Edit report at https://bugs.php.net/bug.php?id=71243&edit=1
ID: 71243
Updated by: [email protected]
Reported by: maggus dot staab at googlemail dot com
Summary: session_start() returns true, even for invalid
session ids
-Status: Assigned
+Status: Analyzed
Type: Bug
Package: Session related
Operating System: Ubuntu12 lts
PHP Version: Irrelevant
Assigned To: yohgaki
Block user comment: N
Private report: N
New Comment:
@maggus Thank you for the report.
The cause is different. The cause is
static void ps_files_open(ps_files *data, const char *key TSRMLS_DC)
is not returning status properly.
Many session internal functions were written w/o return values originally. It's time for cleanup to fix these issues. Some of them will be only for PHP 7.1 as PHPAPI needs changes.
Previous Comments:
------------------------------------------------------------------------
[2015-12-30 10:14:18] maggus dot staab at googlemail dot com
Description:
------------
session_start() returns true, even if the configured session_id() is invalid.
This is similar to https://bugs.php.net/bug.php?id=65795 but I guess the cause is different.
Test script:
---------------
https://3v4l.org/HXRoR
session_id('öäü');
var_dump(session_start());
Expected result:
----------------
Warning: The session id contains illegal characters, valid characters are a-z, A-Z, 0-9 and '-,' in /in/HXRoR on line 4
bool(false)
Actual result:
--------------
Warning: The session id contains illegal characters, valid characters are a-z, A-Z, 0-9 and '-,' in /in/HXRoR on line 4
bool(true)
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=71243&edit=1
lmpx.com only provides a reader for public news (NNTP) servers. It is not
affiliated with the servers or forums shown here and is not responsible for
the content of articles, which is written by their respective authors.