Bug #14688 Updated: session_register() doesn't register

ID: 14688 Updated by: rasmus@php.net Reported By: niklas-phpbugs@alberth.com Status: Feedback Bug Type: Session related Operating System: linux 2.2 PHP Version: 4.2.0RC2 New Comment: I didn't miss the point. You should probably have stated that your example showed the problem with simple hrefs as well. I scan things quickly and if an obvious thing such as trying to do a setcookie and a redirect in the same request is there, I comment on that and move on. What you are seeing is a side-effect of having $HTTP_SESSION_VARS['counter'] and $_SESSION['counter'] and $counter all be references to the same data. unset($counter) only removes one reference. It would be inconsistent to make unset() remove all references, and the most common usage is simply $counter = new_value which works correctly. Doing a second session_register() on the same variable doesn't currently do anything since it is already registered unless of course you have called session_unregister on it. So in summary, I think this is a fringe case that needs documenting and not necessarily fixing unless someone can come up with a clean and consistent fix. Previous Comments: ------------------------------------------------------------------------ [2002-05-29 16:04:27] valdand@soften.ktu.lt I see you miss the point. I have made that example of three scripts with redirects to easy things. You can equaly put links into scripts and then click them manualy with the same effect. All Set_Cookie and Redirect headers look fine. Take a look at the first message here from niklas-phpbugs@alberth.com. I can only speculate why this does not work in 4.1 or 4.2: when you register variable with session_register php it puts a referense to variable. When unset function unsets variable, session variable still hold reference to old variable, though it does not exist anymore. When you try to reregister variable with session_register it thinks that that variable already registered, and does nothing. So whaterver new value you assign id does not reach session module, even at exit of the script. But in theory session should reference to the name of variable not variable itself, and if variable is gone in context so must session registered one. And if you use session_unregister in the same script as unset, you would get correct result. (see ### uncomment this to see the difference # session_unregister("counter");). I don't want to insult anyone but I am amazed that such simple bug have not been fixed several monthts yet. ------------------------------------------------------------------------ [2002-05-11 00:06:17] rasmus@php.net Having a SetCookie and a Redirect in the same response causes unpredictable behaviour and will be browser-dependant. I'd suggest not relying on this. PHP does send both, so unless you can somehow show us an example of PHP not actually sending both the Location and the SetCookie then I don't see how this is a PHP issue. ------------------------------------------------------------------------ [2002-05-11 00:00:03] php-bugs@lists.php.net No feedback was provided for this bug for over a month, so it is being suspended automatically. If you are able to provide the information that was originally requested, please do so and change the status of the bug back to "Open". ------------------------------------------------------------------------ [2002-04-25 12:43:34] valdand@soften.ktu.lt 4.2.0 final still has the problem. And it is a problem, not an imagination. ------------------------------------------------------------------------ [2002-04-11 04:18:27] valdand@soften.ktu.lt FYI, with 4.0.5 my example scripts gives expected result - 4 with register_globals = on, and the same nothing with register_globals = off. ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at http://bugs.php.net/14688 -- Edit this bug report at http://bugs.php.net/?id=14688&edit=1