Re: [VOTE] Secure Session Module Options/Internal by Default

And about to remove these options, should they be keep in the newest releases? ; http://php.net/session.bug-compat-42 session.bug_compat_42 = Off ; session value into the global space. session.bug_compat_42 must be enabled before ; http://php.net/session.bug-compat-warn 2014-02-24 7:00 GMT-03:00 Yasuo Ohgaki <yohgaki@ohgaki.net>: > Hi Andrey, > > On Mon, Feb 24, 2014 at 6:50 PM, Andrey Andreev <narf@devilix.net> wrote: > > > > > - hash_bits_per_character will be removed from the RFC. > > > - Possible issue with ID length change will be documented. > > > - "id_length" will be removed. User should use hash index search. > > > - Raise error when hash function is not available. > > > > I'd be happy with that, yes. :) > > Although for hash_bits_per_character, I only insisted the RFC to > > explain that this is a change complementing hash_function. > > > > OK. I'll document it. > > > > > > Raising error seems not good... > > > If hash extension is available always, it might be easier for other > > module, > > > too. > > > Do not allow DL/disabling hash extension, perhaps? > > > > > > I see no reason why anybody would want to disable the Hash extension, > > so sure - I'd remove that choice. > > > > I agree. It will be added to the RFC. > > > > However, silent fallback for stuff like this is never a good thing and > > somebody might i.e. make a typo while configuring, so why not raise > > E_WARNING for invalid hash_function regardless? > > > Make sense to me, too. > I'll make it raise error for any invalid hashes. > > Thank you for your help :) > > Regards, > > -- > Yasuo Ohgaki > yohgaki@ohgaki.net > -- * Marcel Araujo Analista de SistemasDesenvolvedor PHP/Zend/JavaScript/jQuery/NodeJSLinux User #490101http://www.twitter.com/marcelarauj0 <http://www.twitter.com/marcelarauj0> http://blog.marcelaraujo.me <http://blog.marcelaraujo.me/>http://br.linkedin.com/in/marcelaraujo <http://br.linkedin.com/in/marcelaraujo> *