[php-src] master: session: fix create_sid()/validateId() check depending on interface order (#23329)

Author: Lazizbek Ergashev (lazerg)
Committer: GitHub (web-flow)
Pusher: Girgias
Date: 2026-08-18T19:50:33+01:00

Commit: https://github.com/php/php-src/commit/52767e6ee78b6c18e2c2718899c98f8653f0662d
Raw diff: https://github.com/php/php-src/commit/52767e6ee78b6c18e2c2718899c98f8653f0662d.diff

session: fix create_sid()/validateId() check depending on interface order (#23329)

Closes GH-23328

Changed paths:
  A  ext/session/tests/user_session_module/gh23328.phpt
  M  ext/session/session.c


Diff:

diff --git a/ext/session/session.c b/ext/session/session.c
index a6e698d4c0aa..e745a628767f 100644
--- a/ext/session/session.c
+++ b/ext/session/session.c
@@ -2935,13 +2935,27 @@ static PHP_GINIT_FUNCTION(ps)
 	ps_globals->random_seeded = false;
 }
 
+/* Interfaces extending the given one are not flattened into ce->interfaces before they are
+ * themselves processed, so every entry has to be checked with instanceof. */
+static bool session_interfaces_include(const zend_class_entry *ce, const zend_class_entry *iface)
+{
+	for (uint32_t i = 0; i < ce->num_interfaces; i++) {
+		if (instanceof_function(ce->interfaces[i], iface)) {
+			return true;
+		}
+	}
+	return false;
+}
+
 static int session_handler_interface_gets_implemented(zend_class_entry *self, zend_class_entry *class) {
-	if (!zend_hash_str_exists(&class->function_table, ZEND_STRL("create_sid"))) {
+	if (!zend_hash_str_exists(&class->function_table, ZEND_STRL("create_sid"))
+		&& !session_interfaces_include(class, php_session_id_iface_entry)) {
 		zend_error(E_WARNING,
 			"Class %s implementing SessionHandlerInterface is missing the create_sid() method which will be required in PHP 9.0",
 			ZSTR_VAL(class->name));
 	}
-	if (!zend_hash_str_exists(&class->function_table, ZEND_STRL("validateid"))) {
+	if (!zend_hash_str_exists(&class->function_table, ZEND_STRL("validateid"))
+		&& !session_interfaces_include(class, php_session_update_timestamp_iface_entry)) {
 		zend_error(E_WARNING,
 			"Class %s implementing SessionHandlerInterface is missing the validateId() method which will be required in PHP 9.0",
 			ZSTR_VAL(class->name));
diff --git a/ext/session/tests/user_session_module/gh23328.phpt b/ext/session/tests/user_session_module/gh23328.phpt
new file mode 100644
index 000000000000..c23ccb1de389
--- /dev/null
+++ b/ext/session/tests/user_session_module/gh23328.phpt
@@ -0,0 +1,32 @@
+--TEST--
+GH-23328: SessionHandlerInterface create_sid()/validateId() warning depends on interface order
+--EXTENSIONS--
+session
+--FILE--
+<?php
+
+abstract class HandlerFirst implements SessionHandlerInterface, SessionIdInterface, SessionUpdateTimestampHandlerInterface {}
+abstract class HandlerLast implements SessionIdInterface, SessionUpdateTimestampHandlerInterface, SessionHandlerInterface {}
+
+interface CombinedInterface extends SessionIdInterface, SessionUpdateTimestampHandlerInterface {}
+abstract class CombinedFirst implements CombinedInterface, SessionHandlerInterface {}
+abstract class CombinedLast implements SessionHandlerInterface, CombinedInterface {}
+
+interface NestedInterface extends CombinedInterface {}
+abstract class NestedLast implements SessionHandlerInterface, NestedInterface {}
+
+abstract class MissingBoth implements SessionHandlerInterface {}
+abstract class MissingValidateId implements SessionHandlerInterface, SessionIdInterface {}
+abstract class MissingCreateSid implements SessionHandlerInterface, SessionUpdateTimestampHandlerInterface {}
+
+echo "Done\n";
+?>
+--EXPECTF--
+Warning: Class MissingBoth implementing SessionHandlerInterface is missing the create_sid() method which will be required in PHP 9.0 in %s on line %d
+
+Warning: Class MissingBoth implementing SessionHandlerInterface is missing the validateId() method which will be required in PHP 9.0 in %s on line %d
+
+Warning: Class MissingValidateId implementing SessionHandlerInterface is missing the validateId() method which will be required in PHP 9.0 in %s on line %d
+
+Warning: Class MissingCreateSid implementing SessionHandlerInterface is missing the create_sid() method which will be required in PHP 9.0 in %s on line %d
+Done