Re: Re: [RFC][VOTE] Session ID without hashing
| From: | Leigh | Date: | Thu, 07 Jul 2016 08:25:03 +0000 |
| Subject: | Re: Re: [RFC][VOTE] Session ID without hashing | ||
| References: | 1 2 3 4 5 6 7 8 9 10 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-94405@lists.php.net to get a copy of this message | ||
On 6 July 2016 at 22:30, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:
> php_session_create_id() may return NULL. It's an usual error. Session
> module supports session ID creation save handler which may return
> anything valid for the type.
>
> Session module tries to call php_session_create_id() several
> places/times. If it could not get valid one, it raises
> E_RECOVERABLE_ERROR or E_ERROR eventually.
>
> Although it's not enabled yet, PHP_FUNCTION(session_create_id) returns
> FALSE it fails.
If it fails due to a lack of random, it throws a fatal. Tested your PR
and forced the fd of /dev/urandom to -1 in ext/standard/random.c
$ sapi/cli/php -n -r 'session_start();'
Next Exception: Cannot open source device in Command line code:1
Stack trace:
#0 Command line code(1): session_start()
#1 {main}
thrown in Command line code on line 1
Fatal error: session_start(): Failed to create session ID: files
(path: ) in Command line code on line 1