Fix bug #71038 - session_start() returns true even when it failed #2167

yohgaki · 2016-10-16T08:49:58Z

Sorry for late bug fix for important feature.
I felt complete fix requires RFC and I forgot to create RFC for this.
https://bugs.php.net/bug.php?id=71038

In short, this patch fixes session_start()'s insane behaviors.

NOTE: There is no functional changes at all, but only error handling changes. Therefore, proper codes will not be affected by this change. Only bad codes are detected.

Original session_start() is designed to continue execution as much as it can. This design caused a lot of issues including number of crash bugs. We've removed most issues caused by this design, but session_start() behaves insane way. e.g. Return TRUE and initializes $_SESSION array for useless session, improper error messages, memory leak, etc. (Please verify phpt changes how this patch makes session_start() behave sane way)

This fix may change app behavior. However, it changes behavior only when there is useless session which is fatal anyway. Therefore, it could be applied to PHP 7.1.

I pushed patch ( 637f72c and later commits) fixes number of nonsense/inconsistent session function behaviors. Many of them are impossible to fix due to improper session status management. This bug fix allows us to fix many error handling issues in session module. The additional patch is pushed so that it's easy to cherry pick minimum fixes. 637f72c and later commits are additional fixes other than session_start() return value issue.

Change Summary:

Disallow nonsense function usages/behaviors.
- Do not allow to change cookie parameters when it has no effects.
  - session_set_cookie_params() session_cache_limiter()
- Dn not allow to change INI parameters when it cannot be changed.
  - session_name() session_module_name() session_save_path() session_set_save_handler() session_cache_expire()
- Do not allow parameter for void parameter functions.
  - session_unset() session_write_close() session_commit() session_abort() session_reset()
- Do not allow nonsense INI changes by ini_set()
  - All of cookie related INIs, session.use_strict_mode and session.referer_check.
- Return function status properly.
  - session_start() - It sets correct session status always by this patch.
- Return function status as it should. Previously void.
  - session_abort() session_flush() session_commit() session_write_close() session_reset() session_destroy()
Raise proper error and return status.
- Many functions.

…s can be fixed also. - Disallow nonsense function usage that has no effect - Return proper value on failure - Show proper errors on failure Additionally - Made session_flash()/session_commit()/session_write_close() report errors and return bool, parameter is checked as other functions.

KalleZ · 2016-10-17T01:34:51Z

Maybe a side thing, but Yasuo, from how I read php_session_start(), then it is possible for it to return SUCCESS and have PS(id) be NULL, is this intended, or?

yohgaki · 2016-10-17T01:50:53Z

@KalleZ Do you mean php_session_start()? Then yes, it is intended. If you read code closely, PS(id) is set eventually for successful call. Otherwise, many PHP sites will have severe problems.

When session cannot be started, it results in empty session ID because it does not make sense to have unusable session ID. Is there any valid use case for this?

KalleZ · 2016-10-17T02:14:27Z

ext/session/session.c

@@ -1531,36 +1542,50 @@ PHPAPI void php_session_start(void) /* {{{ */
 		PS(id) = NULL;


@yohgaki I mean here for example, don't we miss a return as well?

@KalleZ Thank you for checking!
php_session_start() only initializes session ID from client. Invalid session ID or initial access can result in PS(id) == NULL. Therefore there should not be "return" here.

There is php_session_initialize() bellow. It creates new session ID when PS(id) == NULL. If it failed for reasons, it should return FAILURE with PS(id) == NULL or PS(id) != NULL.

As you can see from this PR. Session module has a lot of problems and legacy codes. There may be redundant/strange/obsolete codes. Some are intentional, but please let me know if you find anything.

@yohgaki Thank you for clarifying, the session module does seem a mess at some parts and I was just trying to understand it a bit better. I will let you know if I spot anything obvious.

KalleZ · 2016-10-17T02:17:47Z

@yohgaki hmm it may be me then but as I read the code then there is at least one such case where PS(id) can be NULL and php_session_start() be a SUCCESS. I added an inline comment

pierrejoye · 2016-10-18T01:54:06Z

ext/session/session.c

-	STD_PHP_INI_ENTRY("session.referer_check",      "",          PHP_INI_ALL, OnUpdateString, extern_referer_chk, php_ps_globals,    ps_globals)
-	STD_PHP_INI_ENTRY("session.cache_limiter",      "nocache",   PHP_INI_ALL, OnUpdateString, cache_limiter,      php_ps_globals,    ps_globals)
-	STD_PHP_INI_ENTRY("session.cache_expire",       "180",       PHP_INI_ALL, OnUpdateLong,   cache_expire,       php_ps_globals,    ps_globals)
+	STD_PHP_INI_ENTRY("session.cookie_lifetime",    "0",         PHP_INI_ALL, OnUpdateSessionLongGEZero,   cookie_lifetime,    php_ps_globals,    ps_globals)


OnUpdateSessionLongGEZero makes little sense, OnUpdateSessionLifetime sounds more obvious as name.

or even better OnUpdateSessionTTL (TTL is only > 0)

It's not reused, so it would be better to use dedicated name. I'll

It kept TTL for other usage and used Lifetime for this.
i.e. Time stamped session management.

yohgaki · 2016-10-18T03:39:54Z

Why does travis not fail to build always, but on occasion when base branch is wrong??

