1
0
mirror of https://github.com/php/php-src.git synced 2026-03-24 16:22:37 +01:00
Commit Graph

1687 Commits

Author SHA1 Message Date
David Carlier
84a8fea251 Fix GH-16290: session cookie_lifetime ini value overflow.
close GH-16295
2024-10-13 14:19:18 +01:00
Niels Dossche
7cdd1302c3 Fix GH-16385: Unexpected null returned by session_set_cookie_params
Two issues:
1) The check happened before ZPP checks
2) The `return;` statement caused NULL to be returned while this
   function can only return booleans. An exception seems not acceptable
   in stable versions, but a warning may do.

Closes GH-16386.
2024-10-12 13:08:37 +02:00
Christoph M. Becker
af789afbe8 Fix type incompatibility in assignment.
This partially reverts 0956267c08, which
introduced a type incompatibility where an `int` function is assigned
to a `zend_result` function.  That yields a level 1 C4133 warning on
MSVC, and usually (e.g. in CI) level 1 warnings are elevated to errors,
so the build fails.[1]

The PHP-8.3 branch and up are uneffected by this, so the upward merges
should be empty.

[1] <0956267c08 (r144587696)>
2024-07-26 14:57:16 +02:00
Levi Morrison
0956267c08 Fix warnings in session/spl
This fixes -Winline errors where the functions are not ever inlined.

Also fixes some signature mismatches which were fixed previously but
for whatever reason were not ported to all maintained branches:

/usr/local/src/php/ext/session/session.c:1299:20:
warning:conflicting types for 'php_session_send_cookie' due to enum/integer mismatch;
have 'zend_result(void)' {aka 'ZEND_RESULT_CODE(void)'} [-Wenum-int-mismatch]
 1299 | static zend_result php_session_send_cookie(void) /* {{{ */
      |                    ^~~~~~~~~~~~~~~~~~~~~~~
/usr/local/src/php/ext/session/session.c:100:12:
note: previous declaration of 'php_session_send_cookie' with type 'int(void)'
  100 | static int php_session_send_cookie(void);
      |            ^~~~~~~~~~~~~~~~~~~~~~~
2024-07-23 16:25:11 -06:00
Niels Dossche
d7aa0be3a8 Fix GH-14368: Test failure in ext/session/tests/gh13856.phpt (#14378)
If the runner overrides session.save_path, the test fails.
Manually set it to a value known to trigger the issue.
2024-05-31 18:18:40 +02:00
David Carlier
42443b4c2e ext/session: fix _read/_write buffer limit.
MSDN pages mention the buffer size upper limit is INT_MAX not UINT_MAX.
inspired by GH-13205.

Close GH-14017
2024-04-20 17:11:03 +01:00
Niels Dossche
5ce9687cb2 Fix GH-13891: memleak and segfault when using ini_set with session.trans_sid_hosts (#13892)
The hash tables used are allocated via the persistent allocator.
When using ini_set, the allocation happens via the non-persistent
allocator. When the table is then freed in GSHUTDOWN, we get a crash
because the allocators are mismatched.

As a side note, it is strange that this is designed this way, because it
means that ini_sets persist between requests...

Co-authored-by: Kamil Tekiela <tekiela246@gmail.com>
2024-04-06 13:43:26 +02:00
Niels Dossche
46f45a51b4 Fix GH-13856: Member access within null pointer of type 'ps_files' in ext/session/mod_files.c
We should not mark the session as opened when there was a failure in
open.

Closes GH-13858.
2024-04-01 14:15:51 +02:00
Niels Dossche
6985aff7c3 Fix GH-13680: Segfault with session_decode and compilation error
It's illegal to return from a bailout because that doesn't restore the
original bailout data. Return outside of it.

Test by YuanchengJiang

Closes GH-13689.
2024-03-13 17:47:25 +01:00
Niels Dossche
7f7031eb72 Fix GH-12504: Corrupted session written when there's a fatal error in autoloader
For details and reasoning, see [1] and following.

[1] https://github.com/php/php-src/issues/12504#issuecomment-1790870399

Closes GH-13207.
2024-01-22 21:59:11 +01:00
Ilija Tovilo
1441f30a8d Merge branch 'PHP-8.1' into PHP-8.2
* PHP-8.1:
  Remove session ID set through REQUEST_URI
2023-06-22 12:36:52 +02:00
Ilija Tovilo
f160eff441 Remove session ID set through REQUEST_URI 2023-06-22 12:35:55 +02:00
David Carlier
9995514718 Merge branch 'PHP-8.1' into PHP-8.2 2023-02-21 16:10:32 +00:00
nielsdos
da3ce6015d Propagate errors correctly in ps_files_cleanup_dir()
In SessionHandler::gc, we use a virtual call to PS(default_mod)->s_gc to
call the gc implementation. That return value is checked against
FAILURE (-1).
One of the call targets of PS(default_mod)->s_gc is ps_gc_files().
ps_gc_files() calls to ps_files_cleanup_dir(). The latter function has
some error checks and outputs a notice if something goes wrong. In cases
of errors, the function returns 0. This means that the check in
SessionHandler::gc will misinterpret this as a success and report that 0
files have been *successfully* cleaned up. Fix it by returning -1 to
indicate something *did* go wrong.

