php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Bug #38085 session_regenerate_id() clashes with session.save_path
Submitted: 2006-07-12 21:59 UTC Modified: 2006-07-14 06:21 UTC
From: ralph at smashlabs dot com Assigned:
Status: Not a bug Package: Session related
PHP Version: 5.1.4 OS: Linux 2.6 series
Private report: No CVE-ID: None
View Developer Edit
Welcome! If you don't have a Git account, you can't do anything here.
If you reported this bug, you can edit this bug over here.
(description)
Block user comment
Status: Assign to:
Package:
Bug Type:
Summary:
From: ralph at smashlabs dot com
New email:
PHP Version: OS:

 

 [2006-07-12 21:59 UTC] ralph at smashlabs dot com 
Description:
------------
I have not dug super deep into this problem but it seems as though if I try to call session_regenerate_id() after having set session.save_path with custom values, i get an error.  My guess is that session_regenerate_id() is having issues with the save_path var. See rest below:

Reproduce code:
---------------
This is my test script:

file: ../htdocs/test.php
<?

ini_set("session.save_path", ";666;../application/var/sessions");

session_start();

$id_before = session_id();

if ((++$_SESSION['counter'] % 5) == 0)
{
    session_regenerate_id(true);
}

echo "<pre>SESSION ID BEFORE: " . $id_before . "\n";
echo "SESSION ID AFTER : " . session_id();
echo "COUNTER          : " . $_SESSION['counter'];

?> 

Expected result:
----------------
The first 5 times it runs, it works fine... which means the file was created with the proper permissions and at the proper location.

On the 5th run, I should not see any errors. Only the before and after Session ID AND there should be a file in the directory with the old session data... Counter should never start over.



Actual result:
--------------
SESSION ID BEFORE: 1e1469055dd81c95fb78aafde667639a
SESSION ID AFTER : a51b257a22da32065a0bef114abac7c7

COUNTER          : 5

Warning:  Unknown: open(../application/var/sessions/sess_a51b257a22da32065a0bef114abac7c7, O_RDWR) failed: No such file or directory (2) in Unknown on line 0



Warning:  Unknown: Failed to write session data (files). Please verify that the current setting of session.save_path is correct (;666;../application/var/sessions) in Unknown on line 0

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2006-07-13 00:03 UTC] iliaa@php.net 
Please try using this CVS snapshot:

  http://snaps.php.net/php5.2-latest.tar.gz
 
For Windows:
 
  http://snaps.php.net/win32/php5.2-win32-latest.zip

Works fine in latest cvs, even with 10 runs.
Have you tried changing ../application/var/sessions to a full 
path?
 [2006-07-13 05:43 UTC] ralph at smashlabs dot com 
Thanks for the quick response.

For both 5.1.4 and 5.2 that script works fine if I use a full path from root, eg: /home/ralph/dev/application/var/sessions
(including with a trailing slash too).

In both 5.1.4 and 5.2 the problem persists when you use a relative path.

Can you not reproduce this?  Shall I post some INI info?

While not super high priority, in a bootstrapped type framework based envoirment, it would be nice to be able to use relative paths for portablity reasons.

Thanks again.
Ralph
 [2006-07-13 13:45 UTC] iliaa@php.net 
Thank you for taking the time to write to us, but this is not
a bug. Please double-check the documentation available at
http://www.php.net/manual/ and the instructions on how to report
a bug at http://bugs.php.net/how-to-report.php

The bottom line is that you should not use relative paths as 
they can be affected by internal directory change. Therefor 
throwing you out of the expected directory path resulting in 
the errors you've encountered.
 [2006-07-14 06:21 UTC] ralph at smashlabs dot com 
You are correct, this is an issue of the internal cwd changing.  This only seems to be an issue in a forked environment as when started w/ strace and apache2 non-forked it works as expected.  

The fact of the matter is that as a user, I should certainly not be expected to concern myself with the inner workings of php, its internal state, or the internal current working directory.  When I supply a session.save_path in a script, it should be clear that it is being set within the context of the user-script.  Simply put, PHP should recognize when a relative directory was passed and prefix it with the base directory of the calling script.

Since session.save_path related code is so isolated, it seems like it would be more trivial than not to add this to the ext/session/mod_files.c or some function that uses the save_path.  After a quick search, it seems like I am not the only one that has wanted this functionality: http://us2.php.net/manual/en/ref.session.php#54881

Furthermore, having this would encourage better PHP (app) coding standards, resulting in cleaner, more portable solutions.

BTW, nowhere in the manual does it say the path must be absolute.
 
PHP Copyright © 2001-2025 The PHP Group
All rights reserved. 		Last updated: Thu Dec 04 02:00:02 2025 UTC