php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #5770 sessions are not working
Submitted: 2000-07-24 23:58 UTC Modified: 2000-08-01 10:35 UTC
From: rusty at socrates dot berkeley dot edu Assigned:
Status: Closed Package: Session related
PHP Version: 4.0.1pl2 OS: solaris 2.7
Private report: No CVE-ID: None
View Add Comment Developer Edit
Welcome! If you don't have a Git account, you can't do anything here.
You can add a comment by following this link or if you reported this bug, you can edit this bug over here.
(description)
Block user comment
Status: Assign to:
Package:
Bug Type:
Summary:
From: rusty at socrates dot berkeley dot edu
New email:
PHP Version: OS:

 

 [2000-07-24 23:58 UTC] rusty at socrates dot berkeley dot edu
Sample files to see the problem.  When you go to bbb.php
the session id is different.  Doesn't matter if I use
session_start or session_register.  (The sess_ files are
being made in /tmp.)

# config shell script for mod_php:
./configure \
	--prefix=/grunt_a/apache \
        --with-apxs=/grunt_a/apache/bin/apxs \
        --with-xml \
        --enable-track-vars \
	--enable-trans-sid \
        --with-config-file-path=/grunt_a/apache/conf \
        --with-mysql=/grunt_a/mysql

# configure wrapper for apache
./configure \
	--prefix=/grunt_a/apache \
	--enable-rule=SHARED_CORE \
	--disable-rule=SSL_COMPAT \
	--enable-rule=SSL_SDBM \
	--enable-module=ssl \
	--enable-shared=ssl \
	--enable-module=so \
	--enable-module=most \
	--enable-shared=max

; php.ini
[PHP]

;;;;;;;;;;;;;;;;;;;
; About this file ;
;;;;;;;;;;;;;;;;;;;
; This file controls many aspects of PHP's behavior.  In order for PHP to
; read it, it must be named 'php.ini'.  PHP looks for it in the current
; working directory, in the path designated by the environment variable
; PHPRC, and in the path that was defined in compile time (in that order).
; Under Windows, the compile-time path is the Windows directory.  The
; path in which the php.ini file is looked for can be overriden using
; the -c argument in command line mode.
;
; The syntax of the file is extremely simple.  Whitespace and Lines
; beginning with a semicolon are silently ignored (as you probably guessed).
; Section headers (e.g. [Foo]) are also silently ignored, even though
; they might mean something in the future.
;
; Directives are specified using the following syntax:
; directive = value
; Directive names are *case sensitive* - foo=bar is different from FOO=bar.
;
; The value can be a string, a number, a PHP constant (e.g. E_ALL or M_PI), one
; of the INI constants (On, Off, True, False, Yes, No and None) or an expression
; (e.g. E_ALL & ~E_NOTICE), or a quoted string ("foo").
;
; Expressions in the INI file are limited to bitwise operators and parentheses:
; |				bitwise OR
; &				bitwise AND
; ~				bitwise NOT
; !				boolean NOT
;
; Boolean flags can be turned on using the values 1, On, True or Yes.
; They can be turned off using the values 0, Off, False or No.
;
; An empty string can be denoted by simply not writing anything after the equal
; sign, or by using the None keyword:
;
;   foo =			; sets foo to an empty string
;	foo = none		; sets foo to an empty string
;	foo = "none"	; sets foo to the string 'none'
;
; If you use constants in your value, and these constants belong to a dynamically
; loaded extension (either a PHP extension or a Zend extension), you may only
; use these constants *after* the line that loads the extension.
;
; All the values in the php.ini-dist file correspond to the builtin
; defaults (that is, if no php.ini is used, or if you delete these lines,
; the builtin defaults will be identical).