It seems multiple tests are running on build env...

smalyshev · 2016-10-19T05:46:12Z

ext/session/session.c

@@ -1353,15 +1402,17 @@ static void ppid2sid(zval *ppid) {
 	}
 }

-PHPAPI void php_session_reset_id(void) /* {{{ */
+
+/* Made to return int from 7.1, previously void */


We don't need to comment on this in the code, this should be in the manual and UPGRADING.

smalyshev · 2016-10-19T05:48:59Z

ext/session/session.c

+static PHP_INI_MH(OnUpdateCookieLifetime) /* {{{ */
+{
+	SESSION_CHECK_OUTPUT_STATE;
+	return OnUpdateLongGEZero(entry, new_value, mh_arg1, mh_arg2, mh_arg3, stage);


It was OnUpdateLong before, why it changed?

Negative lifetime is treated the same as 0. It is mitigation for integer overflow that user would like to set very long lifetime, but it overflowed by computation. It's unlikely, so it could be OnUpdateLong. Should I?

PHP numbers don't work this way - if you add two large integers, it converts to float, not negative number.

smalyshev · 2016-10-19T05:50:00Z

ext/session/session.c

 	PHP_INI_ENTRY("session.use_trans_sid",          "0",         PHP_INI_ALL, OnUpdateTransSid)
 	PHP_INI_ENTRY("session.sid_length",             "32",        PHP_INI_ALL, OnUpdateSidLength)
 	PHP_INI_ENTRY("session.sid_bits_per_character", "4",         PHP_INI_ALL, OnUpdateSidBits)
-	STD_PHP_INI_BOOLEAN("session.lazy_write",       "1",         PHP_INI_ALL, OnUpdateBool,   lazy_write,         php_ps_globals,    ps_globals)
+	STD_PHP_INI_BOOLEAN("session.lazy_write",       "1",         PHP_INI_ALL, OnUpdateSessionBool,   lazy_write,         php_ps_globals,    ps_globals)


Why I can't change lazy write after session start? Write happens at the end, not at the start.

lazy_write stores read session data, so this setting should be enabled before session_start(), otherwise it does not take the effect. I should fix this! Thank you!

Well, I think still not much of a problem enabling lazy writes - worst thing, it would not be lazy if the data to do lazy part is not there.

smalyshev · 2016-10-19T05:52:11Z

ext/session/session.c

+		php_error_docref(NULL, E_WARNING, "Cannot set cookie parameters - headers already sent");
+		RETURN_FALSE;
+	}
+


Shouldn't we also check session state? If session state is wrong, INI functions will fail anyway, so why not check it if we're already checking this?

smalyshev · 2016-10-19T05:54:26Z

ext/session/session.c

@@ -1675,6 +1770,11 @@ static PHP_FUNCTION(session_module_name)
 		return;
 	}

+	if (name && PS(session_status) == php_session_active) {
+		php_error_docref(NULL, E_WARNING, "Cannot change save handler module when session is active");


Why we need this check? According to test bug73100.phpt session_module_name already fails when session is active.

smalyshev · 2016-10-19T05:55:04Z

ext/session/session.c

@@ -1867,6 +1968,11 @@ static PHP_FUNCTION(session_save_path)
 		return;
 	}

+	if (PS(session_status) == php_session_active) {
+		php_error_docref(NULL, E_WARNING, "Cannot change save path when session is active");


Same here - why not?

smalyshev · 2016-10-19T05:55:12Z

ext/session/session.c

@@ -1710,7 +1810,8 @@ static PHP_FUNCTION(session_set_save_handler)
 	zend_string *name;
 	zend_string *ini_name, *ini_val;

-	if (PS(session_status) != php_session_none) {
+	if (PS(session_status) == php_session_active) {
+		php_error_docref(NULL, E_WARNING, "Cannot change save handler when session is active");


Why we can't change it here, actually? Would something work wrong? Yes, we may use different handlers - so what? Changing write handler before write happens should not be a problem, should it?

smalyshev · 2016-10-19T05:56:17Z

ext/session/session.c

@@ -2074,6 +2182,11 @@ static PHP_FUNCTION(session_cache_limiter)
 	zend_string *limiter = NULL;
 	zend_string *ini_name;

