Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:90651
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.160.172 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <CAGa2bXZNjehZ3iY+Zi+Di1qR1a_kgizRZT2SugHWNPk+RNfe-w@mail.gmail.com>
References: <CAGa2bXZzvkBDkqLF2U3yPSprQwqBdHbW9QCZ-nzjA1G4CM8QkQ@mail.gmail.com>
 <56958637.5080807@gmail.com> <CAMUwpuRJmVsHCW9VsMTsSgDcAcc1WPjmCHDcwkboN92oL1Q5CQ@mail.gmail.com>
 <CAGa2bXbeNGeUYR0dYuXiaS6siPWTT7fvTHaG6Z8Ho5shw-Y3YQ@mail.gmail.com>
 <5697F7E0.8010803@gmail.com> <CAGa2bXZNjehZ3iY+Zi+Di1qR1a_kgizRZT2SugHWNPk+RNfe-w@mail.gmail.com>
Date: Fri, 15 Jan 2016 09:32:01 +0900
Message-ID: <CAGa2bXbk=xQUDvjJ1oyXLmjQNYy_fw_rEUpLGDSsjkOWE051zw@mail.gmail.com>
To: Stanislav Malyshev <smalyshev@gmail.com>
Cc: Julien Pauli <jpauli@php.net>, "internals@lists.php.net" <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Subject: Re: [PHP-DEV] Fixing bug #68063
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

Hi Julien,

On Fri, Jan 15, 2016 at 9:10 AM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:
>
> On Fri, Jan 15, 2016 at 4:32 AM, Stanislav Malyshev <smalyshev@gmail.com> wrote:
>>
>>> However, previous my fix (Raise warning and return false) was wrong fix.
>>> Therefore, I would like to correct (Provide new session ID and continue)
>>> it in 5.5 also. Does this make sense?
>>
>> Yes, but nit sure if it's for 5.5. It's for Julian to decide,
>> ultimately, but it doesn't look like 5.5 has a security issue right now
>> with it? Or am I wrong?
>
> No. It does not have security bug, but has wrong fix for the security bug.

I'll commit the fix from PHP 5.6. If you think this should be included for
PHP 5.5, please cherry pick.  I prefer to have this in PHP 5.5, but it's
not mandatory.

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net