;;;;;;;;;;;;;;;;;;;;
; Language Options ;
;;;;;;;;;;;;;;;;;;;;

engine			=	On	; Enable the PHP scripting language engine under Apache
short_open_tag	=	On	; allow the <? tag.  otherwise, only <?php and <script> tags are recognized.
asp_tags		=	Off ; allow ASP-style <% %> tags
precision		=	14	; number of significant digits displayed in floating point numbers
y2k_compliance	=	Off	; whether to be year 2000 compliant (will cause problems with non y2k compliant browsers)
output_buffering	= Off	; Output buffering allows you to send header lines (including cookies)
							; even after you send body content, in the price of slowing PHP's
							; output layer a bit.
							; You can enable output buffering by in runtime by calling the output
							; buffering functions, or enable output buffering for all files
							; by setting this directive to On.
implicit_flush		= Off	; Implicit flush tells PHP to tell the output layer to flush itself
							; automatically after every output block.  This is equivalent to
							; calling the PHP function flush() after each and every call to print()
							; or echo() and each and every HTML block.
							; Turning this option on has serious performance implications, and
							; is generally recommended for debugging purposes only.
allow_call_time_pass_reference	= On	; whether to enable the ability to force arguments to be 
										; passed by reference at function-call time.  This method
										; is deprecated, and is likely to be unsupported in future
										; versions of PHP/Zend.  The encouraged method of specifying
										; which arguments should be passed by reference is in the
										; function declaration.  You're encouraged to try and
										; turn this option Off, and make sure your scripts work
										; properly with it, to ensure they will work with future
										; versions of the language (you will receive a warning
										; each time you use this feature, and the argument will
										; be passed by value instead of by reference).

; Safe Mode
safe_mode		=	Off
safe_mode_exec_dir	=
safe_mode_allowed_env_vars = PHP_					; Setting certain environment variables
													; may be a potential security breach.
													; This directive contains a comma-delimited
													; list of prefixes.  In Safe Mode, the
													; user may only alter environment
													; variables whose names begin with the
													; prefixes supplied here.
													; By default, users will only be able
													; to set environment variables that begin
													; with PHP_ (e.g. PHP_FOO=BAR).
													; Note:  If this directive is empty, PHP
													; will let the user modify ANY environment
													; variable!
safe_mode_protected_env_vars = LD_LIBRARY_PATH		; This directive contains a comma-
													; delimited list of environment variables,
													; that the end user won't be able to
													; change using putenv().
													; These variables will be protected
													; even if safe_mode_allowed_env_vars is
													; set to allow to change them.


disable_functions	=								; This directive allows you to disable certain
													; functions for security reasons.  It receives
													; a comma separated list of function names.
													; This directive is *NOT* affected by whether
													; Safe Mode is turned on or off.
													

; Colors for Syntax Highlighting mode.  Anything that's acceptable in <font color=???> would work.
highlight.string	=	#DD0000
highlight.comment	=	#FF8000
highlight.keyword	=	#007700
highlight.bg		=	#FFFFFF
highlight.default	=	#0000BB
highlight.html		=	#000000

; Misc
expose_php	=	On		; Decides whether PHP may expose the fact that it is installed on the
						; server (e.g., by adding its signature to the Web server header).
						; It is no security threat in any way, but it makes it possible
						; to determine whether you use PHP on your server or not.



;;;;;;;;;;;;;;;;;;;
; Resource Limits ;
;;;;;;;;;;;;;;;;;;;

max_execution_time = 30     ; Maximum execution time of each script, in seconds
memory_limit = 8388608		; Maximum amount of memory a script may consume (8MB)


