Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:77112
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.192.49 as permitted sender)
MIME-Version: 1.0
Sender: are.you.winning@gmail.com
In-Reply-To: <CAH-PCH7tDQCtmAbPNOF4ONkeSQz5wr89XJ81a0USmzCqKi=26g@mail.gmail.com>
References: <CABRjmp_2DzhrGGoknZvSZ6fM=okjz+Od+2t0TVrNarc2fRLWiA@mail.gmail.com>
	<CAHMUw2HVmJD9syo8Rbc1=bA5S3U9umS0_XHFzwzWsY9Ee7UneQ@mail.gmail.com>
	<CAL+t6cEfbd7KbB=EbhdqgLKG6tBURgj+Ls9Y62tjOHL1Y+r-SA@mail.gmail.com>
	<CAH-PCH7tDQCtmAbPNOF4ONkeSQz5wr89XJ81a0USmzCqKi=26g@mail.gmail.com>
Date: Tue, 9 Sep 2014 15:53:33 +0100
Message-ID: <CAGAGxbYuimpj+phbNXn_3e_17vpGEkes7Pn5jCh9j27uZoOT8Q@mail.gmail.com>
To: Ferenc Kovacs <tyra3l@gmail.com>
Cc: Sherif Ramadan <theanomaly.is@gmail.com>, Tjerk Meesters <tjerk.meesters@gmail.com>, 
	Florian Margaine <florian@margaine.com>, PHP Internals <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Subject: Re: [PHP-DEV] setcookie() minor BC break - fixes issue #67736
From: cw@daverandom.com (Chris Wright)

On 8 September 2014 09:09, Ferenc Kovacs <tyra3l@gmail.com> wrote:
> On Mon, Sep 8, 2014 at 9:15 AM, Sherif Ramadan <theanomaly.is@gmail.com>
> wrote:
>
>> Actually, we shouldn't be doing that all. We should simply just overwrit=
e
>> the header. It wouldn't make much sense to set two headers with the same
>> cookie name when we can just overwrite it.
>>
>>
>>
> that would be a bigger BC break, and without a warning, those people
> affected by the change will have a harder time figuring out what went wro=
ng.
> and as was discussed both in the PR and the bugreport the rfc discourages
> but doesn't prohibit this behavior, so making it impossible for the
> userland to do it would be a bit of an arbitrary restriction.
> maybe we could do something like introducing a new $overwrite =3D true op=
tion
> to the function signature, but setcookie already has 7 arguments, so
> probably isn't a great idea.

How about changing the signature of setcookie() to:

bool setcookie (
    string $name
    [, string $value
    [, int $expire =3D 0
    [, string $path
    [, string $domain
    [, int $flags =3D 0
    [, bool $httponly =3D false
]]]]]])

And creating the following constants for use as flags:

const COOKIE_SECURE =3D 1;
const COOKIE_HTTPONLY =3D 2;
const COOKIE_OVERWRITE =3D 4;

This will also be a small BC break, but would potentially be a
graceful way to trim an argument off setcookie() with minimal impact
to users, making the signature more user-friendly (IMO) and allowing
additional functionality to be added in the future by means of more
flags.

Setting the value of COOKIE_SECURE to 1 covers what I suspect will be
the most common case where the value of this argument is not a bool or
NULL, i.e. specifying 1/0 to reduce line length. If the $httponly arg
is specified and not NULL it can override the value for that element
of $flags. Passing this last argument could emit an E_DEPRECATED,
either immediately or in the future.

This is also not an ideal solution and everyone may hate it, just
throwing it out there.

Thanks, Chris

> --
> Ferenc Kov=C3=A1cs
> @Tyr43l - http://tyrael.hu