Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:69801
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 74.125.82.181 as permitted sender)
Message-ID: <5267B921.7010501@gmail.com>
Date: Wed, 23 Oct 2013 12:55:13 +0100
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:24.0) Gecko/20100101 Thunderbird/24.0.1
MIME-Version: 1.0
To: internals@lists.php.net
References: <CAGa2bXbNFb0tV+Xqavz9m62RDxobey3BmyN0L7g9ATFxMS_KBA@mail.gmail.com> <CAH-PCH7TbexgCAVphaC_H8AF-V5UfNysy863Gq1sOzkxgQ01XA@mail.gmail.com>
In-Reply-To: <CAH-PCH7TbexgCAVphaC_H8AF-V5UfNysy863Gq1sOzkxgQ01XA@mail.gmail.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] session_regenerate_id(true) by default
From: rowan.collins@gmail.com (Rowan Collins)

Ferenc Kovacs wrote (on 22/10/2013):
> On Tue, Oct 22, 2013 at 8:53 AM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:
>
>> Hi all,
>>
>> Without 'true', session_regenerate_id() will not delete old session data
>> which may contain sensitive data. It was made to 'false' by default for
>> users relying on the bug. (PHP 4.x, IIRC)
>>
>> Almost all users should call session_regenerate_id() with 'true' parameter.
>> Therefore, I would like to suggest make it 'true' by default from next PHP.
>>
>> Any comments?
>>
>> --
>> Yasuo Ohgaki
>> yohgaki@ohgaki.net
>>
>
> We could we add an E_DEPRECATED for the session_regenerate_id(false) usage
> for 5.6 instead.
>

Presumably what we want to deprecate is not the *ability* to pass false, 
but the *default* of false.

So raise an E_DEPRECATED if you don't pass the parameter, and document 
that passing true will normally be the desired behaviour. Then in some 
future major version, remove the default value, making it an E_ERROR or 
whatever to omit it.

-- 
Rowan Collins
[IMSoP]