;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
; Error handling and logging ;
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
; error_reporting is a bit-field.  Or each number up to get desired error reporting level
; E_ALL				- All errors and warnings
; E_ERROR			- fatal run-time errors
; E_WARNING			- run-time warnings (non fatal errors)
; E_PARSE			- compile-time parse errors
; E_NOTICE			- run-time notices (these are warnings which often result from a bug in
;					  your code, but it's possible that it was intentional (e.g., using an
;					  uninitialized variable and relying on the fact it's automatically
;					  initialized to an empty string)
; E_CORE_ERROR		- fatal errors that occur during PHP's initial startup
; E_CORE_WARNING	- warnings (non fatal errors) that occur during PHP's initial startup
; E_COMPILE_ERROR	- fatal compile-time errors
; E_COMPILE_WARNING	- compile-time warnings (non fatal errors)
; E_USER_ERROR		- user-generated error message
; E_USER_WARNING	- user-generated warning message
; E_USER_NOTICE		- user-generated notice message
; Examples:
; error_reporting = E_ALL & ~E_NOTICE						; show all errors, except for notices
; error_reporting = E_COMPILE_ERROR|E_ERROR|E_CORE_ERROR	; show only errors
error_reporting	=	E_ALL & ~E_NOTICE		; Show all errors except for notices
display_errors	=	On	; Print out errors (as a part of the HTML script)
log_errors		=	Off	; Log errors into a log file (server-specific log, stderr, or error_log (below))
track_errors	=	Off	; Store the last error/warning message in $php_errormsg (boolean)
;error_prepend_string = "<font color=ff0000>"   ; string to output before an error message
;error_append_string = "</font>"                ; string to output after an error message
;error_log	=	filename	; log errors to specified file
;error_log	=	syslog		; log errors to syslog (Event Log on NT, not valid in Windows 95)
warn_plus_overloading	=	Off		; warn if the + operator is used with strings


;;;;;;;;;;;;;;;;;
; Data Handling ;
;;;;;;;;;;;;;;;;;
variables_order		=	"EGPCS"	; This directive describes the order in which PHP registers
								; GET, POST, Cookie, Environment and Built-in variables (G, P,
								; C, E & S respectively, often referred to as EGPCS or GPC).
								; Registration is done from left to right, newer values override
								; older values.
register_globals	=	On		; Whether or not to register the EGPCS variables as global
								; variables.  You may want to turn this off if you don't want
								; to clutter your scripts' global scope with user data.  This makes
								; most sense when coupled with track_vars - in which case you can
								; access all of the GPC variables through the $HTTP_*_VARS[],
								; variables.
register_argc_argv	=	On		; This directive tells PHP whether to declare the argv&argc
								; variables (that would contain the GET information).  If you
								; don't use these variables, you should turn it off for
								; increased performance
track_vars			=	On		; enable the $HTTP_*_VARS[] arrays, where * is one of
								; ENV, POST, GET, COOKIE or SERVER.
gpc_order			=	"GPC"	; This directive is deprecated.  Use variables_order instead.

; Magic quotes
magic_quotes_gpc	=	On		; magic quotes for incoming GET/POST/Cookie data
magic_quotes_runtime=	Off		; magic quotes for runtime-generated data, e.g. data from SQL, from exec(), etc.
magic_quotes_sybase	=	Off		; Use Sybase-style magic quotes (escape ' with '' instead of \')

; automatically add files before or after any PHP document
auto_prepend_file	=
auto_append_file	=

; As of 4.0b4, PHP always outputs a character encoding by default in
; the Content-type: header.  To disable sending of the charset, simply
; set it to be empty.
; PHP's built-in default is text/html
default_mimetype = "text/html"
;default_charset = "iso-8859-1"

gpc_globals = On

;;;;;;;;;;;;;;;;;;;;;;;;;
; Paths and Directories ;
;;;;;;;;;;;;;;;;;;;;;;;;;
include_path	= .:/grunt_a/apache/php  ; UNIX: "/path1:/path2"  Windows: "\path1;\path2"
doc_root		=					; the root of the php pages, used only if nonempty
user_dir		=					; the directory under which php opens the script using /~username, used only if nonempty
;upload_tmp_dir	=	                ; temporary directory for HTTP uploaded files (will use system default if not specified)
upload_max_filesize = 2097152       ; 2 Meg default limit on file uploads
extension_dir	=	./				; directory in which the loadable extensions (modules) reside
enable_dl		= On				; Whether or not to enable the dl() function.
									; The dl() function does NOT properly work in multithreaded
									; servers, such as IIS or Zeus, and is automatically disabled
									; on them.


;;;;;;;;;;;;;;;;;;;;;;
; Dynamic Extensions ;
;;;;;;;;;;;;;;;;;;;;;;
; if you wish to have an extension loaded automaticly, use the
; following syntax:  extension=modulename.extension
; for example, on windows,
; extension=msql.dll
; or under UNIX,
; extension=msql.so
; Note that it should be the name of the module only, no directory information 
; needs to go here.  Specify the location of the extension with the extension_dir directive above.


