Commit graph

1017 commits

Author SHA1 Message Date
Gina Peter Banyard
db01dbc4ee ext/session: Initialize variable with default value
To make it easier for IDEs to understand what is going on
2025-07-06 17:21:00 +01:00
Gina Peter Banyard
766ccc2210 ext/session: Use zend_string for some session globals 2025-07-06 17:21:00 +01:00
Gina Peter Banyard
f5166b3bb6 ext/session: convert global session_name to zstr 2025-07-06 17:21:00 +01:00
Gina Peter Banyard
b83484df97 ext/session: Use is_numeric_str helper 2025-07-06 17:21:00 +01:00
Gina Peter Banyard
ac3807ee8d ext/session: Use ZEND_STRL() 2025-07-06 17:21:00 +01:00
Gina Peter Banyard
c529e2f85b ext/session: Use smart_str_append when possible 2025-07-06 17:21:00 +01:00
Gina Peter Banyard
eaee504c4d ext/session: Concert save_path to zstr 2025-07-06 17:21:00 +01:00
Gina Peter Banyard
9c68853023 ext/session: copy zstr instead of initializing a new one 2025-07-06 17:21:00 +01:00
Gina Peter Banyard
43fe9fd171 ext/session: convert some globals to zend_string
This prevents some strlen computations
2025-07-06 17:21:00 +01:00
Jessica Smith
042a975238
ext/session: Fix GH-18634 (#18653)
Show warning when saving session if a pipe character is used in one of the $_SESSION keys

Fixes #18634
2025-05-26 11:17:25 +01:00
Jorg Adam Sowa
3f3ac4de25
[skip ci] Remove wrappers comments in session ext (#18017) 2025-03-13 12:14:31 +00:00
Gina Peter Banyard
3930b6f378
Merge branch 'PHP-8.4'
* PHP-8.4:
  ext/session: Fix GH-17541 (ext/session NULL pointer dereferencement during ID reset)
2025-01-24 14:10:12 +00:00
Gina Peter Banyard
d35904adf2
Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  ext/session: Fix GH-17541 (ext/session NULL pointer dereferencement during ID reset)
2025-01-24 14:10:00 +00:00
Gina Peter Banyard
a85666c17b
ext/session: Fix GH-17541 (ext/session NULL pointer dereferencement during ID reset)
Closes GH-17541
Closes GH-17546
2025-01-24 14:04:58 +00:00
Niels Dossche
6d4598eba8
Merge branch 'PHP-8.4'
* PHP-8.4:
  Fix type confusion with session SID constant
2025-01-23 19:03:45 +01:00
Niels Dossche
b448d540c2
Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Fix type confusion with session SID constant
2025-01-23 19:03:35 +01:00
Niels Dossche
2a2cc2ccce
Fix type confusion with session SID constant
Closes GH-17548.
2025-01-23 19:03:04 +01:00
David Carlier
a091e52316
ext/session: session_start() options arguments type checks.
close GH-17388
2025-01-07 23:52:39 +00:00
Gina Peter Banyard
6ab38b52d3 ext/standard: Refactor tick and shutdown functions
Remove usage of FCI and store the parameters and count of it directly on the relevant structures
This reduces the size of the structs by ~50
2024-12-29 23:41:06 +00:00
Niels Dossche
173bdb2c06
Merge branch 'PHP-8.4'
* PHP-8.4:
  Fix GH-16590: UAF in session_encode()
  Fix various memory leaks on error conditions in openssl_x509_parse()
2024-11-04 20:05:42 +01:00
Niels Dossche
cc39bc21e3
Fix GH-16590: UAF in session_encode()
The `PS_ENCODE_LOOP` does not protect the session hash table that it
iterates over. Change it by temporarily creating a copy.

Closes GH-16640.
2024-11-04 20:05:32 +01:00
Calvin Buckley
84d6cb8cf0
Unify headers already sent/session already started error handler (#16451)
* Unify headers already sent errors

Now whenever we need to check where headers were already sent in
ext/session, we call a single location that prints where, keeping it
consistent output wise.

* Unify session aready started errors

Similar to the one for headers.

* Also change session active checks too

This usually go hand in hand with the headers already sent checks, but
is in a separate commit because of the amount of tests it changes.
2024-10-17 13:13:56 -03:00
Calvin Buckley
edf351ce6d
Mention where headers were already sent if session_start fails (#16378)
We had previously improved where sessions were already started, and
where headers were already sent when setting headers, but not where a
header has been sent if we try to set the header cookie.

