Bug #74255 [Opn->Nab]: session.use_strict_mode doesn't work with session_set_save_handler upon 'files'
Edit report at https://bugs.php.net/bug.php?id=74255&edit=1
ID: 74255
Updated by: yohgaki@php.net
Reported by: greedy dot ivan at gmail dot com
Summary: session.use_strict_mode doesn't work with
session_set_save_handler upon 'files'
-Status: Open
+Status: Not a bug
Type: Bug
Package: Session related
Operating System: Windows
PHP Version: 7.1.2
Block user comment: N
Private report: N
New Comment:
You must define validateSid handler to make use_strict_mode work.
Previous Comments:
------------------------------------------------------------------------
[2017-03-16 07:25:42] greedy dot ivan at gmail dot com
Description:
------------
When session.use_strict_mode is on and custom session handler is wrapped upon 'files'
internal handler, session id doesn't regenerate if session id doesn't exist.
If you delete session file and rerun, script must create file with new session id.
It works without session_set_save_handler as expected.
Where session_set_save_handler is set, session id doesn't regenerate.
So, you cannot simply extend internal handler with crypt/decrypt (or something else), because you
must redefine open method and all internal logic of finding session file.
Test script:
---------------
session_module_name('files');
ini_set('session.use_strict_mode', '1');
class MySessionHandler extends SessionHandler{}
session_set_save_handler(new MySessionHandler(), true);
session_start();
var_dump(session_id());
Expected result:
----------------
if you delete session file, next run show you another session_id
Actual result:
--------------
You always give the same session id
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=74255&edit=1
Thread (5 messages)