;Windows Extensions
;extension=php_mysql.dll
;extension=php_nsmail.dll
;extension=php_calendar.dll
;extension=php_dbase.dll
;extension=php_filepro.dll
;extension=php_gd.dll
;extension=php_dbm.dll
;extension=php_mssql.dll
;extension=php_zlib.dll
;extension=php_filepro.dll
;extension=php_imap4r2.dll
;extension=php_ldap.dll
;extension=php_crypt.dll
;extension=php_msql2.dll
;extension=php_odbc.dll

;;;;;;;;;;;;;;;;;;;
; Module Settings ;
;;;;;;;;;;;;;;;;;;;

[Syslog]
define_syslog_variables	= Off	; Whether or not to define the various syslog variables,
								; e.g. $LOG_PID, $LOG_CRON, etc.  Turning it off is a
								; good idea performance-wise.  In runtime, you can define
								; these variables by calling define_syslog_variables()


[mail function]
SMTP			=	localhost			;for win32 only
sendmail_from	=	me@localhost.com	;for win32 only
;sendmail_path	=						;for unix only, may supply arguments as well (default is sendmail -t)

[Debugger]
debugger.host	=	localhost
debugger.port	=	7869
debugger.enabled	=	False

[Logging]
; These configuration directives are used by the example logging mechanism.
; See examples/README.logging for more explanation.
;logging.method    = db
;logging.directory = /path/to/log/directory

[SQL]
sql.safe_mode	=	Off

[ODBC]
;uodbc.default_db		=	Not yet implemented
;uodbc.default_user		=	Not yet implemented
;uodbc.default_pw		=	Not yet implemented
uodbc.allow_persistent	=	On	; allow or prevent persistent links
uodbc.check_persistent  = 	On	; check that a connection is still validbefore reuse
uodbc.max_persistent	=	-1	; maximum number of persistent links. -1 means no limit
uodbc.max_links			=	-1	; maximum number of links (persistent+non persistent). -1 means no limit
uodbc.defaultlrl	=	4096	; Handling of LONG fields. Returns number of bytes to variables, 0 means passthru
uodbc.defaultbinmode	= 	1	; Handling of binary data. 0 means passthru, 1 return as is, 2 convert to char
; See the documentation on odbc_binmode and odbc_longreadlen for an explanation of uodbc.defaultlrl
; and uodbc.defaultbinmode

[MySQL]
mysql.allow_persistent	=	On	; allow or prevent persistent link
mysql.max_persistent	=	-1	; maximum number of persistent links. -1 means no limit
mysql.max_links			=	-1	; maximum number of links (persistent+non persistent).  -1 means no limit
mysql.default_port		=		; default port number for mysql_connect().  If unset,
								; mysql_connect() will use the $MYSQL_TCP_PORT, or the mysql-tcp
								; entry in /etc/services, or the compile-time defined MYSQL_PORT
								; (in that order).  Win32 will only look at MYSQL_PORT.
mysql.default_socket	=		; default socket name for local MySQL connects.  If empty, uses the built-in
								; MySQL defaults
mysql.default_host		=		; default host for mysql_connect() (doesn't apply in safe mode)
mysql.default_user		=		; default user for mysql_connect() (doesn't apply in safe mode)
mysql.default_password	=		; default password for mysql_connect() (doesn't apply in safe mode)
								; Note that this is generally a *bad* idea to store passwords
								; in this file.  *Any* user with PHP access can run
								; 'echo cfg_get_var("mysql.default_password")' and reveal that
								; password!  And of course, any users with read access to this
								; file will be able to reveal the password as well.

