[php-src] PR #23847: ext/session: Abort strict-mode re-creation when create_sid() fails
| From: | iliaal | Date: | Tue, 22 Sep 2026 14:24:26 +0000 |
| Subject: | [php-src] PR #23847: ext/session: Abort strict-mode re-creation when create_sid() fails | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-38719@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/23847
Author: iliaal
Under session.use_strict_mode, when a save handler rejects the supplied ID, php_session_initialize()
called s_create_sid() and quietly generated an internal ID when that failed. reset_id() then emitted
Set-Cookie and defined SID for a session that goes on to fail, and when the internal generation
failed too, PS(id) stayed NULL. This mirrors the abort the primary no-ID branch already performs.
Same failure class as #23800, which covers session_regenerate_id().