Bug #74255 [Nab]: session.use_strict_mode doesn't work with session_set_save_handler upon 'files'

Edit report at https://bugs.php.net/bug.php?id=74255&edit=1

 ID:                 74255
 User updated by:    greedy dot ivan at gmail dot com
 Reported by:        greedy dot ivan at gmail dot com
 Summary:            session.use_strict_mode doesn't work with
                     session_set_save_handler upon 'files'
 Status:             Not a bug
 Type:               Bug
 Package:            Session related
 Operating System:   Windows
 PHP Version:        7.1.2
 Block user comment: N
 Private report:     N

 New Comment:

Because of ignoring use_strict_mode flag when 'files' session handler is exposed, custom validateId method must be implemented that depends on internal realization of file storage mechanism.

This is a minimal implementation:
<?php
session_module_name('files');
ini_set('session.use_strict_mode', '1');

session_set_save_handler(new MySessionHandler(), true);

session_start();
var_dump(session_id());

class MySessionHandler extends SessionHandler
{
    /**
     * Getting full path to session file
     *
     * It's depend on internal realization of 'files' hander.
     * Must be reviewed after each php release.
     */
    private function getFullPathName(string $key) : string
    {
        if (empty($filename = session_save_path())) {
            $filename = sys_get_temp_dir();
        } elseif (strpos($filename, ';') !== false) {
            $data = explode(';', $filename);
            $count = $data[0];
            $filename = end($data);
            for ($i = 0; $i < $count; $i++) {
                $filename .= '/' . $key[$i];
            }
        }
        return $filename.'/sess_'.$key;
    }
    
    public function validateId($key)
    {
        return file_exists($this->getFullPathName($key));
    }
}


Previous Comments:
------------------------------------------------------------------------
[2017-03-16 11:37:09] greedy dot ivan at gmail dot com

It doesn't work either.

I can't use
class MySessionHandler extends SessionHandler
{
    public function validateId($key){
        return parent::validateId($key);
    }
}
because SessionHandler::validateId() is not defined.

Is there any method to wrap internal 'files' handler with use_strict_mode?

------------------------------------------------------------------------
[2017-03-16 10:36:14] [email protected]

You must define validateSid handler to make use_strict_mode work.

------------------------------------------------------------------------
[2017-03-16 07:25:42] greedy dot ivan at gmail dot com

Description:
------------
When session.use_strict_mode is on and custom session handler is wrapped upon 'files' internal handler, session id doesn't regenerate if session id doesn't exist.

If you delete session file and rerun, script must create file with new session id.
It works without session_set_save_handler as expected.
Where session_set_save_handler is set, session id doesn't regenerate.

So, you cannot simply extend internal handler with crypt/decrypt (or something else), because you must redefine open method and all internal logic of finding session file.

Test script:
---------------
session_module_name('files');
ini_set('session.use_strict_mode', '1');

class MySessionHandler extends SessionHandler{}
session_set_save_handler(new MySessionHandler(), true);

session_start();
var_dump(session_id());



Expected result:
----------------
if you delete session file, next run show you another session_id

Actual result:
--------------
You always give the same session id


------------------------------------------------------------------------



--
Edit this bug report at https://bugs.php.net/bug.php?id=74255&edit=1