Closes GH-10644.
2023-02-21 16:09:22 +00:00
David Carlier
65782fbbe8 Merge branch 'PHP-8.1' into PHP-8.2 2022-11-15 12:30:04 +00:00
David Carlier
a4298c14c1 Fix GH-9932: Discards further characters for session name.
As those are converted, it s better to make aware of the code caller of the naming inadequacy.
Closes GH-9940.
2022-11-15 12:27:44 +00:00
George Peter Banyard
7d5ce1c483 Merge branch 'PHP-8.1' into PHP-8.2
* PHP-8.1:
  Actually fix GH-9583
2022-10-06 14:31:29 +01:00
George Peter Banyard
09a57d385d Merge branch 'PHP-8.0' into PHP-8.1
* PHP-8.0:
  Actually fix GH-9583
2022-10-06 14:29:53 +01:00
George Peter Banyard
499fbcd679 Actually fix GH-9583
The issue is that PS(mod)->s_validate_sid is always defined for user modules, thus we need to check that the actual callable is set
Add another regression test to ensure current working behaviour is not broken (which was by the previous incorrect fix)

Closes GH-9638
2022-10-06 14:29:13 +01:00
George Peter Banyard
3579ddaace Merge branch 'PHP-8.1' into PHP-8.2
* PHP-8.1:
  Fix GH-9583: session_create_id() fails with user defined save handler that doesn't have a validateId() method
2022-09-27 15:58:30 +01:00
George Peter Banyard
72cb47338e Merge branch 'PHP-8.0' into PHP-8.1
* PHP-8.0:
  Fix GH-9583: session_create_id() fails with user defined save handler that doesn't have a validateId() method
2022-09-27 15:54:37 +01:00
George Peter Banyard
8b115254c0 Fix GH-9583: session_create_id() fails with user defined save handler that doesn't have a validateId() method 2022-09-27 15:52:21 +01:00
Ilija Tovilo
3071d85a6b PS(mod_user_class_name) must not leak into next request
Fixes GH-9584
2022-09-22 11:37:37 +02:00
George Peter Banyard
1ad59b32c2 Update INI validator and displayers depending on INI type
Closes GH-9451
2022-09-06 10:33:34 +01:00
Máté Kocsis
adb45a63c0 Fix GH-9186 @strict-properties can be bypassed using unserialization (#9354)
* Emit deprecation warnings when adding dynamic properties to classes during unserialization - this will become an Error in php 9.0.
  (Adding dynamic properties in other contexts was already a deprecation warning - the use case of unserialization was overlooked)
* Throw an error when attempting to add a dynamic property to a `readonly` class when unserializing
* Add new serialization methods `__serialize`/`__unserialize` for SplFixedArray to avoid creating deprecated dynamic
  properties that would then be added to the backing fixed-size array
* Don't add named dynamic/declared properties (e.g. $obj->foo) of SplFixedArray to the backing array when unserializing
* Update tests to declare properties or to expect the deprecation warning
* Add news entry

Co-authored-by: Tyson Andre <tysonandre775@hotmail.com>
2022-08-30 07:46:32 -04:00
Máté Kocsis
b4ec3e9bc0 Do not generate CONST_CS when registering constants (#9439) 2022-08-28 08:27:19 +02:00
George Peter Banyard
66aed3a86f SameSite session cookie prop should behave like other INI settings
It should warn if the INI setting is changed after headers are sent or a session is not active
2022-08-22 16:09:46 +01:00
George Peter Banyard
a8f8cc207c Check sessions are active before output emitted consistently 2022-08-22 15:45:43 +01:00
George Peter Banyard
ad3ee47c6d Remove OnUpdateTransSid validator
It is more restrictive than the OnUpdateSessionBool one
2022-08-22 15:45:43 +01:00
George Peter Banyard
e9749a3c1e Remove OnUpdateLazyWrite validator
It is identical to the OnUpdateSessionBool one
2022-08-22 15:45:43 +01:00
George Peter Banyard
a75de167bf Add test for negative cookie lifetime 2022-08-22 15:45:43 +01:00
George Peter Banyard
e8e015777e Use bool instead of int in session struct 2022-08-22 15:45:43 +01:00
Tim Düsterhus
b825756317 Update expires format for session cookie (#9304)
* Update expires format for session cookie

see GH-9200
see 15e3fcb468

* Add ext/session/tests/gh9200.phpt
2022-08-12 19:52:04 +02:00
Máté Kocsis
a98560ad3f Declare ext/session constants in stubs (#9112) 2022-07-23 12:32:21 +02:00
Go Kudo
4d8dd8d258 Implement Random Extension
https://wiki.php.net/rfc/rng_extension
https://wiki.php.net/rfc/random_extension_improvement
2022-07-19 10:27:38 +01:00
Eric Norris
09237f6126 Update request startup error messages 2022-07-18 23:19:59 +01:00
Rowan Tommins
af15923bc3 Extend deprecation notices to is_callable($foo) and callable $foo
Implements https://wiki.php.net/rfc/partially-supported-callables-expand-deprecation-notices
so that uses of "self" and "parent" in is_callable() and callable
type constraints now raise a deprecation notice, independent of the
one raised when and if the callable is actually invoked.

