[RFC] Precise session management #1734
Conversation
…ION__" is in serialized data. Other than this, basic feature works.
TODO: - Add session internal data validation, otherwise broken data can crash PHP. - Remove dependency from previous tests and/or other PHP versions. - Use long parameter for session_destroy([long $duration_for_removing]).
…l_data) for malformed inputs.
…hgaki/php-src into master-rfc-precise-session-management
…er by default (already done in ini). Support disabling automatic session ID regeneration. Update php.ini-production/development.
…e-session-management
…initialization and check in session_decode()
…malformed session data.
…s when transid is used
…t more robust fix will follow. This will be done when this is merged
…e-session-management Fixed conflict
…ors. This is enforced for internal save handlers while user handlers are not. We need to clean up this someday.
…re when fatal error happened.
…investigation for a while.
…e-session-management Conflicts: ext/session/session.c ext/session/tests/bug32330.phpt ext/session/tests/session_set_save_handler_variation5.phpt
| RETURN_BOOL(php_session_destroy() == SUCCESS); | ||
| if (immediate) { | ||
| /* Immediate destroy may cause random lost session by server side race condition. */ | ||
| php_error_docref(NULL, E_NOTICE, "Immediate session data removal may cause random lost sessions. It is advised not to delete immediately"); |
There was a problem hiding this comment.
This is a total no-go. A notice for an intentionally chosen behavior (explicitly passing true).
Warn about it in docs, but definitely not force the user to use the @ operator.
There was a problem hiding this comment.
Sure. Let make it documentation issue.
|
In general, please do not convert to E_RECOVERABLE_ERROR, but use an exception, when you want them to be catchable. |
|
It's OK for me to convert E_RECOVERABLE_ERROR to exceptions. Current session module does not have any exception. I'm not sure which one should be used. If nobody insist, I'll change them to exceptions. |
|
|
||
| if (PS(session_status) != php_session_active) { | ||
| php_error_docref(NULL, E_WARNING, "Session is not active"); | ||
| RETURN_FALSE; |
There was a problem hiding this comment.
The general 'etiquette' is that when there is no data, "NULL" should be returned, and not FALSE. Especially in error conditions like this.
There was a problem hiding this comment.
OK. I'll change the return type.
|
Closing as the RFC has been declined (and is now split in parts). |
This PR is for "Precise session management" RFC.
https://wiki.php.net/rfc/precise_session_management
Current Status:
All features/changes are implemented. Please report issues if there are.
TODO:
Fix test dependency issues by fundamental test updates.