Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:73428
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain devilix.net designates 209.85.213.50 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAMUwpuQePpm3FLY27ptvPyBU=kndK805D8sRr5N3GSoTQiiGxw@mail.gmail.com>
References: <CAMUwpuSVE4iMA86bxXUnvYLonJ3xmDZ_QSzM38eNvJibxcv6Xw@mail.gmail.com>
	<CAGa2bXYO6s6sQo0UkuRSaSciU1XVCHhWqc5MHCDL1H15ChZ65Q@mail.gmail.com>
	<CAMUwpuQePpm3FLY27ptvPyBU=kndK805D8sRr5N3GSoTQiiGxw@mail.gmail.com>
Date: Tue, 25 Mar 2014 18:06:29 +0200
Message-ID: <CAPhkiZy=y7AAfwtNPgPgfEWvLyv+aOnU=Yi_XKTYsszB7dS74g@mail.gmail.com>
To: Julien Pauli <jpauli@php.net>
Cc: Yasuo Ohgaki <yohgaki@ohgaki.net>, PHP Internals <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Subject: Re: session_reset() and session_abort() to send errors
From: narf@devilix.net (Andrey Andreev)

Hi,

I had previously requested the removal of these 2 functions based on
lack of discussion about them (or at least I found none). My request
was ignored because I had to tell "why it's not needed", which I don't
think is the right approach for a new feature that somebody just
decided to commit, but regardless ... here's a good reason:

From what I understand, session_reset() not only discards changes to
$_SESSION and not just re-reads the data, but re-initializes the whole
session. This includes calls to open(), read(), which include opening
file pointers, setting locks, checking session ID validity, etc. I
don't know how safe that is to do internally, but with a userland
session handler, it means discarding previously open connections/file
pointers, locks and whoever knows what else a developer might've
cached, assuming that open(), read() would only be called once.
It would've also been better IMO if the function was called
session_restart() instead, because of the above-described behavior.

I also don't like that these 2 functions kind of make sessions to look
like a traditional database transaction, or at least I'd hate it to
see code that uses them for the wrong purpose, but that's rather
philosophical ... I do see them as useful for resetting the
application to a certain state in case of an error, but in that
context - session_abort() alone should be sufficient.

Cheers,
Andrey.