Bug #76688 [Com]: Cookie $options should not allow further arguments

Edit report at https://bugs.php.net/bug.php?id=76688&edit=1 ID: 76688 Comment by: phpdev at ehrhardt dot nl Reported by: cmb@php.net Summary: Cookie $options should not allow further arguments Status: Open Type: Bug Package: Network related Operating System: * PHP Version: 7.3Git-2018-07-31 (Git) Block user comment: N Private report: N New Comment: Related to the same RFC implementation: php_setcookie requires a 9th argument now. This line: https://github.com/pmjones/ext-request/blob/master/serverresponse.c#L1034 leads to serverresponse.c(1034): error C2198: 'php_setcookie': too few arguments for call It only compiles on Windows if you add an extra argument NULL. Previous Comments: ------------------------------------------------------------------------ [2018-07-31 21:17:44] cmb@php.net Description: ------------ The support for SameSite cookie directives[1] introduced $option parameters for setcookie(), setrawcookie() and session_set_cookie_params(), but these appear to allow further arguments to be passed, which does not appear to conform to the respective RFC[2], and is generally confusing. [1] <https://github.com/php/php-src/pull/3398> [2] <https://wiki.php.net/rfc/same-site-cookie#proposal> Test script: --------------- <?php session_set_cookie_params(array('path'=>'/foo/'), 'bar', 'www.example.com'); var_dump(session_get_cookie_params()); Expected result: ---------------- A warning regarding excess arguments, which should be ignored for further processing. Actual result: -------------- array(6) { ["lifetime"]=> int(0) ["path"]=> string(5) "/foo/" ["domain"]=> string(15) "www.example.com" ["secure"]=> bool(false) ["httponly"]=> bool(false) ["samesite"]=> string(0) "" } ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=76688&edit=1