+	if (PS(session_status) == php_session_active) {
+		php_error_docref(NULL, E_WARNING, "Cannot change cache limiter when session is active");


Here I would rather tell about headers since session being active is not the problem here - the problem here would be we already sent the headers, so we can't take them back.

smalyshev · 2016-10-19T05:58:37Z

ext/session/session.c

@@ -2177,6 +2295,11 @@ static PHP_FUNCTION(session_start)
 		RETURN_FALSE;
 	}

+	if (PS(session_status) == php_session_active) {
+		php_error_docref(NULL, E_NOTICE, "A session had already been started - ignoring");


I'm not sure this is right. Certainly a BC break. You may have legitimate case for replacing session data from third party source. Weird, but people do weird things. Is there a reason to prohibit it?

smalyshev · 2016-10-19T06:01:00Z

ext/session/session.c

@@ -2227,14 +2356,23 @@ static PHP_FUNCTION(session_destroy)
 		return;
 	}

+	if (PS(session_status) != php_session_active) {
+		php_error_docref(NULL, E_WARNING, "Trying to destroy uninitialized session");


I'm not sure about this one... There might be code that calls destroy repeatedly, just in case - e.g. error handlers, etc. - and putting warning there does not help much. Since the session stays destroyed, there's not real reason to react with a failure error. I'd just silently return, maybe return false at worst. Warning should be when whatever you tried to do failed, but here it didn't actually fail - it was just unnecessary.

…etime. Check active state for lazy_write

… into PHP-7.1-session-bug71038

…ug71038

…nt will never work. Should not change setting while session is active because it does not work.

yohgaki · 2016-10-23T08:03:46Z

All issue should be resolved. Please let me know if you find any.

All INI changes should not be done while active. Once output is started, both cookie and trans sid session will not work correctly.

…ug71038

PR #2167

yohgaki · 2016-11-17T02:18:19Z

Merged to master
http://git.php.net/?p=php-src.git;a=commitdiff;h=7f196e321fa464075248eced7d0d2c046b686b24

* master: Fix bug #71038 - session_start() returns true even when it failed PR php#2167 Remove PDOStatement::activeQueryString()

SailorMax · 2017-06-28T14:06:50Z

@yohgaki
Looks like you broke getting session name via session_name() without arguments. Now it output "Cannot change session name when headers already sent"
https://bugs.php.net/bug.php?id=74514

Can you add check on no arguments before output warning?
"if (SG(headers_sent)) {" -> "if (name && SG(headers_sent)) {"
in "static PHP_FUNCTION(session_name)"
and "static PHP_FUNCTION(session_module_name)"

thank you.

yohgaki · 2017-06-30T15:33:29Z

@SailorMax
I might not understand the issue well yet, but it seems something wrong.

With current master

[yohgaki@dev PHP-master]$ ./sapi/cli/php -r 'var_dump(session_name("foo"));var_dump(session_name());'
string(9) "PHPSESSID"

Warning: session_name(): Cannot change session name when headers already sent in Command line code on line 1
bool(false)

2nd session_name() should not try to send HTTP Cookie header. The referred bug report problem seems this is the cause.

Following what it should do. (tested with 7.0)

$ php -r 'var_dump($n=session_name("foo"));var_dump(session_name());'
string(9) "PHPSESSID"
string(3) "foo"

Let's continue discussion on the
https://bugs.php.net/bug.php?id=74514

SailorMax · 2017-06-30T15:48:50Z

@yohgaki
2nd session_name() did not send any headers. It just has wrong "if":
at ext/session/session.c :: static PHP_FUNCTION(session_name)
"if (SG(headers_sent)) {" instead of "if (name && SG(headers_sent)) {"
It has to check headers only when got new name.

Same problem with session_module_name()
Also think about session_save_path(), session_cache_limiter(), and session_cache_expire()

yohgaki · 2017-06-30T16:44:50Z

@SailorMax
You mean
"if (name && SG(headers_sent)) {" instead of "if (SG(headers_sent)) {"
I should have considered non output buffered environment. Thanks.

yohgaki · 2017-06-30T17:32:33Z

@SailorMax
Simply adding non null parameters check have problems still on CLI which ignores HTTP headers at all.
For instance,

var_dump(session_name('foo'));
var_dump(session_module_name('files')); <-- Headers are already sent on Web SAPI w/o buffering, but not with CLI.

SG(headers_sent) should return false always with CLI. However, many test scripts may rely on SG(headers_sent) being true.

I thought about disabling the checks for CLI build, but we have CLI server...

"if (name && SG(headers_sent)) {", this change is good, but it fixes issue partially for CLI. It may be better leave this as documentation issue for 7.2 because it does not make much sense to optimize behavior for non output buffered CLI, i.e. Web SAPI should enable output buffer to work.

