Skip to content

Commit 6901c87

Browse files
GirgiasGirgias
committed
session: deprecate passing save handlers without create_sid() and validateId() methods
RFC: https://wiki.php.net/rfc/deprecations_php_8_6#deprecate_passing_a_sessionhandler_object_to_session_set_save_handler_which_does_not_contain_the_create_sid_and_validateid_methods
1 parent 00f9028 commit 6901c87

10 files changed

Lines changed: 86 additions & 4 deletions

‎ext/session/mod_user_class.c‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -158,3 +158,22 @@ PHP_METHOD(SessionHandler, create_sid)
158158

159159
RETURN_STR(id);
160160
}
161+
162+
PHP_METHOD(SessionHandler, validateId)
163+
{
164+
zend_string *id;
165+
166+
if (zend_parse_parameters(ZEND_NUM_ARGS(), "S", &id) == FAILURE) {
167+
RETURN_THROWS();
168+
}
169+
170+
PS_SANITY_CHECK;
171+
if (!PS(mod_user_is_open)) {
172+
php_error_docref(NULL, E_WARNING, "Parent session handler is not open, ignoring ID validation");
173+
RETURN_TRUE;
174+
}
175+
176+
zend_result status = PS(default_mod)->s_validate_sid(&PS(mod_data), id);
177+
178+
RETURN_BOOL(status == SUCCESS);
179+
}

‎ext/session/session.c‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2158,6 +2158,9 @@ PHP_FUNCTION(session_set_save_handler)
21582158
} else if (zend_hash_find_ptr(object_methods, create_sid_name)) {
21592159
/* For BC reasons we accept methods even if the class does not implement the interface */
21602160
SESSION_SET_USER_HANDLER_OO(ps_create_sid, zend_string_copy(create_sid_name));
2161+
} else {
2162+
php_error_docref(NULL, E_DEPRECATED,
2163+
"Providing an object to argument #1 ($sessionhandler) which does not have the create_sid() method defined is deprecated");
21612164
}
21622165
zend_string_release_ex(create_sid_name, false);
21632166

@@ -2179,6 +2182,9 @@ PHP_FUNCTION(session_set_save_handler)
21792182
if (zend_hash_find_ptr(object_methods, validate_sid_name)) {
21802183
/* For BC reasons we accept methods even if the class does not implement the interface */
21812184
SESSION_SET_USER_HANDLER_OO(ps_validate_sid, zend_string_copy(validate_sid_name));
2185+
} else {
2186+
php_error_docref(NULL, E_DEPRECATED,
2187+
"Providing an object to argument #1 ($sessionhandler) which does not have the validateId() method defined is deprecated");
21822188
}
21832189
if (zend_hash_find_ptr(object_methods, update_timestamp_name)) {
21842190
/* For BC reasons we accept methods even if the class does not implement the interface */
@@ -2929,6 +2935,20 @@ static PHP_GINIT_FUNCTION(ps)
29292935
ps_globals->random_seeded = false;
29302936
}
29312937

2938+
static int session_handler_interface_gets_implemented(zend_class_entry *self, zend_class_entry *class) {
2939+
if (!zend_hash_str_exists(&class->function_table, ZEND_STRL("create_sid"))) {
2940+
zend_error(E_WARNING,
2941+
"Class %s implementing SessionHandlerInterface is missing the create_sid() method which will be required in PHP 9.0",
2942+
ZSTR_VAL(class->name));
2943+
}
2944+
if (!zend_hash_str_exists(&class->function_table, ZEND_STRL("validateid"))) {
2945+
zend_error(E_WARNING,
2946+
"Class %s implementing SessionHandlerInterface is missing the validateId() method which will be required in PHP 9.0",
2947+
ZSTR_VAL(class->name));
2948+
}
2949+
return SUCCESS;
2950+
}
2951+
29322952
static PHP_MINIT_FUNCTION(session)
29332953
{
29342954
zend_register_auto_global(zend_string_init_interned(ZEND_STRL("_SESSION"), true), false, NULL);
@@ -2947,6 +2967,7 @@ static PHP_MINIT_FUNCTION(session)
29472967

29482968
/* Register interfaces */
29492969
php_session_iface_entry = register_class_SessionHandlerInterface();
2970+
php_session_iface_entry->interface_gets_implemented = session_handler_interface_gets_implemented;
29502971

29512972
php_session_id_iface_entry = register_class_SessionIdInterface();
29522973

‎ext/session/session.stub.php‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -147,4 +147,7 @@ public function gc(int $max_lifetime): int|false {}
147147

148148
/** @tentative-return-type */
149149
public function create_sid(): string {}
150+
151+
/** @tentative-return-type */
152+
public function validateId(string $id): bool {}
150153
}

‎ext/session/session_arginfo.h‎

Lines changed: 5 additions & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎ext/session/tests/user_session_module/gh9583-extra.phpt‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,8 @@ session
55
--FILE--
66
<?php
77

8+
ob_start();
9+
810
class SessionHandlerTester implements \SessionHandlerInterface
911
{
1012

@@ -42,6 +44,13 @@ echo 'validateId() ', (method_exists($obj, 'validateId') ? ('returns ' . ($obj->
4244
var_dump($originalSessionId == $newSessionId);
4345