A new flag is added to the existing check_flags parameter of
zend_is_callable / zend_is_callable_ex, for use in internal calls
that would otherwise repeat the notice multiple times. In particular,
arguments to internal function calls are checked first based on
arginfo, and then again during ZPP, so the former suppresses the
deprecation notice.

Some existing tests which raised this deprecation have been updated
to avoid the syntax, but the existing version retained for maximum
regression coverage until it is made an error.

With thanks to Juliette Reinders Folmer for the RFC and initial
investigation.

Closes GH-8823.
2022-07-14 17:07:42 +02:00
Arnaud Le Blanc
4df3dd7679 Reduce memory allocated by var_export, json_encode, serialize, and other (#8902)
smart_str uses an over-allocated string to optimize for append operations. Functions that use smart_str tend to return the over-allocated string directly. This results in unnecessary memory usage, especially for small strings.

The overhead can be up to 231 bytes for strings smaller than that, and 4095 for other strings. This can be avoided for strings smaller than `4096 - zend_string header size - 1` by reallocating the string.

This change introduces `smart_str_trim_to_size()`, and calls it in `smart_str_extract()`. Functions that use `smart_str` are updated to use `smart_str_extract()`.

Fixes GH-8896
2022-07-08 14:47:46 +02:00
George Peter Banyard
4db981b74e Session: Refactor basedir to be a zend_string in mod_files 2022-05-29 15:24:06 +01:00
George Peter Banyard
ec43006719 Session: Refactor last key to be a zend_string in mod_files 2022-05-29 15:24:06 +01:00
George Peter Banyard
8a1ca99aab Session: Use zend_string* consistently for key in mod_mm 2022-05-29 15:24:06 +01:00
George Peter Banyard
f872972584 Session: Use zend_string* consistently for key in mod_files 2022-05-29 15:24:06 +01:00
George Peter Banyard
4a5699ae2f Session: use more appropriate types 2022-05-29 15:24:06 +01:00
George Peter Banyard
d08451b2ca Replace php_stdint.h header with standard headers (#8613) 2022-05-29 11:20:56 +01:00
George Peter Banyard
2ecd46f48f Initialise zend_stat_t to fix MSAN build 2022-05-22 16:06:27 +01:00
Ilija Tovilo
9a90bd7054 Deprecate ${} string interpolation
https://wiki.php.net/rfc/deprecate_dollar_brace_string_interpolation
2022-05-05 10:14:56 +02:00
Ilija Tovilo
0db03c4110 Improve sesson write failure message for user error handlers
Closes GH-7787
Closes GH-8186
2022-03-11 15:08:16 +01:00
Nikita Popov
902d64390e Deprecate implicit dynamic properties
Writing to a proprety that hasn't been declared is deprecated,
unless the class uses the #[AllowDynamicProperties] attribute or
defines __get()/__set().

RFC: https://wiki.php.net/rfc/deprecate_dynamic_properties
2021-11-26 14:10:11 +01:00
Nikita Popov
8be10fb48d Remove redundant test
This test is the same as 001.phpt, apart from some formatting
differences.
2021-11-26 11:24:22 +01:00
Dmitry Stogov
90b7bde615 Use more compact representation for packed arrays.
- for packed arrays we store just an array of zvals without keys.
- the elements of packed array are accessible throuf as ht->arPacked[i]
  instead of ht->arData[i]
- in addition to general ZEND_HASH_FOREACH_* macros, we introduced similar
  familied for packed (ZEND_HASH_PACKED_FORECH_*) and real hashes
  (ZEND_HASH_MAP_FOREACH_*)
- introduced an additional family of macros to access elements of array
  (packed or real hashes) ZEND_ARRAY_ELEMET_SIZE, ZEND_ARRAY_ELEMET_EX,
  ZEND_ARRAY_ELEMET, ZEND_ARRAY_NEXT_ELEMENT, ZEND_ARRAY_PREV_ELEMENT
- zend_hash_minmax() prototype was changed to compare only values

Because of smaller data set, this patch may show performance improvement
on some apps and benchmarks that use packed arrays. (~1% on PHP-Parser)

TODO:
    - sapi/phpdbg needs special support for packed arrays (WATCH_ON_BUCKET).
    - zend_hash_sort_ex() may require converting packed arrays to hash.
2021-11-03 15:18:26 +03:00