Bug #77330 [NEW]: session_id() no longer works inside custom SessionHandlerInterface

From: e6990620 at gmail dot com Operating system: Linux PHP version: 7.3.0 Package: Session related Bug Type: Bug Bug description:session_id() no longer works inside custom SessionHandlerInterface Description: ------------ Up until PHP 7.3.0 when you wrote a custom SessionHandlerInterface you could signal the PHP engine to regenerate the ID by calling session_id('newvalue') inside its read() method. Then, when the session closed and the engine calls the write() method, $session_id used to be the new value. Starting from PHP 7.3.0 this pattern no longer works, as write() receives the stale value. Might be related to https://bugs.php.net/bug.php?id=74941 since it is the only session-related change in this new major release. Another bug report of the same issue in a real world session handler: https://github.com/1ma/RedisSessionHandler/issues/11 Test script: --------------- https://3v4l.org/6S4XM Expected result: ---------------- $ curl -i -H "Cookie: PHPSESSID=madeupkey;" localhost/bug.php; HTTP/1.1 200 OK Server: nginx/1.13.12 Date: Thu, 20 Dec 2018 20:51:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.2.13 <------------ PHP 7.2 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache newsessionid Actual result: -------------- $ curl -i -H "Cookie: PHPSESSID=madeupkey;" localhost/bug.php; HTTP/1.1 200 OK Server: nginx/1.13.12 Date: Thu, 20 Dec 2018 20:51:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.3.0 <------------ PHP 7.3 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache madeupkey <------ successful session fixation attack -- Edit bug report at https://bugs.php.net/bug.php?id=77330&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=77330&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=77330&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=77330&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=77330&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=77330&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=77330&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=77330&r=needscript Try newer version: https://bugs.php.net/fix.php?id=77330&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=77330&r=support Expected behavior: https://bugs.php.net/fix.php?id=77330&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=77330&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=77330&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=77330&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=77330&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=77330&r=dst IIS Stability: https://bugs.php.net/fix.php?id=77330&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=77330&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=77330&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=77330&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=77330&r=mysqlcfg