ID: 71243 Updated by: yohgaki@php.net Reported by: maggus dot staab at googlemail dot com Summary: session_start() returns true, even for invalid session ids Status: Analyzed Type: Bug Package: Session related Operating System: Ubuntu12 lts PHP Version: Irrelevant Assigned To: yohgaki Block user comment: N Private report: N New Comment: I have to change this function's signature PHPAPI void php_session_start(TSRMLS_D) Fix will be only for 7.1 and later. Previous Comments: ------------------------------------------------------------------------ [2015-12-31 00:32:29] yohgaki@php.net @maggus Thank you for the report. The cause is different. The cause is static void ps_files_open(ps_files *data, const char *key TSRMLS_DC) is not returning status properly. Many session internal functions were written w/o return values originally. It's time for cleanup to fix these issues. Some of them will be only for PHP 7.1 as PHPAPI needs changes. ------------------------------------------------------------------------ [2015-12-30 10:14:18] maggus dot staab at googlemail dot com Description: ------------ session_start() returns true, even if the configured session_id() is invalid. This is similar to https://bugs.php.net/bug.php?id=65795 but I guess the cause is different. Test script: --------------- https://3v4l.org/HXRoR session_id('öäü'); var_dump(session_start()); Expected result: ---------------- Warning: The session id contains illegal characters, valid characters are a-z, A-Z, 0-9 and '-,' in /in/HXRoR on line 4 bool(false) Actual result: -------------- Warning: The session id contains illegal characters, valid characters are a-z, A-Z, 0-9 and '-,' in /in/HXRoR on line 4 bool(true) ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=71243&edit=1