Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:102127
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmx.de designates 212.227.17.20 as permitted sender)
To: Lester Caine <lester@lsces.co.uk>, PHP internals <internals@lists.php.net>
References: <569cc0df-c629-960d-8f56-277393cabbfd@lsces.co.uk>
Message-ID: <fef4fe01-265c-b2a3-409b-2193f8a4e2fd@gmx.de>
Date: Fri, 25 May 2018 12:28:23 +0200
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101
 Thunderbird/52.8.0
MIME-Version: 1.0
In-Reply-To: <569cc0df-c629-960d-8f56-277393cabbfd@lsces.co.uk>
Content-Type: text/plain; charset=utf-8
Content-Language: de-DE
Content-Transfer-Encoding: 8bit
Subject: Re: undocumented session_name() change
From: cmbecker69@gmx.de ("Christoph M. Becker")

On 24.05.2018 at 18:16, Lester Caine wrote:

> Since Tony is blocked from this list he has posted a BC break on the
> PHP-General list ... the main jist of which is that session_name() has
> had it's DOCUMENTED functionality changed some time between 7.1.11 and
> 7.2.5

In my opinion, the documentation is somewhat ambiguous regarding the
“current session name”.  What is the name of a session that will never
be started?  Is it ini_get('session.name'), or is there simply no
session name?

> I can't see any discussion on session_name in the last two years or any
> notification of the change, so when did it happen and why. More to the
> point, why has the documentation not been amended to match the new
> functionality?

The change was triggered by <https://bugs.php.net/71038> which required
some deeper changes, which apparently caused Yasuo to have a closer look
at the code recognizing some further strange behavior, so he submitted
<https://github.com/php/php-src/pull/2167>.  There was some discussion,
but obviously nobody objected to these changes for master, so the PR has
been merged.

Apparently, this well documented change (see UPGRADING) has been
overlooked for the migration guide.

Anyhow, it seems to me that Tony makes a mountain out of a molehill.
Apparently, very few code out there is affected by this change
(otherwise there certainly would have been more bug reports or
complains), and to cite Yasuo[1]:

| Therefore, proper codes will not be affected by this change. Only bad
| codes are detected.

I agree.  Consider the code Tony has posted on php-general@[2]:

  if ($_GET['action'] == 'newsession') {
   $session_name = getNewSessionName();  // user-defined function
   session_name($session_name);
   session_regenerate_id();
   header('Location: ' ….);  // restart script to use new session name
and id
   exit;
  }

Why even call session_name($session_name) here?  To my knowledge, this
is a no-op in this case (assuming a session has already been started).

Finally, every minor or major PHP version has a pre-release phase of
roughly six month.  The relevant change has been there since
7.2.0alpha1, so everybody had ample time to check it out, and to
eventually complain before GA.

[1] <https://github.com/php/php-src/pull/2167#issue-89519969>
[2] <http://news.php.net/php.general/326472>

-- 
Christoph M. Becker