Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:73191
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.215.47 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <CAGa2bXYzEP1n0EnEgZwXy8kwH3Asnj=bMTSkrPRrkd0D2BcMMQ@mail.gmail.com>
References: <CAGa2bXYXuQ6hhbzTMne7SgErFfKfJ01w5RquAgA4GBAAzN7hAA@mail.gmail.com>
 <CAPg3XxLNF1zzKU_L8kk0cdZzDPgc7qcBh6RRWEJBHar3Dc3Niw@mail.gmail.com> <CAGa2bXYzEP1n0EnEgZwXy8kwH3Asnj=bMTSkrPRrkd0D2BcMMQ@mail.gmail.com>
Date: Sun, 16 Mar 2014 15:11:45 +0900
Message-ID: <CAGa2bXY_R6E0qd_t4DzES76LeR6XebgA-U6Rcqr0rwMR2O8OEw@mail.gmail.com>
To: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a1133e8ecd3693604f4b32f59
Subject: Re: [PHP-DEV] [VOTE] RFC: Introduce session_start() options -
 read_only, unsafe_lock, lazy_write and lazy_destroy
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

--001a1133e8ecd3693604f4b32f59
Content-Type: text/plain; charset=UTF-8

Hi all,

On Fri, Mar 7, 2014 at 5:34 AM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:

> Hi Peter,
>
> On Mon, Mar 3, 2014 at 7:56 PM, Peter Cowburn <petercowburn@gmail.com>wrote:
>
>> Is this vote still in-progress? The RFC page says yes, but the closing
>> date has long-since passed.
>
>
> Thank you for reminding.
> Proposal 1 is passed 9 vs 1.
> Proposal 2 and 3 is declined 1 vs 7 and 1 vs 6.
>
> Lazy deletion is design bug fix. This issue cannot be solved without
> delayed deletion due to technical reason of current web technology. This
> also involves session security. Current implementation allows attackers to
> exploit stolen session as long as they want also.
> I'll come back on this issue later.
>
> Thank you for voting all!
>
>
Modified patch for this RFC is here

https://github.com/yohgaki/php-src/compare/PHP-5.6-rfc-session-lock

There may be leftover still. I'll check it again later, but it's
appreciated if you find any.

Someone asked if I'm going to allow to change all of session INIs by
session_start(),
I think it's good to have.

I would like to implement this as hash of INI options and handlers like

  "option_name" => function_of_INI_modify_handler;

This way, I can iterate parameter array easily/efficiently, can change INI
values
easily/efficiently and raise appropriate errors.

Any comments for this?

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net

--001a1133e8ecd3693604f4b32f59--