#37087 [NEW]: register_globals with $_SESSION
From: stefys at gmail dot com
Operating system: Windows XP SP2
PHP version: 5.1.2
PHP Bug Type: Variables related
Bug description: register_globals with $_SESSION
Description:
------------
When register_globals is enabled, items from $_SESSION are stored into
variables. However, if you unset one of those variables, and then you set
it again with his own value, then you session_unset() the variable will be
lost too. This is not really a bug, but maybe there is a way to check if
that variable still "points" to $_SESSION.
Reproduce code:
---------------
<?
session_start();
if (!isset($_SESSION['test']))
{
$_SESSION['test'] = "value in session";
echo "please reload!";
}
else
{
echo '$_SESSION[\'test\']:
'.$_SESSION['test']."<br>"; // prints
$_SESSION['test']
echo '$test: '.$test."<br>"; // prints $_SESSION['test']
unset($test); //unsets $test, now $test is not a "pointer" to
$_SESSION['test'] anymore
$test = "my own value";
echo '$_SESSION[\'test\']:
'.$_SESSION['test']."<br>";
echo '$test: '.$test."<br>"; //ok, now $test has different value than
$_SESSION['test']
session_unset(); // unsets $_SESSION['test'], but $test too, because
register_globals is enabled
echo '$_SESSION[\'test\']:
'.$_SESSION['test']."<br>";
echo '$test: '.$test."<br>";
}
?>
Expected result:
----------------
It should only unset $_SESSION['test'], not $test, even if
register_globals is enabled.
Actual result:
--------------
Both, $test and $_SESSION['test'] are unset. This how I think that
session_unset() works:
function session_unset()
{
global $_SESSION;
foreach ($_SESSION as $item => $value)
{
unset($_SESSION[$item]);
if (ini_get('register_globals')) unset($$value); // unsets $value,
no matter if it does not "point" to $_SESSION anymore
//as a temporary fix:
//if (ini_get('register_globals') && $$value === $_SESSION[$item])
... // this will still not fix everything, since value of $$value might be
same as in $_SESSION, in which case it will still be unset
}
}
--
Edit bug report at http://bugs.php.net/?id=37087&edit=1
--
Try a CVS snapshot (PHP 4.4): http://bugs.php.net/fix.php?id=37087&r=trysnapshot44
Try a CVS snapshot (PHP 5.1): http://bugs.php.net/fix.php?id=37087&r=trysnapshot51
Try a CVS snapshot (PHP 6.0): http://bugs.php.net/fix.php?id=37087&r=trysnapshot60
Fixed in CVS: http://bugs.php.net/fix.php?id=37087&r=fixedcvs
Fixed in release: http://bugs.php.net/fix.php?id=37087&r=alreadyfixed
Need backtrace: http://bugs.php.net/fix.php?id=37087&r=needtrace
Need Reproduce Script: http://bugs.php.net/fix.php?id=37087&r=needscript
Try newer version: http://bugs.php.net/fix.php?id=37087&r=oldversion
Not developer issue: http://bugs.php.net/fix.php?id=37087&r=support
Expected behavior: http://bugs.php.net/fix.php?id=37087&r=notwrong
Not enough info: http://bugs.php.net/fix.php?id=37087&r=notenoughinfo
Submitted twice: http://bugs.php.net/fix.php?id=37087&r=submittedtwice
register_globals: http://bugs.php.net/fix.php?id=37087&r=globals
PHP 3 support discontinued: http://bugs.php.net/fix.php?id=37087&r=php3
Daylight Savings: http://bugs.php.net/fix.php?id=37087&r=dst
IIS Stability: http://bugs.php.net/fix.php?id=37087&r=isapi
Install GNU Sed: http://bugs.php.net/fix.php?id=37087&r=gnused
Floating point limitations: http://bugs.php.net/fix.php?id=37087&r=float
No Zend Extensions: http://bugs.php.net/fix.php?id=37087&r=nozend
MySQL Configuration Error: http://bugs.php.net/fix.php?id=37087&r=mysqlcfg
Thread (2 messages)
- stefys at gmail dot com