Re: [VOTE] Secure Session Module Options/Internal by Default
| From: | Yasuo Ohgaki | Date: | Tue, 18 Feb 2014 11:09:52 +0000 |
| Subject: | Re: [VOTE] Secure Session Module Options/Internal by Default | ||
| References: | 1 2 3 4 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-72680@lists.php.net to get a copy of this message | ||
Hi Tjerk,
On Tue, Feb 18, 2014 at 7:56 PM, Tjerk Meesters <tjerk.meesters@gmail.com>wrote:
> It seemed to be part of the patch of the respective rfc:
>
>
>
> https://gist.github.com/yohgaki/1379668#file-php-trunk-strict-session-patch-L602
>
> How was this a merge issue?
>
Could you point out what's the exact issue here?
It's gist and it's not the patch merged.
tests/session_id_basic.phpt
var_dump(session_id());
var_dump(session_id("test"));
var_dump(session_id());
var_dump(session_id("1234567890"));
var_dump(session_id());
// Turn off strice mode, since it does not allow uninitialized session ID
ini_set('session.use_strict_mode',false);
var_dump(session_start());
var_dump(session_id());
var_dump(session_destroy());
var_dump(session_id());
echo "Done";
ob_end_flush();
?>
--EXPECTF--
*** Testing session_id() : basic functionality ***
string(0) ""
string(0) ""
string(4) "test"
string(4) "test"
string(10) "1234567890"
bool(true)
string(10) "1234567890"
bool(true)
string(0) ""
Done
It works like this. Is there issue with this behavior?
Regards,
--
Yasuo Ohgaki
yohgaki@ohgaki.net