mirrors/php-src
0
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2024-11-23 18:04:36 +08:00
Code Issues Packages Projects Releases Wiki Activity

SameSite session cookie prop should behave like other INI settings

Browse Source 
It should warn if the INI setting is changed after headers are sent or a session is not active
This commit is contained in:
George Peter Banyard 2022-08-12 19:10:47 +01:00
parent a44fb09620
commit 66aed3a86f
2 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
UPGRADING
View File

@ -280,6 +280,11 @@ PHP 8.2 UPGRADE NOTES
- PCRE:
. NUL characters (\0) in pattern strings are now supported.
- Session:
. Trying to change the SameSite cookie INI setting while the session is
active or output has already been sent will now fail and emit a warning.
This aligns the behaviour with all other session INI settings.
- SQLite3:
. sqlite3.defensive is now PHP_INI_USER.

2
ext/session/session.c
View File

@ -784,7 +784,7 @@ PHP_INI_BEGIN()
STD_PHP_INI_ENTRY("session.cookie_domain", "", PHP_INI_ALL, OnUpdateSessionString, cookie_domain, php_ps_globals, ps_globals)
STD_PHP_INI_ENTRY("session.cookie_secure", "0", PHP_INI_ALL, OnUpdateSessionBool, cookie_secure, php_ps_globals, ps_globals)
STD_PHP_INI_ENTRY("session.cookie_httponly", "0", PHP_INI_ALL, OnUpdateSessionBool, cookie_httponly, php_ps_globals, ps_globals)
STD_PHP_INI_ENTRY("session.cookie_samesite", "", PHP_INI_ALL, OnUpdateString, cookie_samesite, php_ps_globals, ps_globals)
STD_PHP_INI_ENTRY("session.cookie_samesite", "", PHP_INI_ALL, OnUpdateSessionString, cookie_samesite, php_ps_globals, ps_globals)
STD_PHP_INI_ENTRY("session.use_cookies", "1", PHP_INI_ALL, OnUpdateSessionBool, use_cookies, php_ps_globals, ps_globals)
STD_PHP_INI_ENTRY("session.use_only_cookies", "1", PHP_INI_ALL, OnUpdateSessionBool, use_only_cookies, php_ps_globals, ps_globals)
STD_PHP_INI_ENTRY("session.use_strict_mode", "0", PHP_INI_ALL, OnUpdateSessionBool, use_strict_mode, php_ps_globals, ps_globals)