Conversation
This patch disables any invalid save handler calls.
ext/session/mod_user.c
Outdated
|
|
||
| if (PS(in_save_handler)) { | ||
| PS(in_save_handler) = 0; | ||
| php_error_docref(NULL, E_WARNING, "Cannot call save handler function recursive manner"); |
There was a problem hiding this comment.
This should be:
"Cannot call session save handler recursively or "Cannot call session save handler in a recursive manner"
I took the liberty to add 'session', as it eases up where to look during debugging quickly
There was a problem hiding this comment.
This should go in any further error messages :)
There was a problem hiding this comment.
@KalleZ
Thanks for feedback! I'll update error message to
Cannot call session save handler in a recursive manner
because invalid calls do not have to be recursive call.
|
@yohgaki what is the status of this PR ? |
|
The bug report says that 7.x is affected, but git can't apply the patch to 7.0 It may need rebasing, or there may need to be a PR for 7.0 ? |
|
Comment on behalf of krakjoe at php.net: Adding comment |
|
@krakjoe |
|
@krakjoe This patch is ready to be merged to 7.1/master, unless there should be patch for 7.0, please merge this to 7.1 and master. Thank you. |
* PHP-7.1: new entry for #2196 Improve error message Fix test Refactor and cleanup implementation. Revert "Fix Bug #73461" Revert "Protect class based session save handler" Protect class based session save handler Fix Bug #73461
|
Merged. Thanks ;) |
* 'PHP-7.1' of git.php.net:/php-src: new entry for #2196 Improve error message Fix test Refactor and cleanup implementation. Revert "Fix Bug #73461" Revert "Protect class based session save handler" Protect class based session save handler Fix Bug #73461
* master: Fixed bug #73532 (Null pointer dereference in mb_eregi) news entry for php#2196 new entry for php#2196 Improve error message Fix test Refactor and cleanup implementation. Revert "Fix Bug #73461" Revert "Protect class based session save handler" Protect class based session save handler Fix Bug #73461 update NEWS Add PDOStatement::activeQueryString()
|
Good catch @weltling, ta ... |
5 participants
This patch disables any invalid save handler calls such as recursive save handler calls. This disables many kinds of save handler abuses.
7.1 and up has session_create_id(). This patch allows to use session_create_id() in user session save handler also. i.e. Allows to call session_carete_id() to make custom session id by session ID creation handler.
https://bugs.php.net/bug.php?id=73461