1
0
mirror of https://github.com/php/php-src.git synced 2026-03-24 16:22:37 +01:00
Commit Graph

1773 Commits

Author SHA1 Message Date
Gina Peter Banyard
d35904adf2 Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  ext/session: Fix GH-17541 (ext/session NULL pointer dereferencement during ID reset)
2025-01-24 14:10:00 +00:00
Gina Peter Banyard
a85666c17b ext/session: Fix GH-17541 (ext/session NULL pointer dereferencement during ID reset)
Closes GH-17541
Closes GH-17546
2025-01-24 14:04:58 +00:00
Niels Dossche
b448d540c2 Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Fix type confusion with session SID constant
2025-01-23 19:03:35 +01:00
Niels Dossche
2a2cc2ccce Fix type confusion with session SID constant
Closes GH-17548.
2025-01-23 19:03:04 +01:00
Niels Dossche
cc39bc21e3 Fix GH-16590: UAF in session_encode()
The `PS_ENCODE_LOOP` does not protect the session hash table that it
iterates over. Change it by temporarily creating a copy.

Closes GH-16640.
2024-11-04 20:05:32 +01:00
David Carlier
4d008e300b Merge branch 'PHP-8.3' into PHP-8.4 2024-10-13 14:19:45 +01:00
David Carlier
f31232e218 Merge branch 'PHP-8.2' into PHP-8.3 2024-10-13 14:19:33 +01:00
David Carlier
84a8fea251 Fix GH-16290: session cookie_lifetime ini value overflow.
close GH-16295
2024-10-13 14:19:18 +01:00
Niels Dossche
45f7f87b75 Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Fix GH-16385: Unexpected null returned by session_set_cookie_params
2024-10-12 13:09:24 +02:00
Niels Dossche
a1f7ce5617 Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix GH-16385: Unexpected null returned by session_set_cookie_params
2024-10-12 13:09:06 +02:00
Niels Dossche
7cdd1302c3 Fix GH-16385: Unexpected null returned by session_set_cookie_params
Two issues:
1) The check happened before ZPP checks
2) The `return;` statement caused NULL to be returned while this
   function can only return booleans. An exception seems not acceptable
   in stable versions, but a warning may do.

Closes GH-16386.
2024-10-12 13:08:37 +02:00
Christoph M. Becker
217ea732fc Use php_error_docref() instead of zend_error() in session.c (GH-15505)
Using `php_error_docref()` is preferable since it outputs additional
details (which function has been called and whether it is a startup or
shutdown error), uses HTML markup, and also provides a link to the
documentation, if configured.

Since these deprecation warnings have been introduced recently[1][2],
i.e. for PHP 8.4, there are no BC concerns.

[1] <e8ff7c70f9>
[2] <b36eac94d2>

Co-authored-by: Máté Kocsis <kocsismate90@gmail.com>
2024-09-04 16:00:28 +02:00
Kamil Tekiela
c5bce0d8a2 Deprecate disabling use_only_cookies (#13578) 2024-08-24 16:33:45 +02:00
Máté Kocsis
8d12f666ae Fix registration of internal readonly child classes (#15459)
Currently, internal classes are registered with the following code:

INIT_CLASS_ENTRY(ce, "InternalClass", class_InternalClass_methods);
class_entry = zend_register_internal_class_ex(&ce, NULL);
class_entry->ce_flags |= ...;

This has worked well so far, except if InternalClass is readonly. It is because some inheritance checks are run by zend_register_internal_class_ex before ZEND_ACC_READONLY_CLASS is added to ce_flags.

The issue is fixed by adding a zend_register_internal_class_with_flags() zend API function that stubs can use from now on. This function makes sure to add the flags before running any checks. Since the new API is not available in lower PHP versions, gen_stub.php has to keep support for the existing API for PHP 8.3 and below.
2024-08-24 12:36:54 +02:00
Jorg Adam Sowa
ff69f334f1 ext/session: Warn when providing invalid values for session.gc_probability and session.gc_divisor 2024-08-22 01:29:40 +01:00
Christoph M. Becker
3ed5eee5d3 [skip ci] Fix bug71162.phpt xfail message (GH-15506)
The test failure is unlikely to be caused by `SessionHandlerInterface`
not being available.
2024-08-20 14:48:52 +02:00
Peter Kokot
80d784610a Add date extension to dependencies (#15475)
This is at this point only meta-data information for extensions to
depend also on date extension. This is a configure phase dependency for
consistency.
2024-08-18 16:47:57 +02:00
Jorg Adam Sowa
21fa5e15f9 ext/session: session_create_id() now throws a ValueError for large prefix (#15338) 2024-08-15 11:10:18 +01:00
Jorg Adam Sowa
c4eccf33e9 ext/session: session.save_handler - add tests fortwo uncovered cases (#15337) 2024-08-11 15:39:56 +01:00
Jorg Adam Sowa
6bf7b7220d ValueError on null byte in session_name() (#15286) 2024-08-11 13:26:54 +01:00
Peter Kokot
97eb89afd6 Autotools: Improve --with-mm configure option check (#15212)
The mm check code block needs to done only when session is enabled to
prevent redundant mm library linkage in edge case mistakes like:

    ./configure --disable-session --with-mm

CS is synced with AC_* macros. The 'm4_text_wrap' macro joins the given
text with single space characters and limits it to 79 characters width.

