Req->Doc #71289 [Ana->Dup]: Using session_name() prevents session_progress features from working

Edit report at https://bugs.php.net/bug.php?id=71289&edit=1 ID: 71289 Updated by: cmb@php.net Reported by: pfenderd at bellsouth dot net -Summary: JIT $_FILES initilization is required for multiple session.name to work +Summary: Using session_name() prevents session_progress features from working -Status: Analyzed +Status: Duplicate -Type: Feature/Change Request +Type: Documentation Problem Package: Session related Operating System: any PHP Version: irrelevant -Assigned To: +Assigned To: cmb Block user comment: N Private report: N New Comment: Like Yasuo said, uploads are processed before any scripts are actually executed. When an upload is in progress, the respective data are written to the session as specified in php.ini, and $_SESSION is populated. If you change the session name and then start a session, the upload data are therefore no longer available in $_SESSION. The cleanest solution is to set the desired session.name prior to script execution. If that is not possible for whatever reason, you can work around with something like: <?php if (isset($_SESSION)) { $upload_data = $_SESSION; } session_name("myname"); session_start(); $_SESSION = array_merge($_SESSION, $upload_data); ?> Thus, this is merely a doc problem, and hence a duplicate of bug #76808. Previous Comments: ------------------------------------------------------------------------ [2016-01-20 16:19:39] pfenderd at bellsouth dot net Is there a difference in how sessions are handled using the API or the fast CGI on the server side? My testing has been on Windows 7 using IIS 7.5. If there is a difference in the server type of session handling, then this should be well documented so programmers can deal with it. The problem has nothing to do with multiple files being uploaded, only a single file. ------------------------------------------------------------------------ [2016-01-07 05:14:39] yohgaki@php.net Possible work around is to set session.name in .htaccess. "php_value" directive is processed before uploaded file handling. If you use .htaccess (or like) to set different session name, it should work. You'll need individual files, at least symlink, though. ------------------------------------------------------------------------ [2016-01-07 05:09:30] yohgaki@php.net The reason why changing session name after module initialization does not work is the way RFC 1867 callback implemented. Upload progress callback (php_rfc1867_callback) is registered when session module is initialized. It is used when RFC 1867 upload is performed and handled in main/rfc1867.c. This means changing session name in user script is too late to make it work. I think it does not work in older versions also, does it? Possible fix would be delaying file upload handling and/or handle file upload manually. PHP handles file uploading automatically now. Anyway, user cannot make use of session_name('NEW_NAME')/ini_set('session.name', 'NEW_NAME') to use multiple file upload progress handling. I checked the code briefly. Please correct me if I'm wrong. ------------------------------------------------------------------------ [2016-01-07 01:44:28] pfenderd at bellsouth dot net More on the problem conditions: To make the session_name() function work with session.upload_progress, the session first needs to be started without using session_name() AND also a file upload needs to be done. Once the first file has been uploaded, then it is safe to use session_name() and the progress feature will work properly. Test using session_name(): http://upx.djpnet.dyndns.org/form1.php Test without using session_name(): http://upx.djpnet.dyndns.org/form1.php?sn=0 ------------------------------------------------------------------------ [2016-01-06 22:04:56] pfenderd at bellsouth dot net The problem is a little bit more complicated than first thought. When a browser is first opened and a session started using session_name() before session_start() the problem will continue to occur. However, if a session is opened without using session_name() just once, then thereafter the use of session_name() will not cause a problem. This is repeatable with IE 11, Firefox 43.0.4, Chrome 47.0.2526.106 and Opera 34.0.2036.31. Test using session_name(): http://dayspeaknet.djpnet.dyndns.org/upload_sermons/upx/form1.php Test without using session_name(): http://dayspeaknet.djpnet.dyndns.org/upload_sermons/upx/form1.php?sn=0 The only difference between these two test URLs is the use of session_name() or not. Closing the browser and opening the browser again creates the problem situation. ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at https://bugs.php.net/bug.php?id=71289 -- Edit this bug report at https://bugs.php.net/bug.php?id=71289&edit=1