Re: [VOTE] Secure Session Module Options/Internal by Default

On Tue, Feb 18, 2014 at 7:09 PM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote: > Hi Tjerk, > > On Tue, Feb 18, 2014 at 7:56 PM, Tjerk Meesters <tjerk.meesters@gmail.com>wrote: > >> It seemed to be part of the patch of the respective rfc: >> >> >> >> https://gist.github.com/yohgaki/1379668#file-php-trunk-strict-session-patch-L602 >> >> How was this a merge issue? >> > > Could you point out what's the exact issue here? > It's gist and it's not the patch merged. > In that case, the RFC should be updated with the corresponding commit logs (part of the process) when it was merged with the project; this makes it easier to discuss historical commits based on it. > tests/session_id_basic.phpt > > var_dump(session_id()); > var_dump(session_id("test")); > var_dump(session_id()); > var_dump(session_id("1234567890")); > var_dump(session_id()); > // Turn off strice mode, since it does not allow uninitialized session ID > ini_set('session.use_strict_mode',false); > var_dump(session_start()); > var_dump(session_id()); > var_dump(session_destroy()); > var_dump(session_id()); > > echo "Done"; > ob_end_flush(); > ?> > --EXPECTF-- > *** Testing session_id() : basic functionality *** > string(0) "" > string(0) "" > string(4) "test" > string(4) "test" > string(10) "1234567890" > bool(true) > string(10) "1234567890" > bool(true) > string(0) "" > Done > > It works like this. Is there issue with this behavior? > That looks okay, thanks for getting back to me :) > > Regards, > > -- > Yasuo Ohgaki > yohgaki@ohgaki.net > > -- -- Tjerk