Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:94368
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.220.182 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <CAEZPtU6F4qyS6tgHgy1DAiv7B+01KB3CAom64=m2jjqiN5ugGQ@mail.gmail.com>
References: <CAGa2bXaSkozJLLtycujwmHyas9TofRw5s6JzG0EQQvPyU0pxNQ@mail.gmail.com>
 <CAPwsocEffWVhzjNHVA853J+1VfmrhstZ0inihhQVHW=VfLS6Eg@mail.gmail.com>
 <CAPwsocEAvcRoH7FmKHh+eUMd=044Jm8DfwyM_Mb22W4UPvXE=w@mail.gmail.com>
 <CAGa2bXbUMO-8AYfS7-yryboq69Vn5uzZMTqNOJHrkNcuZ+P45A@mail.gmail.com> <CAEZPtU6F4qyS6tgHgy1DAiv7B+01KB3CAom64=m2jjqiN5ugGQ@mail.gmail.com>
Date: Mon, 4 Jul 2016 12:03:45 +0900
Message-ID: <CAGa2bXa_YYxVRfva52DyaMwaKJT2rNJUR71OfuZdZAZHSfDpaA@mail.gmail.com>
To: Pierre Joye <pierre.php@gmail.com>
Cc: PHP internals <internals@lists.php.net>, Leigh <leight@gmail.com>
Content-Type: text/plain; charset=UTF-8
Subject: Re: [PHP-DEV] [RFC][VOTE] Session ID without hashing
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

Hi Pierre,

On Sun, Jul 3, 2016 at 2:16 PM, Pierre Joye <pierre.php@gmail.com> wrote:
>
> On Jul 3, 2016 7:04 AM, "Yasuo Ohgaki" <yohgaki@ohgaki.net> wrote:
>>
>> Hi Leigh,
>>
>> On Sat, Jul 2, 2016 at 5:39 PM, Leigh <leight@gmail.com> wrote:
>> >  So I have a few issues that span the RFC and the implementation.
>> >
>> > Your RFC states
>> >
>> >> hardcoded default and php.ini-* default values are the same.
>> >
>> > This is not the case.
>> >
>> > Originally the session id length and character set were controlled by
>> > session.hash_function and/or session.hash_bits_per_character. These
>> > customisations to configuration will be lost when the user upgrades. You
>> > have provided a mechanism to control length and charset, but it will
>> > require
>> > new changes to the default settings. This needs to be noted as a
>> > breaking
>> > change.
>> >
>> > Your default for session.sid_length is 48. Up to 7.1 the session id
>> > length
>> > is 32. Your default for session.sid_bits_per_character is 5, up to 7.1
>> > the
>> > session id uses 4 bits per character. This is a breaking change.
>> > (Imagine
>> > custom session handlers that validate session id character sets, or
>> > database
>> > schemas that will truncate after 32 characters)
>>
>> I'll update relevant part.
>>
>> > Your patch updates session.use_strict_mode from 0 to 1. I actually don't
>> > know what this changes, but it's an undocumented change.
>>
>> This is unintentional. I'll remove this part.
>>
>> > Overall your patch looks very similar to the one I was working on
>> > earlier in
>> > the year, although you appear to have deleted a bunch of tests that you
>> > could have just updated. You should probably put those back, and update
>> > them.
>>
>> It removes hashing, so irrelevant tests are simply removed.
>>
>> Thank you for point them out.
>> I'll fix them now.
>
> Restart vote too please.

Sure.

I extended vote period. Fix for RFC and patch is done.
Please vote.

https://wiki.php.net/rfc/session-id-without-hashing

Thank you!

--
Yasuo Ohgaki
yohgaki@ohgaki.net