Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:90942
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 74.125.82.44 as permitted sender)
MIME-Version: 1.0
Sender: tyra3l@gmail.com
In-Reply-To: <CAEZPtU4v1Qm2AzBZcjbMdpgwRh+2o6ZqcV5yT-ov+QkFEH8j_g@mail.gmail.com>
References: <03a501d15439$fcbf9ca0$f63ed5e0$@php.net>
	<56A1054A.5080102@fedoraproject.org>
	<CAGa2bXbavNd3H3+c_ASOBH6O6LoaBsj52pxPZmjTKZyssup7gw@mail.gmail.com>
	<CAEZPtU4v1Qm2AzBZcjbMdpgwRh+2o6ZqcV5yT-ov+QkFEH8j_g@mail.gmail.com>
Date: Tue, 26 Jan 2016 19:35:50 +0100
Message-ID: <CAH-PCH4msLtH4CM57HQzfoCsWCoDirfO2XZ2v=prym8UAY+rGQ@mail.gmail.com>
To: Pierre Joye <pierre.php@gmail.com>
Cc: Yasuo Ohgaki <yohgaki@ohgaki.net>, PHP internals <internals@lists.php.net>, 
	julien pauli <jpauli@php.net>, Remi Collet <remi@fedoraproject.org>
Content-Type: multipart/alternative; boundary=047d7b5d2d286d7492052a40f424
Subject: Re: [PHP-DEV] PHP 7.0.3 RC1 is available for testing - **** BC break ***
From: tyrael@php.net (Ferenc Kovacs)

--047d7b5d2d286d7492052a40f424
Content-Type: text/plain; charset=UTF-8

>
>
> > This is added because when session cannot be started, then it should
> fail.
> > This fix is related to https://bugs.php.net/bug.php?id=71243
> > The php_session_abort() is not directly related to this bug, but this
> (and
> > other fixes) is added because session_start() returns TRUE even when it
> fails/
> > should fail.
> >
> > Note: PHP 5.6's session_start() return value fix is not perfect to keep
> > save handler compatibility which is a big one. PHP7 should return FALSE
> > for session_start() failures always by the fix.
> >
> > Fixing the broken test should be just removing the php_session_abort()
> from
> > php_session_cache_limiter().
>
> Fixing broken tests most likely mean BC will remain which is not so good.
>
you probably meant BC *break* will remain which I agree that isn't good.


> I understand the overall goal to improve session security but this is an
> area that has behaved this way for years. I am totally convinced that such
> big changes should have (or should) in stable branches, be 7.0 or 5.6.
> Especially because testing these changes take time.
>
I have to look through the changes and the original bugreport which
warranted this change but my gut feeling is that this shouldn't be changed
in a micro version and Yasuo even changed/fixed a handful of tests together
of the code changes, so the potential impact could be even bigger than what
Remi spotted with their CI pipeline.

--047d7b5d2d286d7492052a40f424--