Fixes GH-16372
2024-10-14 21:13:43 -03:00
David Carlier
4d008e300b
Merge branch 'PHP-8.3' into PHP-8.4 2024-10-13 14:19:45 +01:00
David Carlier
f31232e218
Merge branch 'PHP-8.2' into PHP-8.3 2024-10-13 14:19:33 +01:00
David Carlier
84a8fea251
Fix GH-16290: session cookie_lifetime ini value overflow.
close GH-16295
2024-10-13 14:19:18 +01:00
Niels Dossche
45f7f87b75
Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Fix GH-16385: Unexpected null returned by session_set_cookie_params
2024-10-12 13:09:24 +02:00
Niels Dossche
a1f7ce5617
Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix GH-16385: Unexpected null returned by session_set_cookie_params
2024-10-12 13:09:06 +02:00
Niels Dossche
7cdd1302c3
Fix GH-16385: Unexpected null returned by session_set_cookie_params
Two issues:
1) The check happened before ZPP checks
2) The `return;` statement caused NULL to be returned while this
   function can only return booleans. An exception seems not acceptable
   in stable versions, but a warning may do.

Closes GH-16386.
2024-10-12 13:08:37 +02:00
Christoph M. Becker
217ea732fc
Use php_error_docref() instead of zend_error() in session.c (GH-15505)
Using `php_error_docref()` is preferable since it outputs additional
details (which function has been called and whether it is a startup or
shutdown error), uses HTML markup, and also provides a link to the
documentation, if configured.

Since these deprecation warnings have been introduced recently[1][2],
i.e. for PHP 8.4, there are no BC concerns.

[1] <e8ff7c70f9>
[2] <b36eac94d2>

Co-authored-by: Máté Kocsis <kocsismate90@gmail.com>
2024-09-04 16:00:28 +02:00
Kamil Tekiela
c5bce0d8a2
Deprecate disabling use_only_cookies (#13578) 2024-08-24 16:33:45 +02:00
Jorg Adam Sowa
ff69f334f1
ext/session: Warn when providing invalid values for session.gc_probability and session.gc_divisor 2024-08-22 01:29:40 +01:00
Jorg Adam Sowa
21fa5e15f9
ext/session: session_create_id() now throws a ValueError for large prefix (#15338) 2024-08-15 11:10:18 +01:00
Jorg Adam Sowa
6bf7b7220d
ValueError on null byte in session_name() (#15286) 2024-08-11 13:26:54 +01:00
Tim Düsterhus
e8ff7c70f9
session: Deprecate session.sid_length and session.sid_bits_per_character (#15213)
RFC: https://wiki.php.net/rfc/deprecations_php_8_4
2024-08-04 18:25:31 +02:00
Christoph M. Becker
af789afbe8
Fix type incompatibility in assignment.
This partially reverts 0956267c08, which
introduced a type incompatibility where an `int` function is assigned
to a `zend_result` function.  That yields a level 1 C4133 warning on
MSVC, and usually (e.g. in CI) level 1 warnings are elevated to errors,
so the build fails.[1]

The PHP-8.3 branch and up are uneffected by this, so the upward merges
should be empty.

[1] <0956267c08 (r144587696)>
2024-07-26 14:57:16 +02:00
Levi Morrison
9d25296723
Merge branch 'PHP-8.3' 2024-07-23 16:34:16 -06:00
Levi Morrison
e43d9c7469
Merge branch 'PHP-8.2' into PHP-8.3 2024-07-23 16:33:40 -06:00
Levi Morrison
0956267c08
Fix warnings in session/spl
This fixes -Winline errors where the functions are not ever inlined.

Also fixes some signature mismatches which were fixed previously but
for whatever reason were not ported to all maintained branches:

/usr/local/src/php/ext/session/session.c:1299:20:
warning:conflicting types for 'php_session_send_cookie' due to enum/integer mismatch;
have 'zend_result(void)' {aka 'ZEND_RESULT_CODE(void)'} [-Wenum-int-mismatch]
 1299 | static zend_result php_session_send_cookie(void) /* {{{ */
      |                    ^~~~~~~~~~~~~~~~~~~~~~~
/usr/local/src/php/ext/session/session.c💯12:
note: previous declaration of 'php_session_send_cookie' with type 'int(void)'
  100 | static int php_session_send_cookie(void);
      |            ^~~~~~~~~~~~~~~~~~~~~~~
2024-07-23 16:25:11 -06:00
Jorg Adam Sowa
8e1561cdbe
Check session_create_id() input for null byte (#14728) 2024-07-06 21:18:35 +01:00
Arnaud Le Blanc
11accb5cdf
Preferably include from build dir (#13516)
* Include from build dir first

This fixes out of tree builds by ensuring that configure artifacts are included
from the build dir.

Before, out of tree builds would preferably include files from the src dir, as
the include path was defined as follows (ignoring includes from ext/ and sapi/) :

    -I$(top_builddir)/main
    -I$(top_srcdir)
    -I$(top_builddir)/TSRM
    -I$(top_builddir)/Zend
    -I$(top_srcdir)/main
    -I$(top_srcdir)/Zend
    -I$(top_srcdir)/TSRM
    -I$(top_builddir)/

As a result, an out of tree build would include configure artifacts such as
`main/php_config.h` from the src dir.

