Bug #79031 [NEW]: Session unserialization problem

From: Date: Wed, 25 Dec 2019 09:52:12 +0000
Subject: Bug #79031 [NEW]: Session unserialization problem
Groups: php.bugs 
Request: Send a blank email to php-bugs+get-224527@lists.php.net to get a copy of this message 
From:             syberon at gmail dot com
Operating system: Windows 10 1909
PHP version:      7.4.1
Package:          Class/Object related
Bug Type:         Bug
Bug description:Session unserialization problem

Description:
------------
Since version 7.4 of PHP the unserialize function can't process object
references from serialized session strings.

For example, i have a few object stored in session with 3 namespaces (i
exploded it to readability:

__ZF|a:2:{s:20:"_REQUEST_ACCESS_TIME";d:1577256665.394478;s:6:"_VALID";a:1:{s:25:"Zend\Session\Validator\Id";s:26:"uk2ngahnpc35k4rfsqd97kf9e6";}}
FlashMessenger|C:23:"Zend\Stdlib\ArrayObject":205:{a:4:{s:7:"storage";a:0:{}s:4:"flag";i:2;s:13:"iteratorClass";s:13:"ArrayIterator";s:19:"protectedProperties";a:4:{i:0;s:7:"storage";i:1;s:4:"flag";i:2;s:13:"iteratorClass";i:3;s:19:"protectedProperties";}}}

MtCms\User\Authentication\Adapter\DatabaseAdapter|C:23:"Zend\Stdlib\ArrayObject":644:{a:4:{s:7:"storage";a:1:{s:7:"storage";a:2:{s:12:"is_satisfied";b:1;s:8:"identity";O:8:"stdClass":13:{s:2:"id";s:1:"1";s:8:"username";s:5:"admin";s:5:"email";s:17:"syberon@gmail.com";s:12:"display_name";s:6:"Andrey";s:7:"picture";s:0:"";s:8:"delivery";s:1:"1";s:4:"city";s:22:"Новосибирск";s:9:"city_code";s:3:"270";s:8:"zip_code";s:6:"630000";s:7:"address";s:16:"ываывавы";s:5:"phone";s:4:"4234";s:5:"state";s:1:"1";s:10:"persistent";s:1:"1";}}}s:4:"flag";i:2;s:13:"iteratorClass";s:13:"ArrayIterator";s:19:"protectedProperties";a:4:{i:0;s:7:"storage";i:1;s:4:"flag";i:2;s:13:"iteratorClass";i:3;s:19:"protectedProperties";}}}

Zend_Auth|C:23:"Zend\Stdlib\ArrayObject":224:{a:4:{s:7:"storage";a:1:{s:7:"storage";r:20;}s:4:"flag";i:2;s:13:"iteratorClass";s:13:"ArrayIterator";s:19:"protectedProperties";a:4:{i:0;s:7:"storage";i:1;s:4:"flag";i:2;s:13:"iteratorClass";i:3;s:19:"protectedProperties";}}}

Second namespace 'MtCms\User\Authentication\Adapter\DatabaseAdapter' has
object of class 'Zend\Stdlib\ArrayObject' that has a property with name
'storage' that contains anothe object.

Third namespace 'Zend_Auth' has the object of class
'Zend\Stdlib\ArrayObject' too. And this object has the same property
'storage' but it has value r:20 (reference to object of second
namespace)

PHP 7.3 parses this serialized session data without any problems and at
result we have a objects from 2nd and 3rd namespaces with property
'storage' what have identically object contain in.

But then i upgraded to PHP 7.4 the session_start() function give the
error when trying to parse this session data. It can not recognize
'r:20' reference in object of 3rd namespace.


-- 
Edit bug report at https://bugs.php.net/bug.php?id=79031&edit=1
-- 
Fix committed:                    https://bugs.php.net/fix.php?id=79031&r=fixed
Fixed in release:                 https://bugs.php.net/fix.php?id=79031&r=alreadyfixed
Need backtrace:                   https://bugs.php.net/fix.php?id=79031&r=needtrace
Need Reproduce Script:            https://bugs.php.net/fix.php?id=79031&r=needscript
Try newer version:                https://bugs.php.net/fix.php?id=79031&r=oldversion
Not developer issue:              https://bugs.php.net/fix.php?id=79031&r=support
Expected behavior:                https://bugs.php.net/fix.php?id=79031&r=notwrong
Not enough info:                  https://bugs.php.net/fix.php?id=79031&r=notenoughinfo
Submitted twice:                  https://bugs.php.net/fix.php?id=79031&r=submittedtwice
register_globals:                 https://bugs.php.net/fix.php?id=79031&r=globals
PHP version support discontinued: https://bugs.php.net/fix.php?id=79031&r=phptooold
Daylight Savings:                 https://bugs.php.net/fix.php?id=79031&r=dst
IIS Stability:                    https://bugs.php.net/fix.php?id=79031&r=isapi
Install GNU Sed:                  https://bugs.php.net/fix.php?id=79031&r=gnused
Floating point limitations:       https://bugs.php.net/fix.php?id=79031&r=float
No Zend Extensions:               https://bugs.php.net/fix.php?id=79031&r=nozend
MySQL Configuration Error:        https://bugs.php.net/fix.php?id=79031&r=mysqlcfg

Thread (7 messages)

« previous php.bugs (#224527) next »