[php-src] Issue #10807: session_regenerate_id with custom handler and use_strict_mode generates three new session ids
| From: | bgardner-noggin | Date: | Wed, 08 Mar 2023 07:20:22 +0000 |
| Subject: | [php-src] Issue #10807: session_regenerate_id with custom handler and use_strict_mode generates three new session ids | ||
| Groups: | php.bugs | ||
| Request: | Send a blank email to php-bugs+get-243874@lists.php.net to get a copy of this message | ||
Issue: https://github.com/php/php-src/issues/10807
Author: bgardner-noggin
### Description
If I have set session.use_strict_mode = 1 and I have a custom session handler which implements the
validateId function, then invoking session_regenerate_id calls
customhandler->create_sid
customhandler->validateId
customhandler->create_sid
customhandler->validateId
customhandler->create_sid
customhandler->validateId
customhandler->create_sid
Looking at the source code for session_regenerate_id, I can see the bug
https://github.com/php/php-src/blob/PHP-8.0.27/ext/session/session.c#L2263
while (limit-- && PS(mod)->s_validate_sid(&PS(mod_data), PS(id)) == SUCCESS)
{
Shouldn't this be
while (limit-- && PS(mod)->s_validate_sid(&PS(mod_data), PS(id)) == FAILURE)
{
Note that this is the same code in master
### PHP Version
PHP 8.0.27
### Operating System
_No response_