[php-src] Issue #10807: session_regenerate_id with custom handler and use_strict_mode generates three new session ids

From: Date: Wed, 08 Mar 2023 07:20:22 +0000
Subject: [php-src] Issue #10807: session_regenerate_id with custom handler and use_strict_mode generates three new session ids
Groups: php.bugs 
Request: Send a blank email to php-bugs+get-243874@lists.php.net to get a copy of this message
Issue: https://github.com/php/php-src/issues/10807 Author: bgardner-noggin ### Description If I have set session.use_strict_mode = 1 and I have a custom session handler which implements the validateId function, then invoking session_regenerate_id calls customhandler->create_sid customhandler->validateId customhandler->create_sid customhandler->validateId customhandler->create_sid customhandler->validateId customhandler->create_sid Looking at the source code for session_regenerate_id, I can see the bug https://github.com/php/php-src/blob/PHP-8.0.27/ext/session/session.c#L2263 while (limit-- && PS(mod)->s_validate_sid(&PS(mod_data), PS(id)) == SUCCESS) { Shouldn't this be while (limit-- && PS(mod)->s_validate_sid(&PS(mod_data), PS(id)) == FAILURE) { Note that this is the same code in master ### PHP Version PHP 8.0.27 ### Operating System _No response_

« previous php.bugs (#243874) next »