4446
?>
45-
--EXPECT--
47+
--EXPECTF--
48+
Warning: Class SessionHandlerTester implementing SessionHandlerInterface is missing the create_sid() method which will be required in PHP 9.0 in %s on line %d
49+
50+
Warning: Class SessionHandlerTester implementing SessionHandlerInterface is missing the validateId() method which will be required in PHP 9.0 in %s on line %d
51+
52+
Deprecated: session_set_save_handler(): Providing an object to argument #1 ($sessionhandler) which does not have the create_sid() method defined is deprecated in %s on line %d
53+
54+
Deprecated: session_set_save_handler(): Providing an object to argument #1 ($sessionhandler) which does not have the validateId() method defined is deprecated in %s on line %d
4655
validateId() is commented out
4756
bool(true)

‎ext/session/tests/user_session_module/gh9583.phpt‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,8 @@ session
55
--FILE--
66
<?php
77

8+
ob_start();
9+
810
class SessionHandlerTester implements \SessionHandlerInterface
911
{
1012

@@ -38,6 +40,14 @@ echo "\n";
3840

3941
?>
4042
--EXPECTF--
43+
Warning: Class SessionHandlerTester implementing SessionHandlerInterface is missing the create_sid() method which will be required in PHP 9.0 in %s on line %d
44+
45+
Warning: Class SessionHandlerTester implementing SessionHandlerInterface is missing the validateId() method which will be required in PHP 9.0 in %s on line %d
46+
47+
Deprecated: session_set_save_handler(): Providing an object to argument #1 ($sessionhandler) which does not have the create_sid() method defined is deprecated in %s on line %d
48+
49+
Deprecated: session_set_save_handler(): Providing an object to argument #1 ($sessionhandler) which does not have the validateId() method defined is deprecated in %s on line %d
50+
4151
validateId() is commented out
4252

4353
Session ID:%s

‎ext/session/tests/user_session_module/session_set_save_handler_class_016.phpt‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -80,6 +80,8 @@ array(1) {
8080
["foo"]=>
8181
string(5) "hello"
8282
}
83+
84+
Warning: SessionHandler::validateId(): Parent session handler is not open, ignoring ID validation in %s on line %d
8385
array(1) {
8486
["foo"]=>
8587
string(5) "hello"

‎ext/session/tests/user_session_module/session_set_save_handler_class_017.phpt‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -71,14 +71,16 @@ var_dump($_SESSION);
7171
<?php
7272
@unlink(session_save_path().'/u_sess_PHPSESSIDsession_set_save_handler_class_017');
7373
?>
74-
--EXPECT--
74+
--EXPECTF--
7575
*** Testing session_set_save_handler() function: class with create_sid ***
7676
string(34) "session_set_save_handler_class_017"
7777
string(4) "user"
7878
array(1) {
7979
["foo"]=>
8080
string(5) "hello"
8181
}
82+
83+
Warning: SessionHandler::validateId(): Parent session handler is not open, ignoring ID validation in %s on line %d
8284
array(1) {
8385
["foo"]=>
8486
string(5) "hello"

‎ext/session/tests/user_session_module/session_set_save_handler_iface_001.phpt‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -83,6 +83,10 @@ session_unset();
8383
--EXPECTF--
8484
*** Testing session_set_save_handler() function: interface ***
8585

86+
Warning: Class MySession2 implementing SessionHandlerInterface is missing the create_sid() method which will be required in PHP 9.0 in %s on line %d
87+
88+
Warning: Class MySession2 implementing SessionHandlerInterface is missing the validateId() method which will be required in PHP 9.0 in %s on line %d
89+
8690
Deprecated: session_set_save_handler(): Providing individual callbacks instead of an object implementing SessionHandlerInterface is deprecated in %s on line %d
8791
string(%d) "%s"
8892
string(4) "user"
@@ -94,6 +98,10 @@ array(1) {
9498
["foo"]=>
9599
string(5) "hello"
96100
}
101+
102+
Deprecated: session_set_save_handler(): Providing an object to argument #1 ($sessionhandler) which does not have the create_sid() method defined is deprecated in %s on line %d
103+
104+
Deprecated: session_set_save_handler(): Providing an object to argument #1 ($sessionhandler) which does not have the validateId() method defined is deprecated in %s on line %d
97105
string(%d) "%s"
98106
string(4) "user"
99107
array(1) {

‎ext/session/tests/user_session_module/session_set_save_handler_iface_003.phpt‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -70,8 +70,12 @@ var_dump($_SESSION);
7070
<?php
7171
@unlink(session_save_path().'/u_sess_PHPSESSIDsession_set_save_handler_iface_003');
7272
?>
73-
--EXPECT--
73+
--EXPECTF--
7474
*** Testing session_set_save_handler() function: id interface ***
75+
76+
Warning: Class MySession2 implementing SessionHandlerInterface is missing the validateId() method which will be required in PHP 9.0 in %s on line %d
77+
78+
Deprecated: session_set_save_handler(): Providing an object to argument #1 ($sessionhandler) which does not have the validateId() method defined is deprecated in %s on line %d
7579
string(34) "session_set_save_handler_iface_003"
7680
string(4) "user"
7781
array(1) {

0 commit comments

Comments
 (0)