[mSQL]
msql.allow_persistent	=	On	; allow or prevent persistent link
msql.max_persistent		=	-1	; maximum number of persistent links. -1 means no limit
msql.max_links			=	-1	; maximum number of links (persistent+non persistent).  -1 means no limit

[PostgresSQL]
pgsql.allow_persistent	=	On	; allow or prevent persistent link
pgsql.max_persistent	=	-1	; maximum number of persistent links. -1 means no limit
pgsql.max_links			=	-1	; maximum number of links (persistent+non persistent).  -1 means no limit

[Sybase]
sybase.allow_persistent	=	On	; allow or prevent persistent link
sybase.max_persistent	=	-1	; maximum number of persistent links. -1 means no limit
sybase.max_links		=	-1	; maximum number of links (persistent+non persistent).  -1 means no limit
;sybase.interface_file	=	"/usr/sybase/interfaces"
sybase.min_error_severity	=	10	; minimum error severity to display
sybase.min_message_severity	=	10	; minimum message severity to display
sybase.compatability_mode	= Off	; compatability mode with old versions of PHP 3.0.
									; If on, this will cause PHP to automatically assign types to results
									; according to their Sybase type, instead of treating them all as
									; strings.  This compatability mode will probably not stay around
									; forever, so try applying whatever necessary changes to your code,
									; and turn it off.

[Sybase-CT]
sybct.allow_persistent	=	On		; allow or prevent persistent link
sybct.max_persistent	=	-1		; maximum number of persistent links. -1 means no limit
sybct.max_links			=	-1		; maximum number of links (persistent+non persistent).  -1 means no limit
sybct.min_server_severity	=	10	; minimum server message severity to display
sybct.min_client_severity	=	10	; minimum client message severity to display

[bcmath]
bcmath.scale	=	0	; number of decimal digits for all bcmath functions

[browscap]
;browscap	=	extra/browscap.ini

[Informix]
ifx.default_host		=		; default host for ifx_connect() (doesn't apply in safe mode)
ifx.default_user		=		; default user for ifx_connect() (doesn't apply in safe mode)
ifx.default_password		=		; default password for ifx_connect() (doesn't apply in safe mode)
ifx.allow_persistent		=	On	; allow or prevent persistent link
ifx.max_persistent		=	-1	; maximum number of persistent links. -1 means no limit
ifx.max_links			=	-1	; maximum number of links (persistent+non persistent).  -1 means no limit
ifx.textasvarchar		=	0	; if set on, select statements return the contents of a text blob instead of it's id
ifx.byteasvarchar		=	0	; if set on, select statements return the contents of a byte blob instead of it's id
ifx.charasvarchar		=	0	; trailing blanks are stripped from fixed-length char columns. May help the life
						; of Informix SE users. 
ifx.blobinfile			=	0	; if set on, the contents of text&byte blobs are dumped to a file instead of
						; keeping them in memory
ifx.nullformat			=	0	; NULL's are returned as empty strings, unless this is set to 1. In that case,
						; NULL's are returned as string 'NULL'.

[Session]
session.save_handler      = files   ; handler used to store/retrieve data
session.save_path         = /tmp    ; argument passed to save_handler
                                    ; in the case of files, this is the
                                    ; path where data files are stored
session.use_cookies       = 1       ; whether to use cookies
session.name              = PHPSESSID  
                                    ; name of the session
                                    ; is used as cookie name
session.auto_start        = 0       ; initialize session on request startup
session.cookie_lifetime   = 0       ; lifetime in seconds of cookie
                                    ; or if 0, until browser is restarted
session.cookie_path       = /       ; the path the cookie is valid for
session.cookie_domain     =         ; the domain the cookie is valid for
session.serialize_handler = php     ; handler used to serialize data
                                    ; php is the standard serializer of PHP
session.gc_probability    = 1       ; percentual probability that the 
                                    ; 'garbage collection' process is started
                                    ; on every session initialization
session.gc_maxlifetime    = 1440    ; after this number of seconds, stored
                                    ; data will be seen as 'garbage' and
                                    ; cleaned up by the gc process
session.referer_check     = On      ; check HTTP Referer to invalidate 
                                    ; externally stored URLs containing ids
session.entropy_length    = 0       ; how many bytes to read from the file
session.entropy_file      =         ; specified here to create the session id
; session.entropy_length    = 16
; session.entropy_file      = /dev/urandom
session.cache_limiter     = nocache ; set to {nocache,private,public} to
                                    ; determine HTTP caching aspects
session.cache_expire      = 180     ; document expires after n minutes

[MSSQL]
;extension=php_mssql.dll
mssql.allow_persistent		=	On	; allow or prevent persistent link
mssql.max_persistent		=	-1	; maximum number of persistent links. -1 means no limit
mssql.max_links				=	-1	; maximum number of links (persistent+non persistent).  -1 means no limit
mssql.min_error_severity	=	10	; minimum error severity to display
mssql.min_message_severity	=	10	; minimum message severity to display
mssql.compatability_mode	= Off	; compatability mode with old versions of PHP 3.0.

