[2.1.7]: "Cannot use bool as array" Session.php:159

[Geremia]

Basic Information

I get tons of errors from Guest users:

I can fix this problem by disabling database-driven sessions (at index.php?action=admin;area=serversettings#databaseSession_enable).

Steps to reproduce

1. Make sure database driven sessions are enabled.
2. Access the site as a Guest (with no JavaScript so PHPSESSID is used in URL).

👀:

SMF/Sources/Session.php

Line 159 in d49255b

list ($sess_data) = $smcFunc['db_fetch_row']($result);

Version/Git revision

2.1.7

Database Engine

PostgreSQL

Database Version

PostgreSQL (libpq) Version 15.17

PHP Version

PHP Version 8.5.4

[sbulen]

Note that as of SMF 2.1.7, passing PHPSESSID via URL is disallowed. SMF is keeping up with PHP (and best practices) in this regard; the capability is already deprecated in PHP & will be removed completely by PHP 9.0.

Still, this error might need to be improved/trapped better.

Note that since SMF no longer generates the PHPSESSID URLs, I'm not sure where those are coming from...

[sbulen]

I just attempted to reproduce in vanilla 2.1.7 with javascript disabled, & could not reproduce the error. No issues browsing as a guest.

I also could not reproduce with both cookies & javascript disabled, no issues there, navigation was OK.

I tried with both PHP 8.4.5 & PHP 8.5.3. MySQL 8.4.

I also tried emulating user who had bookmarked a PHPSESSID URL, and could not reproduce an error. It is being properly ignored.

[jdarwood007]

I haven't tried to reproduce it either however

SMF/Sources/Session.php

Lines 149 to 160 in a4ab0a4

	// Look for it in the database.
	$result = $smcFunc['db_query']('', '
	SELECT data
	FROM {db_prefix}sessions
	WHERE session_id = {string:session_id}
	LIMIT 1',
	array(
	'session_id' => $id,
	)
	);
	list ($sess_data) = $smcFunc['db_fetch_row']($result);
	$smcFunc['db_free_result']($result);

The error is most likely because the query is failing, $result is returns a resource but when we pass it into db_fetch_row we get an error and false is returned.
To work around it we would have to do something like

		$row = $smcFunc['db_fetch_row']($result);
		$smcFunc['db_free_result']($result);

		return is_array($row) && $row[0] != null ? $row[0] : '';

[sbulen]

I repeated the tests in pg14, and everything came out clean. Even with js disabled, and with cookies disabled. Also dummied up some bogus PHPSESSIDs.

PHP 8.4.5; clean 2.1.7 install.

[Geremia]

@sbulen

Note that since SMF no longer generates the PHPSESSID URLs, I'm not sure where those are coming from...

I think it's a bot or malicious source.

[Geremia]

@jdarwood007

To work around it we would have to do something like

--- a/Sources/Session.php
+++ b/Sources/Session.php
@@ -162 +162 @@
-		return $sess_data != null ? $sess_data : '';
+		return is_array($row) && $row[0] != null ? $row[0] : '';

led to:

And even if I do try to log out or clear all cookies and try logging in again, I get that same message.

[sbulen]

The challenge here is that the issue is not reproducible with the given instructions. It may be a local issue, not a bug. Unknown at this point. You're right, it may be malicious code. But how are they sneaking that in there...

Anything in the mysql log? apache log? php log?

Since the session query appears to be failing, I would audit the session table, make sure it matches SMF, structure & indexes. Compare the relevant code to vanilla, Session.php, Security.php, Subs-Auth.php, and Subs-Db-Postgresql.php. Make sure it's all vanilla.

smf_sessions is very simple, but gets a LOT of inserts/deletes. I'd try any pg tools to analyze/vacuum/optimize. Maybe even truncate it.

I'm not as familar with pg tools, but if there is a way to log the pg queries & see exactly what the failed request is, that'd help.

If there is not standard way to get that logged, you maybe need some debug code to isolate the internal DB error.

[Geremia]

@sbulen I even turned on "Include database query in the error log", but it's not logging those.

Also, I'm getting the error when Guests access threads without PHPSESSID in the URL (e.g., index.php?/topic,201.msg503.html).

I also vacuumed, analyzed, and optimized smf, but I'm still getting this issue.

The requests are coming from a bot (Bytespider; spider-feedback@bytedance.com).

[Geremia]

Session.php, Security.php, Subs-Auth.php, and Subs-Db-Postgresql.php. Make sure it's all vanilla.

I diffed those; they're the same.

[jdarwood007]

@Geremia

Think you missed a line that needed to be updated

		list ($sess_data) = $smcFunc['db_fetch_row']($result);
		$smcFunc['db_free_result']($result);

		return $sess_data != null ? $sess_data : '';

		$row = $smcFunc['db_fetch_row']($result);
		$smcFunc['db_free_result']($result);

		return is_array($row) && $row[0] != null ? $row[0] : '';

That said, as mentioned, PHPSESSID is no longer used. Cookies are required, but JavaScript is not needed to browse or use basic functionality. It is used to enhance things. It may also be used by recaptcha or other modern anti-spam technology

[Geremia]

@jdarwood007 Oh, I see, you meant:

--- a/Session.php
+++ b/Session.php
@@ -159 +159 @@
-		list ($sess_data) = $smcFunc['db_fetch_row']($result);
+		$row = $smcFunc['db_fetch_row']($result);
@@ -162 +162 @@
-		return $sess_data != null ? $sess_data : '';
+		return is_array($row) && ($row[0] != null ? $row[0] : '');

That still produces the problems I mentioned above.

[jdarwood007]

I wonder if your session error is related to the issue we have addressed in #9167

[Geremia]

@jdarwood007 Maybe.

[Geremia]

@sbulen

Anything in the mysql log?

I enabled Postgres request logging, but I didn't see anything useful.