Co-authored-by: Gina Peter Banyard <girgias@php.net>
2024-08-04 21:16:15 +02:00
Tim Düsterhus
e8ff7c70f9 session: Deprecate session.sid_length and session.sid_bits_per_character (#15213)
RFC: https://wiki.php.net/rfc/deprecations_php_8_4
2024-08-04 18:25:31 +02:00
Peter Kokot
16d9bd0aae Sync AC_DEFINE help texts (#15207) 2024-08-03 09:47:39 +02:00
Peter Kokot
f66feaec0f Sync HAVE_<extension> help texts (#15167)
This syncs all help texts of extension preprocessor macros to the same
style "Define to 1 if the PHP extension '<ext>' is available.".
[skip ci]
2024-08-02 01:41:47 +02:00
Peter Kokot
1ceadaed52 Autotools: Normalize and quote all PHP_NEW_EXTENSION arguments (#15144)
This adds Autoconf quote characters to all PHP_NEW_EXTENSION arguments
and syncs the CS across the php-src Autotools build system.
2024-07-29 00:14:59 +02:00
Peter Kokot
ff4b99e260 Autotools: Quote PHP_ADD_LIB* arguments (#15112)
Following previous CS syncs, this quotes arguments in PHP_ADD_LIB* M4
macros:
- PHP_ADD_LIBRARY
- PHP_ADD_LIBRARY_WITH_PATH
- PHP_ADD_LIBPATH
2024-07-26 23:26:55 +02:00
Christoph M. Becker
af789afbe8 Fix type incompatibility in assignment.
This partially reverts 0956267c08, which
introduced a type incompatibility where an `int` function is assigned
to a `zend_result` function.  That yields a level 1 C4133 warning on
MSVC, and usually (e.g. in CI) level 1 warnings are elevated to errors,
so the build fails.[1]

The PHP-8.3 branch and up are uneffected by this, so the upward merges
should be empty.

[1] <0956267c08 (r144587696)>
2024-07-26 14:57:16 +02:00
Levi Morrison
9d25296723 Merge branch 'PHP-8.3' 2024-07-23 16:34:16 -06:00
Levi Morrison
e43d9c7469 Merge branch 'PHP-8.2' into PHP-8.3 2024-07-23 16:33:40 -06:00
Levi Morrison
0956267c08 Fix warnings in session/spl
This fixes -Winline errors where the functions are not ever inlined.

Also fixes some signature mismatches which were fixed previously but
for whatever reason were not ported to all maintained branches:

/usr/local/src/php/ext/session/session.c:1299:20:
warning:conflicting types for 'php_session_send_cookie' due to enum/integer mismatch;
have 'zend_result(void)' {aka 'ZEND_RESULT_CODE(void)'} [-Wenum-int-mismatch]
 1299 | static zend_result php_session_send_cookie(void) /* {{{ */
      |                    ^~~~~~~~~~~~~~~~~~~~~~~
/usr/local/src/php/ext/session/session.c:100:12:
note: previous declaration of 'php_session_send_cookie' with type 'int(void)'
  100 | static int php_session_send_cookie(void);
      |            ^~~~~~~~~~~~~~~~~~~~~~~
2024-07-23 16:25:11 -06:00
Peter Kokot
97afc86437 Autotools: Quote M4 arguments (#15045)
- AC_MSG_CHECKING
- AC_MSG_RESULT
- AC_MSG_WARN
- AC_MSG_ERROR
- AC_MSG_NOTICE
2024-07-21 01:52:17 +02:00
Peter Kokot
68ae477796 Autotools: Quote M4 arguments (#15033)
- PHP_ADD_INCLUDE
- PHP_EVAL_INCLINE
- PHP_EVAL_LIBLINE
2024-07-20 07:21:44 +02:00
Peter Kokot
2ebef11e83 Update http links to https and sync www.php.net URLs (#14854) 2024-07-07 04:23:08 +02:00
Jorg Adam Sowa
8e1561cdbe Check session_create_id() input for null byte (#14728) 2024-07-06 21:18:35 +01:00
Peter Kokot
bee84c0468 Autotools: Quote PHP_SUBST arguments in extensions (#14748) 2024-07-02 06:56:18 +02:00
Arnaud Le Blanc
11accb5cdf Preferably include from build dir (#13516)
* Include from build dir first

This fixes out of tree builds by ensuring that configure artifacts are included
from the build dir.

Before, out of tree builds would preferably include files from the src dir, as
the include path was defined as follows (ignoring includes from ext/ and sapi/) :

    -I$(top_builddir)/main
    -I$(top_srcdir)
    -I$(top_builddir)/TSRM
    -I$(top_builddir)/Zend
    -I$(top_srcdir)/main
    -I$(top_srcdir)/Zend
    -I$(top_srcdir)/TSRM
    -I$(top_builddir)/

As a result, an out of tree build would include configure artifacts such as
`main/php_config.h` from the src dir.