[Assertion]
;assert.active				=	On	; assert(expr); active by default
;assert.warning				=	On	; issue a PHP warning for each failed assertion.
;assert.bail				=	Off	; don't bail out by default.
;assert.callback			=	0	; user-function to be called if an assertion fails.
;assert.quiet_eval			=	0	; eval the expression with current error_reporting(). set to true if you want error_reporting(0) around the eval().

; Local Variables:
; tab-width: 4
; End:


<!-- start of file aaa.php -->
<?
  if (! isset($email))
    $email = "abc";
  session_register("email");
?>
<html>
<body>
<? echo("Session id is " . session_id() . "<p>"); ?>
<a href="bbb.php">Continue</a>
</body>
</html>
<!-- end of file aaa.php -->

<!-- start of file bbb.php -->
<?
  /* session_start(); */

  session_register("email");

  if (! isset($email))
    $email = "(unset)";
?>
<html>
<body>
<?
  echo("<p>Your login is $email<p>");
  echo("Session id is " . session_id() . "<p>");
?>
</body>
</html>
<!-- end of file bbb.php -->

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2000-07-31 14:51 UTC] sas@php.net
Please refine the statement "sessions are not working." Are the sess_* files empty? If they are empty, that bug has been fixed and you can close the report. If they are not, please update this bug report with the necessary information.
 [2000-07-31 21:30 UTC] waldschrott@php.net
user feedback below:

This is an addendum to bug id 5770.  That bug report
contains my config files.

sas asked me to explain what I mean by "sessions are not
working".  What is happening is that the variable I
registered with session_register does not show up in the
next page.  My previous example .php files may not have been
the best example; here are updated versions.  Not only does
the registered variable not get passed, but the value
returned by session_id() keeps changing.  I tried it with
both IE 5.5 and with Netscape Communicator 4.7.  I also
tried it with cookies turned off in IE 5.5 and I removed all
of the cookie files from IE's cache directory; still no success.

(The sess_ files in /tmp do have data in them.)

===> start of aaa.php <===
<?
  session_start();

  if (! isset($email)) {
    $email = "abc";
    session_register("email");
  }
?>  <html>  <body> <? echo("Session id is " . session_id() .
"<p>"); ?> <a href="bbb.php">Continue</a> </body>  </html>
===> end of aaa.php <===

===> start of bbb.php <===
<?
  session_start();

  if (! isset($email))
    $email = "(unset)";
?>  <html>  <body> <?
  echo("<p>Your login is $email<p>");
  echo("Session id is " . session_id() . "<p>");
?> <a href="aaa.php">Back to aaa</a> </body> ===> end of
bbb.php <===

 [2000-08-01 08:52 UTC] stas@php.net
you probably need to turn cookies _on_, not off. Is the cookie really set?
 [2000-08-01 09:04 UTC] stas@php.net
session.referer_check should contain not "On" but substring that you want to see in the referer. 
 [2000-08-01 10:33 UTC] waldschrott@php.net
user feedback:

In my php.ini file I have

  session.referer_check = On

I'm using php4.0pl2, Solaris 2.7, gcc 2.95.2, Apache 1.3.12.

Having session.referer_check on causes sessions to break; the
registered session variables don't propogate and the session id
constantly changes.  This is between pages on the same machine and in
the same directory.  With it off then they start to work.

I was referring to the web page using the "short" domain name; e.g.,

http://socrates/testdir/aaa.php  This is an addendum to bug ID 5770.

 [2000-08-01 10:35 UTC] waldschrott@php.net
I?ll open a new documentation bug on this issue, leaving closed
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Thu Mar 28 12:01:27 2024 UTC