Commit graph

950 commits

Author SHA1 Message Date
Niels Dossche
6985aff7c3 Fix GH-13680: Segfault with session_decode and compilation error
It's illegal to return from a bailout because that doesn't restore the
original bailout data. Return outside of it.

Test by YuanchengJiang

Closes GH-13689.
2024-03-13 17:47:25 +01:00
Niels Dossche
7f7031eb72 Fix GH-12504: Corrupted session written when there's a fatal error in autoloader
For details and reasoning, see [1] and following.

[1] https://github.com/php/php-src/issues/12504#issuecomment-1790870399

Closes GH-13207.
2024-01-22 21:59:11 +01:00
Ilija Tovilo
1441f30a8d
Merge branch 'PHP-8.1' into PHP-8.2
* PHP-8.1:
  Remove session ID set through REQUEST_URI
2023-06-22 12:36:52 +02:00
Ilija Tovilo
f160eff441
Remove session ID set through REQUEST_URI 2023-06-22 12:35:55 +02:00
David Carlier
65782fbbe8 Merge branch 'PHP-8.1' into PHP-8.2 2022-11-15 12:30:04 +00:00
David Carlier
a4298c14c1 Fix GH-9932: Discards further characters for session name.
As those are converted, it s better to make aware of the code caller of the naming inadequacy.
Closes GH-9940.
2022-11-15 12:27:44 +00:00
George Peter Banyard
7d5ce1c483
Merge branch 'PHP-8.1' into PHP-8.2
* PHP-8.1:
  Actually fix GH-9583
2022-10-06 14:31:29 +01:00
George Peter Banyard
09a57d385d
Merge branch 'PHP-8.0' into PHP-8.1
* PHP-8.0:
  Actually fix GH-9583
2022-10-06 14:29:53 +01:00
George Peter Banyard
499fbcd679
Actually fix GH-9583
The issue is that PS(mod)->s_validate_sid is always defined for user modules, thus we need to check that the actual callable is set
Add another regression test to ensure current working behaviour is not broken (which was by the previous incorrect fix)

Closes GH-9638
2022-10-06 14:29:13 +01:00
George Peter Banyard
3579ddaace
Merge branch 'PHP-8.1' into PHP-8.2
* PHP-8.1:
  Fix GH-9583: session_create_id() fails with user defined save handler that doesn't have a validateId() method
2022-09-27 15:58:30 +01:00
George Peter Banyard
72cb47338e
Merge branch 'PHP-8.0' into PHP-8.1
* PHP-8.0:
  Fix GH-9583: session_create_id() fails with user defined save handler that doesn't have a validateId() method
2022-09-27 15:54:37 +01:00
George Peter Banyard
8b115254c0
Fix GH-9583: session_create_id() fails with user defined save handler that doesn't have a validateId() method 2022-09-27 15:52:21 +01:00
Ilija Tovilo
3071d85a6b
PS(mod_user_class_name) must not leak into next request
Fixes GH-9584
2022-09-22 11:37:37 +02:00
George Peter Banyard
1ad59b32c2 Update INI validator and displayers depending on INI type
Closes GH-9451
2022-09-06 10:33:34 +01:00
George Peter Banyard
66aed3a86f SameSite session cookie prop should behave like other INI settings
It should warn if the INI setting is changed after headers are sent or a session is not active
2022-08-22 16:09:46 +01:00
George Peter Banyard
a8f8cc207c Check sessions are active before output emitted consistently 2022-08-22 15:45:43 +01:00
George Peter Banyard
ad3ee47c6d Remove OnUpdateTransSid validator
It is more restrictive than the OnUpdateSessionBool one
2022-08-22 15:45:43 +01:00
George Peter Banyard
e9749a3c1e Remove OnUpdateLazyWrite validator
It is identical to the OnUpdateSessionBool one
2022-08-22 15:45:43 +01:00
Tim Düsterhus
b825756317
Update expires format for session cookie (#9304)
* Update expires format for session cookie

see GH-9200
see 15e3fcb468

* Add ext/session/tests/gh9200.phpt
2022-08-12 19:52:04 +02:00
Máté Kocsis
a98560ad3f
Declare ext/session constants in stubs (#9112) 2022-07-23 12:32:21 +02:00
Go Kudo
4d8dd8d258
Implement Random Extension
https://wiki.php.net/rfc/rng_extension
https://wiki.php.net/rfc/random_extension_improvement
2022-07-19 10:27:38 +01:00
Rowan Tommins
af15923bc3
Extend deprecation notices to is_callable($foo) and callable $foo
Implements https://wiki.php.net/rfc/partially-supported-callables-expand-deprecation-notices
so that uses of "self" and "parent" in is_callable() and callable
type constraints now raise a deprecation notice, independent of the
one raised when and if the callable is actually invoked.

