Fixing bug #71038 session_start() returns TRUE on failure

php.internals

Yasuo Ohgaki

10 years ago
Hi all, I made PR https://github.com/php/php-src/pull/1721 for bug #71038 https://bugs.php.net/bug.php?id=71038 Currently, the patch is written as it should and breaks compatibility on PHP 5.6. To be compatible with PHP 5.6 (PHP 7.0 is OK), it may ignore read failures returned from save handlers. If nobody cares current buggy logic, I would like to change the PR to ignore read errors and commit it. Any comments? Regards,
-- Yasuo Ohgaki yohgaki@ohgaki.net

Stas Malyshev

10 years ago
Hi!
> I made PR > https://github.com/php/php-src/pull/1721 > > for bug #71038 > https://bugs.php.net/bug.php?id=71038 > > Currently, the patch is written as it should and > breaks compatibility on PHP 5.6. > > To be compatible with PHP 5.6 (PHP 7.0 is OK), > it may ignore read failures returned from save handlers.
I think it should return false on 5.6 too. The docs say: This function returns TRUE if a session was successfully started, otherwise FALSE. Thus, if the session was *not* successfully started, it should return false.
-- Stas Malyshev smalyshev@gmail.com

Yasuo Ohgaki

10 years ago
Hi Stas, On Fri, Jan 15, 2016 at 4:05 PM, Stanislav Malyshev <smalyshev@gmail.com> wrote:
>> I made PR >> https://github.com/php/php-src/pull/1721 >> >> for bug #71038 >> https://bugs.php.net/bug.php?id=71038 >> >> Currently, the patch is written as it should and >> breaks compatibility on PHP 5.6. >> >> To be compatible with PHP 5.6 (PHP 7.0 is OK), >> it may ignore read failures returned from save handlers. > > I think it should return false on 5.6 too. The docs say: > > This function returns TRUE if a session was successfully started, > otherwise FALSE. > > Thus, if the session was *not* successfully started, it should return > false.
In most cases other than read failure, PHP 5.6 is made return FALSE for failures also. Read failure is special because old save handler allowed returning false for read and continued as if there is no errors. I cannot fix this without braking buggy save handlers compatibility. Regards,
-- Yasuo Ohgaki yohgaki@ohgaki.net

Stas Malyshev

10 years ago
Hi!
> Read failure is special because old save handler allowed returning false > for read and continued as if there is no errors. I cannot fix this without > braking buggy save handlers compatibility.
Ah, you mean when read actually worked but handler returns false? If the session is set up correctly, then returning true is OK I guess.
-- Stas Malyshev smalyshev@gmail.com

Yasuo Ohgaki

10 years ago
Hi Stas, On Fri, Jan 15, 2016 at 5:22 PM, Stanislav Malyshev <smalyshev@gmail.com> wrote:
>> Read failure is special because old save handler allowed returning false >> for read and continued as if there is no errors. I cannot fix this without >> braking buggy save handlers compatibility. > > Ah, you mean when read actually worked but handler returns false? If the > session is set up correctly, then returning true is OK I guess.
There are many codes like function read($id) { return @file_get_contents(FILE_PATH.$id); } It returns FALSE for non-existing session data. i.e. The first access to the server. To make it work, user should either - check file existence and return '' (empty string) - cast FALSE to "string" to get '' (empty string). e.g. (string)@file_get_contents() So I cannot return FALSE on session_start() read failure w/o breaking existing codes. PHP 7.0 is strict for return values, so session_start() returns FALSE on read failure. Even if it is expected behavior for PHP 7.0, there was bug report on this, though. Regards,
-- Yasuo Ohgaki yohgaki@ohgaki.net