Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:94409
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmx.de designates 212.227.15.19 as permitted sender)
To: Yasuo Ohgaki <yohgaki@php.net>
References: <CAGa2bXaSkozJLLtycujwmHyas9TofRw5s6JzG0EQQvPyU0pxNQ@mail.gmail.com>
 <CAGa2bXZ=DiqQ4PozYntvGApZHdkjWyTBQhk_Udy5Y3_m0ry9Lw@mail.gmail.com>
 <a32232d3-006b-a7c2-0aa8-7f44509dfe69@gmail.com>
 <CAGa2bXa3o4FzQDGyU+=XHWoH59QjTJdJcjwch4=VdUUC7ZsD=w@mail.gmail.com>
 <CAEZPtU5RRGbUXJE7cHd2LuUmF5hiGDJAhGNKZ+_nRj1d+pHkZA@mail.gmail.com>
 <CAPwsocHU4Dc5YLMq_vfJsvXQseH7es4baMh-_pNJFf7aB3bKyg@mail.gmail.com>
 <e7188936-2ef1-15b0-d5e0-15c16b2c4f73@gmx.de>
 <CAGa2bXbWT507Pv85TPB9+Cnd1_z3ynKiZZ+Zrdu6Ocvm_WD4VQ@mail.gmail.com>
 <9e874892-d682-1c0d-77ad-21d5b44ce25b@gmx.de>
 <CAGa2bXZ1_nkgh44s3hd-j4e-7dcL6=RPUVigte06W5DWu0ddbQ@mail.gmail.com>
Cc: Leigh <leight@gmail.com>, Pierre Joye <pierre.php@gmail.com>,
 Dan Ackroyd <danack@php.net>, PHP internals <internals@lists.php.net>,
 Stanislav Malyshev <smalyshev@gmail.com>
Message-ID: <54093194-3164-2b79-579a-df30d0c411ab@gmx.de>
Date: Thu, 7 Jul 2016 14:13:00 +0200
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101
 Thunderbird/45.1.1
MIME-Version: 1.0
In-Reply-To: <CAGa2bXZ1_nkgh44s3hd-j4e-7dcL6=RPUVigte06W5DWu0ddbQ@mail.gmail.com>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] Re: [RFC][VOTE] Session ID without hashing
From: cmbecker69@gmx.de (Christoph Becker)

On 06.07.2016 at 23:30, Yasuo Ohgaki wrote:
>
> On Wed, Jul 6, 2016 at 9:10 PM, Christoph Becker <cmbecker69@gmx.de> wrote:
>>
>> Yes, I am aware that the patch uses php_random_bytes(), but what happens
>> when it fails, in which case php_session_create_id() returns null[1]?
>> Would it be impossible to use a session in this case?
> 
> php_session_create_id() may return NULL. It's an usual error. Session
> module supports session ID creation save handler which may return
> anything valid for the type.
> 
> Session module tries to call php_session_create_id() several
> places/times. If it could not get valid one, it raises
> E_RECOVERABLE_ERROR or E_ERROR eventually.
> 
> Although it's not enabled yet, PHP_FUNCTION(session_create_id) returns
> FALSE it fails.

Thanks for the explanation, Yasuo.  AIUI, the old session module would
not fail on such (most likely rare) occasions, however.  If that is so,
I suggest to note that in the "Backward Incompatible Changes" section of
the RFC (so that it would be noted in UPGRADING and the migration guide).

-- 
Christoph M. Becker