1
0
mirror of https://github.com/php/php-src.git synced 2026-03-31 04:32:19 +02:00
Commit Graph

209 Commits

Author SHA1 Message Date
Stanislav Malyshev
24dda816d0 Merge branch 'PHP-5.4.45' into PHP-5.5.29
* PHP-5.4.45:
  Fix bug #70219 (Use after free vulnerability in session deserializer)
  Fix for bug #69782
  5.4.45 next

Conflicts:
	configure.in
	ext/standard/var_unserializer.c
	ext/standard/var_unserializer.re
	main/php_version.h
2015-08-25 23:08:49 -07:00
Stanislav Malyshev
df4bf28f9f Fix bug #70219 (Use after free vulnerability in session deserializer) 2015-08-23 19:56:12 -07:00
Yasuo Ohgaki
853ae39d6e Fixed bug #68063 Empty session IDs do still start sessions 2015-02-03 13:38:49 +09:00
Yasuo Ohgaki
17beba686e Bug #61470 is fixed only in master 2015-02-03 12:26:01 +09:00
Yasuo Ohgaki
fb803ff819 Add test for bug #61470. It is already fixed. 2015-02-02 18:39:07 +09:00
Adam Harvey
bc44eb6172 Fix bug #67972 (SessionHandler Invalid memory read create_sid()).
SessionHandler::create_sid() didn't check if PS(default_mod) was initialised
before attempting to call its create_sid() handler.
2014-09-08 19:25:14 +00:00
Yasuo Ohgaki
f83a6c33b4 Merge branch 'PHP-5.4' into PHP-5.5
* PHP-5.4:
  Fixed bug #66827 Session raises E_NOTICE when session name variable is array
2014-07-19 09:53:04 +09:00
Yasuo Ohgaki
e946de29d2 Fixed bug #66827 Session raises E_NOTICE when session name variable is array 2014-07-19 09:52:31 +09:00
Ferenc Kovacs
8e2d396b52 Merge branch 'PHP-5.4' into PHP-5.5
* PHP-5.4:
  Fixed test (it requires ext/hash)
2014-05-07 00:55:05 +02:00
Dmitry Stogov
8517001b25 Fixed test (it requires ext/hash) 2014-05-07 00:52:49 +02:00
Ferenc Kovacs
579898e338 Merge branch 'PHP-5.4' into PHP-5.5
* PHP-5.4:
  Fixed tests (they might fail from time to time because of session GC)
  Fix author name on the #63228 patch.
2014-05-07 00:38:32 +02:00
Dmitry Stogov
f880013c4d Fixed tests (they might fail from time to time because of session GC) 2014-05-07 00:37:56 +02:00
Anatol Belski
c0fcd3d6b0 refixed that test for 5.5+ 2014-01-22 23:30:14 +01:00
Anatol Belski
0436b85d9f Merge branch 'PHP-5.4' into PHP-5.5
* PHP-5.4:
  fixed test
2014-01-22 15:40:19 +01:00
Anatol Belski
0eff7176de fixed test 2014-01-22 15:39:49 +01:00
Yasuo Ohgaki
58f94345a7 Fixed previous commit may delete unwanted cookies. Sync tests from upper branches. 2014-01-22 19:21:25 +09:00
Yasuo Ohgaki
383423a1ee Re-fixed bug #66469 2014-01-22 13:46:59 +09:00
Yasuo Ohgaki
a27e51fd4e Re-fixed bug #66469 2014-01-22 13:40:58 +09:00
Anatol Belski
14e371e7d4 Merge branch 'PHP-5.4' into PHP-5.5
* PHP-5.4:
  forked the test for bug #66481
2014-01-17 03:31:38 +01:00
Anatol Belski
a218a8b917 forked the test for bug #66481 2014-01-17 03:30:42 +01:00
Xinchen Hui
9799816e0c Merge branch 'PHP-5.4' into PHP-5.5 2014-01-16 14:41:52 +08:00
Xinchen Hui
b777248ded Re-fixed Bug #66481 (Calls to session_name() segfault when session.name is null) 2014-01-16 14:41:12 +08:00
Xinchen Hui
271053ad47 Revert "Bug #66481 Segfaults on session_name()"
This reverts commit 5662ffb295.
2014-01-16 14:38:35 +08:00
Yasuo Ohgaki
744f38c2d6 Merge branch 'PHP-5.4' into PHP-5.5
* PHP-5.4:
  Bug #66481 Segfaults on session_name()
2014-01-16 11:34:31 +09:00
Conor McDermottroe
5662ffb295 Bug #66481 Segfaults on session_name()
If the previous value of session.name was NULL then any call to
session_name($string) would result in a segmentation fault.

This changes the behaviour to set the value of session.name to
"PHPSESSID" if a blank value is given in php.ini or via -d on the
command line. There is already protection against setting it to NULL via
session_name() or ini_set().
2014-01-16 11:33:10 +09:00
Eric Stenson
330168a247 Fix tests expecting specific resource IDs
When Wincache or APC are installed, the resource IDs are not the same.
This is because Wincache takes a few resource objects for itself.  As a
result, these tests become false positives.

