Bug #71243 [Ana]: session_start() returns true, even for invalid session ids

Edit report at https://bugs.php.net/bug.php?id=71243&edit=1

 ID:                 71243
 Updated by:         [email protected]
 Reported by:        maggus dot staab at googlemail dot com
 Summary:            session_start() returns true, even for invalid
                     session ids
 Status:             Analyzed
 Type:               Bug
 Package:            Session related
 Operating System:   Ubuntu12 lts
 PHP Version:        Irrelevant
 Assigned To:        yohgaki
 Block user comment: N
 Private report:     N

 New Comment:

I have to kill broken save handler implementations also. i.e. BC

static void php_session_initialize(TSRMLS_D
**SNIP**
	if (PS(mod)->s_read(&PS(mod_data), PS(id), &val, &vallen TSRMLS_CC) == FAILURE) {
		/* Some broken save handler implementation returns FAILURE for non-existent session ID */
		/* It's better to raise error for this, but disabled error for better compatibility */
		/*
		php_error_docref(NULL TSRMLS_CC, E_NOTICE, "Failed to read session data: %s (path: %s)", PS(mod)->s_name, PS(save_path));
		*/
	}


Previous Comments:
------------------------------------------------------------------------
[2015-12-31 00:56:49] [email protected]

I have to change this function's signature

PHPAPI void php_session_start(TSRMLS_D)

Fix will be only for 7.1 and later.

------------------------------------------------------------------------
[2015-12-31 00:32:29] [email protected]

@maggus Thank you for the report.
The cause is different. The cause is 

static void ps_files_open(ps_files *data, const char *key TSRMLS_DC)

is not returning status properly.

Many session internal functions were written w/o return values originally. It's time for cleanup to fix these issues. Some of them will be only for PHP 7.1 as PHPAPI needs changes.

------------------------------------------------------------------------
[2015-12-30 10:14:18] maggus dot staab at googlemail dot com

Description:
------------
session_start() returns true, even if the configured session_id() is invalid.

This is similar to https://bugs.php.net/bug.php?id=65795 but I guess the cause is different.

Test script:
---------------
https://3v4l.org/HXRoR

session_id('öäü');
var_dump(session_start());

Expected result:
----------------
Warning: The session id contains illegal characters, valid characters are a-z, A-Z, 0-9 and '-,' in /in/HXRoR on line 4
bool(false)

Actual result:
--------------
Warning: The session id contains illegal characters, valid characters are a-z, A-Z, 0-9 and '-,' in /in/HXRoR on line 4
bool(true)


------------------------------------------------------------------------



--
Edit this bug report at https://bugs.php.net/bug.php?id=71243&edit=1