A new flag is added to the existing check_flags parameter of
zend_is_callable / zend_is_callable_ex, for use in internal calls
that would otherwise repeat the notice multiple times. In particular,
arguments to internal function calls are checked first based on
arginfo, and then again during ZPP, so the former suppresses the
deprecation notice.

Some existing tests which raised this deprecation have been updated
to avoid the syntax, but the existing version retained for maximum
regression coverage until it is made an error.

With thanks to Juliette Reinders Folmer for the RFC and initial
investigation.

Closes GH-8823.
2022-07-14 17:07:42 +02:00
Arnaud Le Blanc
4df3dd7679
Reduce memory allocated by var_export, json_encode, serialize, and other (#8902)
smart_str uses an over-allocated string to optimize for append operations. Functions that use smart_str tend to return the over-allocated string directly. This results in unnecessary memory usage, especially for small strings.

The overhead can be up to 231 bytes for strings smaller than that, and 4095 for other strings. This can be avoided for strings smaller than `4096 - zend_string header size - 1` by reallocating the string.

This change introduces `smart_str_trim_to_size()`, and calls it in `smart_str_extract()`. Functions that use `smart_str` are updated to use `smart_str_extract()`.

Fixes GH-8896
2022-07-08 14:47:46 +02:00
George Peter Banyard
4a5699ae2f Session: use more appropriate types 2022-05-29 15:24:06 +01:00
George Peter Banyard
2ecd46f48f
Initialise zend_stat_t to fix MSAN build 2022-05-22 16:06:27 +01:00
Ilija Tovilo
0db03c4110
Improve sesson write failure message for user error handlers
Closes GH-7787
Closes GH-8186
2022-03-11 15:08:16 +01:00
Dmitry Stogov
90b7bde615 Use more compact representation for packed arrays.
- for packed arrays we store just an array of zvals without keys.
- the elements of packed array are accessible throuf as ht->arPacked[i]
  instead of ht->arData[i]
- in addition to general ZEND_HASH_FOREACH_* macros, we introduced similar
  familied for packed (ZEND_HASH_PACKED_FORECH_*) and real hashes
  (ZEND_HASH_MAP_FOREACH_*)
- introduced an additional family of macros to access elements of array
  (packed or real hashes) ZEND_ARRAY_ELEMET_SIZE, ZEND_ARRAY_ELEMET_EX,
  ZEND_ARRAY_ELEMET, ZEND_ARRAY_NEXT_ELEMENT, ZEND_ARRAY_PREV_ELEMENT
- zend_hash_minmax() prototype was changed to compare only values

Because of smaller data set, this patch may show performance improvement
on some apps and benchmarks that use packed arrays. (~1% on PHP-Parser)

TODO:
    - sapi/phpdbg needs special support for packed arrays (WATCH_ON_BUCKET).
    - zend_hash_sort_ex() may require converting packed arrays to hash.
2021-11-03 15:18:26 +03:00
Nikita Popov
989205e95c Remove incorrect uses of zend_atoi()
zend_atoi() parses integers with size suffixes (like "128M").
These just want to use a plain number, so use ZEND_ATOL instead.
2021-07-12 16:56:00 +02:00
Patrick Allaert
aff365871a Fixed some spaces used instead of tabs 2021-06-29 11:30:26 +02:00
George Peter Banyard
c40231afbf
Mark various functions with void arguments.
This fixes a bunch of [-Wstrict-prototypes] warning,
because in C func() and func(void) have different semantics.
2021-05-12 14:55:53 +01:00
George Peter Banyard
a9695cc615
Refactor register shutdown function mechanism
Use FCI/FCC structure instead of custom implementation which does the same.
This also fixes the "bug" which prevented static methods from being shutdown functions.

