Edit report at https://bugs.php.net/bug.php?id=71289&edit=1
ID: 71289
Updated by: [email protected]
Reported by: pfenderd at bellsouth dot net
-Summary: JIT $_FILES initilization is required for multiple
session.name to work
+Summary: Using session_name() prevents session_progress
features from working
-Status: Analyzed
+Status: Duplicate
-Type: Feature/Change Request
+Type: Documentation Problem
Package: Session related
Operating System: any
PHP Version: irrelevant
-Assigned To:
+Assigned To: cmb
Block user comment: N
Private report: N
New Comment:
Like Yasuo said, uploads are processed before any scripts are
actually executed. When an upload is in progress, the respective
data are written to the session as specified in php.ini, and
$_SESSION is populated. If you change the session name and then
start a session, the upload data are therefore no longer available
in $_SESSION. The cleanest solution is to set the desired
session.name prior to script execution. If that is not possible
for whatever reason, you can work around with something like:
<?php
if (isset($_SESSION)) {
$upload_data = $_SESSION;
}
session_name("myname");
session_start();
$_SESSION = array_merge($_SESSION, $upload_data);
?>
Thus, this is merely a doc problem, and hence a duplicate of bug
#76808.
Previous Comments:
------------------------------------------------------------------------
[2016-01-20 16:19:39] pfenderd at bellsouth dot net
Is there a difference in how sessions are handled using the API or the fast CGI on the server side? My testing has been on Windows 7 using IIS 7.5. If there is a difference in the server type of session handling, then this should be well documented so programmers can deal with it.
The problem has nothing to do with multiple files being uploaded, only a single file.
------------------------------------------------------------------------
[2016-01-07 05:14:39] [email protected]
Possible work around is to set session.name in .htaccess. "php_value" directive is processed before uploaded file handling. If you use .htaccess (or like) to set different session name, it should work. You'll need individual files, at least symlink, though.
------------------------------------------------------------------------
[2016-01-07 05:09:30] [email protected]
The reason why changing session name after module initialization does not work is the way RFC 1867 callback implemented.
Upload progress callback (php_rfc1867_callback) is registered when session module is initialized. It is used when RFC 1867 upload is performed and handled in main/rfc1867.c.
This means changing session name in user script is too late to make it work. I think it does not work in older versions also, does it?
Possible fix would be delaying file upload handling and/or handle file upload manually. PHP handles file uploading automatically now. Anyway, user cannot make use of session_name('NEW_NAME')/ini_set('session.name', 'NEW_NAME') to use multiple file upload progress handling.
I checked the code briefly. Please correct me if I'm wrong.
------------------------------------------------------------------------
[2016-01-07 01:44:28] pfenderd at bellsouth dot net
More on the problem conditions: To make the session_name() function work with session.upload_progress, the session first needs to be started without using session_name() AND also a file upload needs to be done. Once the first file has been uploaded, then it is safe to use session_name() and the progress feature will work properly.
Test using session_name(): http://upx.djpnet.dyndns.org/form1.php
Test without using session_name(): http://upx.djpnet.dyndns.org/form1.php?sn=0
------------------------------------------------------------------------
[2016-01-06 22:04:56] pfenderd at bellsouth dot net
The problem is a little bit more complicated than first thought. When a browser is first opened and a session started using session_name() before session_start() the problem will continue to occur. However, if a session is opened without using session_name() just once, then thereafter the use of session_name() will not cause a problem. This is repeatable with IE 11, Firefox 43.0.4, Chrome 47.0.2526.106 and Opera 34.0.2036.31.
Test using session_name(): http://dayspeaknet.djpnet.dyndns.org/upload_sermons/upx/form1.php
Test without using session_name():
http://dayspeaknet.djpnet.dyndns.org/upload_sermons/upx/form1.php?sn=0
The only difference between these two test URLs is the use of session_name() or not.
Closing the browser and opening the browser again creates the problem situation.
------------------------------------------------------------------------
The remainder of the comments for this report are too long. To view
the rest of the comments, please view the bug report online at
https://bugs.php.net/bug.php?id=71289
--
Edit this bug report at https://bugs.php.net/bug.php?id=71289&edit=1
lmpx.com only provides a reader for public news (NNTP) servers. It is not
affiliated with the servers or forums shown here and is not responsible for
the content of articles, which is written by their respective authors.