After this change, the include path is defined as follows:

    -I$(top_builddir)/main
    -I$(top_builddir)
    -I$(top_srcdir)/main
    -I$(top_srcdir)
    -I$(top_builddir)/TSRM
    -I$(top_builddir)/Zend
    -I$(top_srcdir)/Zend
    -I$(top_srcdir)/TSRM

* Fix extension include path for out of tree builds

* Include config.h with the brackets form

`#include "config.h"` searches in the directory containing the including-file
before any other include path. This can include the wrong config.h when building
out of tree and a config.h exists in the source tree.

Using `#include <config.h>` uses exclusively the include path, and gives
priority to the build dir.
2024-06-26 00:26:43 +02:00
Gina Peter Banyard
fd2d869642
Clean-up some more headers (#14416)
Remove unused headers (such as php_ini.h for extensions that don't define INI settings)
Use more specific headers when possible
2024-06-08 17:15:36 +01:00
Peter Kokot
ec50b178f1
Update ext/session spl dependency (#14410)
The spl dependency is configured so the spl_autoload_register is
available when session_start() is used, meaning the spl extension needs
to be loaded before the session. It is marked as optional to be more
explicit as spl is not directly used nor required in the session
extension.
2024-06-01 19:13:54 +02:00
Peter Kokot
f69c55b5b6
Remove hash dependency from session extension (#14409)
The session extension once depended on the hash extension for having
hash functions available when using the `session.hash_function` INI
directive. This directive was removed in PHP-7.1 via
3467526a65. At the time it could be marked
as optional dependency, because it only needed to be loaded before the
session in that case.

The removed ext/hash/php_hash.h in the ext/session/php_session.h might
cause BC break for PHP extensions if they rely on transitive include and
use hash extension in the code without explicitly including the
ext/hash/php_hash.h header. Solution is to include the
ext/hash/php_hash.h separately.
2024-06-01 17:06:17 +01:00
Niels Dossche
c7797fc8c0
Fix bug GH-11941: soap with session persistence will silently fails when "seession" built as a shared object (#14362)
This adds an optional dependency on the session extension and adds the
necessary APIs to make the functionality work with lazy binding.

This can be tested by configuring PHP with `--enable-session=shared` and
`--enable-soap=shared` and running the test suite, in particular the
buggy behaviour can be observed by the existing test `server009.phpt`.
2024-05-29 19:51:49 +02:00
Jorg Adam Sowa
f69d540541
Removed impossible paths from session_decode and session_encode (#13796) 2024-03-24 20:20:42 +01:00
Tim Düsterhus
81744d6cf7
random: Improve the output quality of RANDOM_SEED() (#13730)
* random: Improve the output quality of RANDOM_SEED()

Previously 4 consecutive calls to `RANDOM_SEED()` each for 4 different CLI
requests resulted in:

    $ sapi/cli/php test.php
    2c13e9fde9caa
    2c13e9fd1d6b0
    2c13e9fd4de34
    2c13e9fd1610e
    $ sapi/cli/php test.php
    2c1436764fe07
    2c14367621770
    2c143676c0bf6
    2c143676e02f5
    $ sapi/cli/php test.php
    2c144995a0626
    2c14499590fe2
    2c144995c65db
    2c14499536833
    $ sapi/cli/php test.php
    2c145cb30860b
    2c145cb3ec027
    2c145cb33b4ca
    2c145cb38ff63

Now they result in:

    $ sapi/cli/php test.php
    6796973ace1b5f3d
    1913daf5c158cb4b
    255dbf24237bc8c9
    7c3ba22e60f35196
    $ sapi/cli/php test.php
    afb7cc9ba9819cd2
    3e01a71b91ad020c
    6b718364d3ef108
    bdcd17beeb4b31d2
    $ sapi/cli/php test.php
    53d36eb9b83f8788
    4381c85e816187aa
    2e9b32ee9898e71e
    31d15c946842bddb
    $ sapi/cli/php test.php
    2037a3cba88114b4
    ba0b0d93a9bb43aa
    e13d82d2421269e2
    191de474f3292240

* tree-wide: Replace GENERATE_SEED() by php_random_generate_fallback_seed()

* random: Fix NTS build

* random: Fix Windows build
2024-03-18 16:08:23 +01:00
Niels Dossche
8793f9938b Merge branch 'PHP-8.3'
* PHP-8.3:
  Fix GH-13680: Segfault with session_decode and compilation error
2024-03-13 17:59:43 +01:00
Niels Dossche
b58dc6fd1a Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix GH-13680: Segfault with session_decode and compilation error
2024-03-13 17:49:31 +01:00
Niels Dossche
6985aff7c3 Fix GH-13680: Segfault with session_decode and compilation error
It's illegal to return from a bailout because that doesn't restore the
original bailout data. Return outside of it.

Test by YuanchengJiang

Closes GH-13689.
2024-03-13 17:47:25 +01:00