php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #13078 register_globals = off & session.save_handler = user
Submitted: 2001-08-31 08:53 UTC Modified: 2001-12-15 11:54 UTC
From: php-jp at typhoon dot co dot jp Assigned:
Status: Closed Package: Session related
PHP Version: 4.0.6, 4.1.0 OS: FreeBSD 4.x
Private report: No CVE-ID: None
 [2001-08-31 08:53 UTC] php-jp at typhoon dot co dot jp
Things are fine when:

   register_globals = off
   session.save_handler = files

Things are fine also when:

   register_globals = on
   session.save_handler = users

where "users" are customed handlers, (saved to PostgreSQL
in my case.

PROBLEM: 

Sessions varilables aren't saved when:

   register_globals = off
   session.save_handler = users

---eof---

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2001-11-24 19:49 UTC] sniper@php.net
Can you please verify if this is now fixed in latest CVS:

http://snaps.php.net/

 [2001-12-12 07:32 UTC] php-jp at typhoon dot co dot jp
Just tried this with 4.1.0 (released on Dec 10) and the original problem description applies, i.e. this has not been fixed.  

Tried this on:

   PHP4.1.0
  Apache 1.3.20
  FreeBSD4.X
---
 [2001-12-12 07:56 UTC] php-jp at typhoon dot co dot jp
After posting the test results with 4.1.0, I tried using:

  session_register("varname");

before doing a:

  $_SESSION["varname"];

i.e., 

  session_register("varname");
  $_SESSION["varname"] = "somevaluehere";

And yet, the custom sess_write was never called.  
--ends--

 [2001-12-13 02:54 UTC] php-jp at typhoon dot co dot jp
Added 4.1.0 into the "PHP Version" field of this report.
---ends---
 [2001-12-13 04:52 UTC] yohgaki@php.net
When you use $_SESSION or $HTTP_SESSION_VARS, you don't need session_register/unregister to save session vars.
Do you have problem still when you don't use session_register/unregister?

 [2001-12-13 05:14 UTC] php-jp at typhoon dot co dot jp
Yes, I have problems with or without session_register/unregister.

In fact, I first tried:

   $_SESSION["varname"] = "somevaluehere";

to see if it was saved. But it was NOT.  So, I tried this:

   session_register("varname");
   $_SESSION["varname"] = "somevaluehere";

thinking it would help.  Anyhow, none of the above worked.  

Once again, if 

   register_globals=on

then, everything is fine.
---ends---
 [2001-12-13 05:55 UTC] derick@php.net
PHP 4.1.0 (release)

TEST SCRIPT:
<?php
    session_start();
    $_SESSION['test'] = 'YES';
    echo ini_get('register_globals');
?>

SESSION FILE CONTENTS:

With register_globals = 1:
<empty>

With register_globals = 0:
test|s:3:"YES";
 [2001-12-13 22:04 UTC] sniper@php.net
Just to note that I can not reproduce this with latest CVS.

--Jani

 [2001-12-14 00:19 UTC] php-jp at typhoon dot co dot jp
Problem solved in 4.1.0 (release).

All thanks to yohgaki@php.net for pointing me to his very well written code!

I found the reason my sess_write was never called with register_globals = off was because my sess_read function was something like this:

   sess_read( $key)
   ...
   if I find stuff for $key from PostgreSQL {
      return $valuesfound;
   }
   else {
      return false;
   }

The problem was with "return false;"
After changing:

    return false;

to
    return NULL;

things worked.

Don't know why the "return false" worked with "register_globals=on" and "register_global=off" requires sess_read to return NULL if nothing was found...

THANKS again to yohgaki@php.net for his code and my apologise for wasting people's time.

Please feel free to close this bug report.  I am not closing it because derick@php.net brought up something which I don't know about nor can I duplicate. 
---ends---

      
 [2001-12-14 01:45 UTC] php-jp at typhoon dot co dot jp
Sorry, but further testing revealed when sess_read

  return NULL;

for when nothing was found caused problems sometimes, not always!

However

  return '';

seems to work all of the time!  

Looks like sess_write has to return a '' (null string) It cannot return NULL, nor it return false;

Otherise sess_write will never be called!
---ends---
 [2001-12-14 02:52 UTC] derick@php.net
Closing then...
 [2001-12-14 02:56 UTC] yohgaki@php.net
It is bug in your session handler, but PHP should not behave that way.


 [2001-12-14 03:40 UTC] yohgaki@php.net
Closing. (I don't mean warning message patch is committed ;)
If anyone who has karma for session module liked it, it will be committed.
 [2001-12-15 11:54 UTC] derick@php.net
This is fixed in php 4.2.0dev.

Derick
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Sat May 18 16:01:36 2024 UTC