After this change, the include path is defined as follows:

    -I$(top_builddir)/main
    -I$(top_builddir)
    -I$(top_srcdir)/main
    -I$(top_srcdir)
    -I$(top_builddir)/TSRM
    -I$(top_builddir)/Zend
    -I$(top_srcdir)/Zend
    -I$(top_srcdir)/TSRM

* Fix extension include path for out of tree builds

* Include config.h with the brackets form

`#include "config.h"` searches in the directory containing the including-file
before any other include path. This can include the wrong config.h when building
out of tree and a config.h exists in the source tree.

Using `#include <config.h>` uses exclusively the include path, and gives
priority to the build dir.
2024-06-26 00:26:43 +02:00
Gina Peter Banyard
fd2d869642 Clean-up some more headers (#14416)
Remove unused headers (such as php_ini.h for extensions that don't define INI settings)
Use more specific headers when possible
2024-06-08 17:15:36 +01:00
Peter Kokot
ec50b178f1 Update ext/session spl dependency (#14410)
The spl dependency is configured so the spl_autoload_register is
available when session_start() is used, meaning the spl extension needs
to be loaded before the session. It is marked as optional to be more
explicit as spl is not directly used nor required in the session
extension.
2024-06-01 19:13:54 +02:00
Peter Kokot
f69c55b5b6 Remove hash dependency from session extension (#14409)
The session extension once depended on the hash extension for having
hash functions available when using the `session.hash_function` INI
directive. This directive was removed in PHP-7.1 via
3467526a65. At the time it could be marked
as optional dependency, because it only needed to be loaded before the
session in that case.

The removed ext/hash/php_hash.h in the ext/session/php_session.h might
cause BC break for PHP extensions if they rely on transitive include and
use hash extension in the code without explicitly including the
ext/hash/php_hash.h header. Solution is to include the
ext/hash/php_hash.h separately.
2024-06-01 17:06:17 +01:00
Niels Dossche
a58c3a7eb1 Merge branch 'PHP-8.3'
* PHP-8.3:
  Fix reading zlib ini settings in ext-soap
  Fix memory leak if calling SoapServer::setClass() twice
  Fix memory leak if calling SoapServer::setObject() twice
  Fix missing error restore code in ext-soap (#14379)
  Fix GH-14368: Test failure in ext/session/tests/gh13856.phpt (#14378)
2024-05-31 18:27:22 +02:00
Niels Dossche
2b1097a87d Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Fix reading zlib ini settings in ext-soap
  Fix memory leak if calling SoapServer::setClass() twice
  Fix memory leak if calling SoapServer::setObject() twice
  Fix missing error restore code in ext-soap (#14379)
  Fix GH-14368: Test failure in ext/session/tests/gh13856.phpt (#14378)
2024-05-31 18:26:22 +02:00
Niels Dossche
d7aa0be3a8 Fix GH-14368: Test failure in ext/session/tests/gh13856.phpt (#14378)
If the runner overrides session.save_path, the test fails.
Manually set it to a value known to trigger the issue.
2024-05-31 18:18:40 +02:00
Niels Dossche
c7797fc8c0 Fix bug GH-11941: soap with session persistence will silently fails when "seession" built as a shared object (#14362)
This adds an optional dependency on the session extension and adds the
necessary APIs to make the functionality work with lazy binding.

This can be tested by configuring PHP with `--enable-session=shared` and
`--enable-soap=shared` and running the test suite, in particular the
buggy behaviour can be observed by the existing test `server009.phpt`.
2024-05-29 19:51:49 +02:00
Peter Kokot
c1d71cfeea Remove forgotten obsolete session INI directives (#14238)
The session.hash_function and session.hash_bits_per_character INI
directives have been removed in PHP 7.1:
3467526a65
2024-05-15 17:01:15 +02:00
David Carlier
151a677acb Merge branch 'PHP-8.3' 2024-04-20 17:12:20 +01:00
David Carlier
2636104a83 Merge branch 'PHP-8.2' into PHP-8.3 2024-04-20 17:11:33 +01:00
David Carlier
42443b4c2e ext/session: fix _read/_write buffer limit.
MSDN pages mention the buffer size upper limit is INT_MAX not UINT_MAX.
inspired by GH-13205.

Close GH-14017
2024-04-20 17:11:03 +01:00
Jorg Adam Sowa
4829b8f2cb ext/session: Add test for session_start with read_and_close option (#13799) 2024-04-14 13:22:43 +01:00
Niels Dossche
cf313321c2 Merge branch 'PHP-8.3'
* PHP-8.3:
  [ci skip] NEWS
  Fix GH-13891: memleak and segfault when using ini_set with session.trans_sid_hosts (#13892)
2024-04-06 13:45:10 +02:00
Niels Dossche
eb244fcb49 Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  [ci skip] NEWS
  Fix GH-13891: memleak and segfault when using ini_set with session.trans_sid_hosts (#13892)
2024-04-06 13:45:00 +02:00