On Windows boxes, the microtime precision is not granular enough
to reliably register a difference if two calls to uniqid() are made
concurrently.  This is a fix to the uniqid() test to avoid the false
positive when run on Windows machines.  Also, added a test to exercise
the 'more_entropy' variant of uniqid().
2013-12-15 16:51:21 +08:00
Yasuo Ohgaki
c51f77fe83 Add php_serialize session.serialize_handler. This patch closes
Request #25630
  Request #43980
  Request #54383
  Bug #65359

and many others similar to these that are closed as "wont fix" or
"not a bug".

Current serializers have limitations due to register_globals support
that are no longer supported. Changing existing serializer may cause
compatibility issue. Therefore, new handler is needed to remove
needless limitations.

php_serialize does not have special characters and allow numerical
index in $_SESSION. $_SESSION can be used as ordinary array.
2013-08-21 10:51:51 +09:00
Yasuo Ohgaki
1641158644 Fixed Bug #65475 2013-08-21 08:11:59 +09:00
Stanislav Malyshev
b80d73ce15 fix crash, enable session_id and fix test 2013-08-04 17:43:20 -07:00
Yasuo Ohgaki
25e8fcc88f Strict session 2013-08-04 16:36:45 -07:00
Stanislav Malyshev
c793a65690 Merge branch 'PHP-5.4' into PHP-5.5
* PHP-5.4:
  non living code related typo fixes

Conflicts:
	Zend/zend_compile.c
2013-08-04 16:06:24 -07:00
Veres Lajos
8d86597d73 non living code related typo fixes 2013-08-04 16:05:36 -07:00
Arpad Ray
94ab37f06a Merge branch 'PHP-5.4' into PHP-5.5
* PHP-5.4:
  Fixed bug #50308 - session id not appended properly for empty anchor tags
2013-07-17 16:19:53 +01:00
Arpad Ray
e6ae977082 Fixed bug #50308 - session id not appended properly for empty anchor tags
The issue was actually because a lack of space before a "/" marking the tag
as empty. This was being swallowed in the rule for unquoted values. Fixed
by making that rule exclude quotes (as per spec anyway).
2013-07-17 16:07:26 +01:00
Veres Lajos
e9a95d78ef typo fixes 2013-07-15 00:23:03 -07:00
Veres Lajos
72085b0e5f typo fixes 2013-07-15 00:18:57 -07:00
Anatol Belski
1968fac697 Merge branch 'PHP-5.4' into PHP-5.5
* PHP-5.4:
  Fixed mysql tests parsing phpinfo()
  Update NEWS
  Fixed bug #35703: when session_name("123") consist only digits, should warning
  Fixed bug #49175: mod_files.sh does not support hash bits
2013-07-02 08:24:37 +02:00
Yasuo Ohgaki
87dda666c7 Fixed bug #35703: when session_name("123") consist only digits, should warning 2013-06-29 11:35:55 +09:00
Arpad Ray
1e836cdd64 BC fix for PR 109 merge - create_sid() method in SessionHandler
Creates a new SessionIdInterface and moves create_sid() into it, so existing
handlers implementing SessionHandlerInterface don't require create_sid().
SessionHandler still includes the method so the default mod can be called, but
now implements both interfaces.

Also added several more tests for this feature.
2013-06-27 12:33:56 +01:00
Arpad Ray
b66c14b0c8 Merge PR 109 - Add create_sid to session_set_save_handler and SessionHandler
Allows user session handlers to create session IDs by adding an optional
7th argument to session_set_save_handler() and a create_sid() method
to SessionHandler.
2013-06-27 12:29:44 +01:00
Xinchen Hui
2f7f57a407 Merge branch 'PHP-5.3' into PHP-5.4 2012-12-17 12:57:37 +08:00
Xinchen Hui
d2cc097049 Fix failed test 2012-12-17 12:56:55 +08:00
Rasmus Lerdorf
538d8338c0 Merge branch 'PHP-5.3' into PHP-5.4 2012-12-13 16:15:06 -08:00
Rasmus Lerdorf
eecdb4c254 Fix broken test
This was missing a %s for the path here
2012-12-13 16:13:37 -08:00
Arpad Ray
6566ea6173 Fix #63379 - Don't reset mod_user_is_open in destroy
The parent handler is still open so the reset here was in error.
2012-12-13 23:51:43 +00:00
Xinchen Hui
1b9e0de2cc Remove executable permission on inc 2012-10-10 10:44:34 +08:00
Xinchen Hui
610c7fbe7b Remove executable permission on phpt 2012-10-10 10:27:49 +08:00
Xinchen Hui
69a4301f6c Merge branch 'PHP-5.3' into PHP-5.4 2012-10-10 10:45:07 +08:00
Xinchen Hui
e081c55fb5 Merge branch 'PHP-5.3' into PHP-5.4 2012-10-10 10:31:31 +08:00
Xinchen Hui
1a527397cc better fix & this test pass now 2012-08-15 01:25:31 +08:00