Anyway, the "name" check should be added. I'll commit the changes for 5 session functions.

yohgaki · 2017-06-30T18:51:40Z

@SailorMax
https://goo.gl/DWZNsQ
Fixed.

Yasuo Ohgaki added 3 commits October 16, 2016 17:34

Fix bug #71038

5ce7642

Add required return

fa6fa18

Fix tests

6ec20f2

KalleZ reviewed Oct 17, 2016

View reviewed changes

Yasuo Ohgaki added 4 commits October 17, 2016 12:10

Disallow nonsense INI changes

bcf6764

Update PHP_SESSION_API

2a77f71

Remove env dependecy from test

29882f3

Add missing SUCCESS

bcae969

pierrejoye reviewed Oct 18, 2016

View reviewed changes

Use dedicated PHP_MH names. Align INI entry defs

27e4361

yohgaki changed the base branch from master to PHP-7.1 October 18, 2016 03:16

Base branch was wrong. Touch file to force travis to rebuild.

f2d06e0

smalyshev reviewed Oct 19, 2016

View reviewed changes

smalyshev added the Feature label Oct 19, 2016

yohgaki added 3 commits October 23, 2016 14:23

Check active state rather than http header. Check negative cookie lif…

e7cd7c1

…etime. Check active state for lazy_write

Merge branch 'PHP-7.1-session-bug71038' of github.com:yohgaki/php-src…

1cd9654

… into PHP-7.1-session-bug71038

Merge remote-tracking branch 'upstream/master' into PHP-7.1-session-b…

3114f4d

…ug71038

yohgaki changed the base branch from PHP-7.1 to master October 23, 2016 05:56

yohgaki added 3 commits October 23, 2016 16:53

Add doc. Check both output and active status. Changes after header se…

1646d2f

…nt will never work. Should not change setting while session is active because it does not work.

Update to more descrictive sentence

f5bc23b

Fix test

7315a54

yohgaki added 2 commits October 23, 2016 17:46

I should have checked header sent status in functions, too.

5a30738

Add test for INI changes

76f77f7

yohgaki and others added 6 commits October 23, 2016 18:34

Fix test

51e83df

Merge branch 'master' into PHP-7.1-session-bug71038

94b5532

Merge remote-tracking branch 'upstream/master' into PHP-7.1-session-b…

3a1e707

…ug71038

Merge remote-tracking branch 'upstream/master' into PHP-7.1-session-b…

b96f304

…ug71038

Merge remote-tracking branch 'upstream/master' into PHP-7.1-session-b…

890a40f

…ug71038

Fix test

f9a39aa

php-pulls pushed a commit that referenced this pull request Nov 17, 2016

Fix bug #71038 - session_start() returns true even when it failed

7f196e3

PR #2167

yohgaki closed this Nov 17, 2016

dstogov added a commit to zendtech/php-src that referenced this pull request Nov 17, 2016

Merge branch 'master' into jit-dynasm

1e8341f

* master: Fix bug #71038 - session_start() returns true even when it failed PR php#2167 Remove PDOStatement::activeQueryString()

		@@ -1531,36 +1542,50 @@ PHPAPI void php_session_start(void) /* {{{ */
		PS(id) = NULL;

Fix bug #71038 - session_start() returns true even when it failed #2167

Fix bug #71038 - session_start() returns true even when it failed #2167

Uh oh!

Conversation

yohgaki commented Oct 16, 2016 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

KalleZ commented Oct 17, 2016

Uh oh!

yohgaki commented Oct 17, 2016 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

yohgaki Oct 17, 2016 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

KalleZ commented Oct 17, 2016

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

yohgaki Oct 18, 2016 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

yohgaki commented Oct 18, 2016 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

yohgaki commented Oct 23, 2016 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

yohgaki commented Nov 17, 2016

Uh oh!

SailorMax commented Jun 28, 2017

Uh oh!

yohgaki commented Jun 30, 2017 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

SailorMax commented Jun 30, 2017

Uh oh!

yohgaki commented Jun 30, 2017

Uh oh!

yohgaki commented Jun 30, 2017 • edited Loading Uh oh! There was an error while loading. Please reload this page.

yohgaki commented Oct 16, 2016 •

edited

Loading

yohgaki commented Oct 17, 2016 •

edited

Loading

yohgaki Oct 17, 2016 •

edited

Loading

yohgaki Oct 18, 2016 •

edited

Loading

yohgaki commented Oct 18, 2016 •

edited

Loading

yohgaki commented Oct 23, 2016 •

edited

Loading

yohgaki commented Jun 30, 2017 •

edited

Loading

yohgaki commented Jun 30, 2017 •

edited

Loading

yohgaki commented Jun 30, 2017 •

edited

Loading