Closes GH-5829

Co-authored-by: Aaron Piotrowski <aaron@trowski.com>
2021-05-10 15:54:59 +01:00
KsaR
01b3fc03c3
Update http->https in license (#6945)
1. Update: http://www.php.net/license/3_01.txt to https, as there is anyway server header "Location:" to https.
2. Update few license 3.0 to 3.01 as 3.0 states "php 5.1.1, 4.1.1, and earlier".
3. In some license comments is "at through the world-wide-web" while most is without "at", so deleted.
4. fixed indentation in some files before |
2021-05-06 12:16:35 +02:00
Nikita Popov
4ce5d2ea88 Add known strings for jit autoglobals
We always create interned strings for all autoglobals anyway, so
we might as well add known strings to make them more widely usable.
2021-04-09 15:37:59 +02:00
George Peter Banyard
09efad615b
Use zend_string_equals_(literal_)ci() API more often
Also drive-by usage of zend_ini_parse_bool()

Closes GH-6844
2021-04-09 02:34:50 +01:00
George Peter Banyard
5caaf40b43
Introduce pseudo-keyword ZEND_FALLTHROUGH
And use it instead of comments
2021-04-07 00:46:29 +01:00
Christoph M. Becker
f4412f56a2 Merge branch 'PHP-8.0'
* PHP-8.0:
  Properly initialize PS(mod) on RINIT
2021-03-23 13:14:49 +01:00
Christoph M. Becker
733b514326 Merge branch 'PHP-7.4' into PHP-8.0
* PHP-7.4:
  Properly initialize PS(mod) on RINIT
2021-03-23 13:13:43 +01:00
Christoph M. Becker
688e56d0ac Properly initialize PS(mod) on RINIT
We need to do that in case a user handler has been set.  However, we
can't do that in `php_rinit_session_globals()` since that function is
called by PHP function `session_destroy()` too, but in that case we
don't want to reset PS(mod).

Closes GH-6795.
2021-03-23 13:12:19 +01:00
Christoph M. Becker
fd62917730 Merge branch 'PHP-8.0'
* PHP-8.0:
  Fix #80889: amendment
2021-03-22 22:51:12 +01:00
Christoph M. Becker
90be86fc91 Merge branch 'PHP-7.4' into PHP-8.0
* PHP-7.4:
  Fix #80889: amendment
2021-03-22 22:49:46 +01:00
Christoph M. Becker
838951c2d6 Fix #80889: amendment
`session_set_save_handler()` may be called with callables instead of an
object; we need to cater to that as well.

We also extract a set_user_save_handler_ini() function to avoid code
duplication.

Closes GH-6796.
2021-03-22 22:17:35 +01:00
Christoph M. Becker
64e589cab6 Merge branch 'PHP-8.0'
* PHP-8.0:
  Fix #80889: Cannot set save handler when save_handler is invalid
2021-03-19 17:05:32 +01:00
Christoph M. Becker
2a1ed81ffc Merge branch 'PHP-7.4' into PHP-8.0
* PHP-7.4:
  Fix #80889: Cannot set save handler when save_handler is invalid
2021-03-19 17:03:54 +01:00
Christoph M. Becker
06bfada99b Fix #80889: Cannot set save handler when save_handler is invalid
There is no need to require a (valid) save_handler to be set, when a
user handler is supposed to be set.  We just have to make sure, that
no user handler is already set in this case.

Closes GH-6788.
2021-03-19 16:59:54 +01:00
Christoph M. Becker
59d030c55b Merge branch 'PHP-8.0'
* PHP-8.0:
  Fix #80774: session_name() problem with backslash
2021-02-22 12:36:43 +01:00
Christoph M. Becker
6dcd640f35 Merge branch 'PHP-7.4' into PHP-8.0
* PHP-7.4:
  Fix #80774: session_name() problem with backslash
2021-02-22 12:35:23 +01:00
Christoph M. Becker
d7c98ca1ac Fix #80774: session_name() problem with backslash
Since we do no longer URL decode cookie names[1], we must not URL
encode the session name.  We need to prevent broken Set-Cookie headers,
by rejecting names which contain invalid characters.

[1] <http://git.php.net/?p=php-src.git;a=commit;h=6559fe912661ca5ce5f0eeeb591d928451428ed0>

Closes GH-6711.
2021-02-22 12:32:56 +01:00
Máté Kocsis
5b5bfd6be4
Generate class entries from stubs for phar, posix, pspell, readline, reflection, session, shmop
Closes GH-6692
2021-02-15 00:11:22 +01:00
Nikita Popov
3e01f5afb1 Replace zend_bool uses with bool
We're starting to see a mix between uses of zend_bool and bool.
Replace all usages with the standard bool type everywhere.

Of course, zend_bool is retained as an alias.
2021-01-15 12:33:06 +01:00
Nikita Popov
8067cf4752 Use callable type in register_shutdown_function()
To make things a bit less weird, split off the function name into
a zval stored separately from the arguments. This allows us to
use normal zpp and get standard behavior.
2020-09-25 14:48:33 +02:00