Commit Graph

152 Commits

Author SHA1 Message Date
foobar
5bd93221a8 bump year and license version 2006-01-01 12:51:34 +00:00
foobar
23e671a51e - Bumber up year 2005-08-03 14:08:58 +00:00
foobar
3ca8ad73a4 - Missing $Id$ tags 2005-02-13 17:54:04 +00:00
foobar
7281cd8082 MFB_4_3: cvs diff -r1.84.2.5 -r1.84.2.6 php_session.h 2005-02-13 07:55:27 +00:00
foobar
6a1d0114a7 Silence some compile warnings 2004-01-23 03:28:59 +00:00
Wez Furlong
6ac364048b export tsrm id for session globals. 2004-01-09 15:30:07 +00:00
foobar
ccfc46b0aa - Happy new year and PHP 5 for rest of the files too..
# Should the LICENSE and Zend/LICENSE dates be updated too?
2004-01-08 17:33:29 +00:00
Wez Furlong
30b631d9f6 Export this so that shared session modules can use it under win32. 2003-12-02 23:14:31 +00:00
James Cox
f68c7ff249 updating license information in the headers. 2003-06-10 20:04:29 +00:00
Sascha Schumann
ed68ca44ec Fix types of bug_compat entries
PR: #21312
Submitted by: Rob Richards <rrichards@ctindustries.net>
2003-05-10 16:49:21 +00:00
Sascha Schumann
4226fe67d1 dividend -> divisor
Submitted by: Jesus M. Castagnetto <jmcastagnetto@yahoo.com>
2003-04-05 11:22:15 +00:00
Sascha Schumann
4ec77cfbb5 Refactor new-session-id code 2003-02-18 19:29:38 +00:00
Sascha Schumann
2699c26f42 Remember whether to send a cookie, so that we send out the correct
session id.  Also improve check for active session
2003-02-18 19:13:49 +00:00
Sascha Schumann
32e0c8161c add session_regenerate_id() 2003-02-18 18:50:44 +00:00
Sascha Schumann
5e601732a3 use appropiate prefixes in the ps_module structure so we don't clash
with syscalls
2003-02-11 00:42:14 +00:00
Sascha Schumann
db8b4c6762 Add INI setting session.hash_bits_per_character which enables developers
to choose how session ids are represented, regardless of the hash algorithm.
2003-01-16 07:21:49 +00:00
Sascha Schumann
f2f1f94e36 add INI setting session.hash_function
add support for creating session ids using SHA-1
source more entropy for session ids
2003-01-12 13:07:14 +00:00
Sebastian Bergmann
b506f5c8f8 Bump year. 2002-12-31 16:08:15 +00:00
Sascha Schumann
13f5db1b67 Make the interpretation of gc_probability configurable by adding
session.gc_dividend. The probability of running gc on each request is then
gc_probability/gc_dividend.
2002-10-03 06:45:15 +00:00
Sascha Schumann
b9077e5a9d Nuke PS(vars), we keep the state of registered session variables now
completely in PS(http_session_vars). This avoids bugs which are caused
by a lack of synchronization between the two hashes. We also don't need
to worry about prioritizing one of them.

Add session.bug_compat_42 and session.bug_compat_warn which are enabled
by default. The logic behind bug_compat_42:

IF bug_compat_42 is on, and
IF register_globals is off, and
IF any value of $_SESSION["key"] is NULL, and
IF there is a global variable $key, then
$_SESSION["key"] is set to $key.

The extension emits this warning once per script, unless told otherwise.

"Your script possibly relies on a session side-effect which existed until
PHP 4.2.3. Please be advised that the session extension does not consider
global variables as a source of data, unless register_globals is enabled.
You can disable this functionality and this warning by setting
session.bug_compat_42 or session.bug_compat_warn.
2002-10-03 03:23:02 +00:00
Sascha Schumann
856cd5e17a The session extension ensures now that get_session_var can rely
on the state of $_SESSION/$HTTP_SESSION_VARS. It does not look up
symbols in the global symbol table anymore.

This was achieved by actually planting references between every
$_SESSION["x"] and $x, not only when restoring a session, but also
when registering a session variable (in a register_globals=1 context).

Upon registering a new variable, this memory leak continues to show
up, regardless of register_globals.

ext/session/session.c(272) :  Freeing 0x0818F01C (12 bytes), script=test

Obviously, the newly allocated empty zval is not properly freed.  If anyone
has any idea on how to fix that, please step forward.
2002-10-01 11:59:45 +00:00
Zeev Suraski
900651b7ab Make unset($_SESSION['foo']) actually remove the variable from the session,
if register_globals is off.
2002-08-15 21:44:44 +00:00
Sascha Schumann
dcf67c4433 This option enables administrators to make their users invulnerable to
attacks which involve passing session ids in URLs.
2002-06-12 08:18:36 +00:00
Thies C. Arntzen
23251ebd1a re-add accidentily nuked session_adapt_url() 2002-05-05 16:39:49 +00:00
Thies C. Arntzen
9712a4b3c8 @ - Added output_add_rewrite_var() and output_remove_rewrite_var() to inject
@   and remove variables from the URL-Rewriter. (thies)
i have also modified the session module to use this - so it doesn't
need to fiddle with the output-system any more
2002-05-03 08:00:41 +00:00
Thies C. Arntzen
42158ef7c8 revert session_set_userdata - diffent patch will come shortly 2002-04-28 11:45:45 +00:00
Thies C. Arntzen
eb105693b8 @ - added session_set_userdata() which enables you to specify one variable
@   that will be kept in the browser in addition to the session-id. This
@   only works when using trans-sid sessions (no cookie). (thies)
2002-04-27 14:07:52 +00:00
Sascha Schumann
3a3acee3c9 - Proper use of underscores (s/createsid/create_sid/)
- Bump the API date and remove extra cpp macro
- Pass TSRMLS appropiately to the create_sid function
2002-03-30 16:29:15 +00:00
Mark L. Woodward
346d74a146 Added field to ps_module structure to hold function pointer for the creation
of the session ID string. Default PS_MOD() macro sets this to be the default
creation routine. PS_MOD_SID() macro sets this to a handlers session ID
creation routine.
2002-03-29 16:00:27 +00:00
Sascha Schumann
8141c7761c Merge in session API changes (carry around tsrm context)
Now PHP_SESSION_API is defined to the date of the last change,
so that externa source-code can handle changes more gracefully.
2002-03-06 11:49:51 +00:00
Sascha Schumann
ca59cb7cf9 Weep out all recent commits of Yasuo.
I don't have time right now to leave in the good ones and remove
only the bad ones.

There are some semantical changes which I reject, because
they aim at fixing a bug which is at a completely other location.

Then SID does not gefined anymore properly. (This broken patch
has not been sent to me at all.)

Also, there were *so* many whitespace changes which already
make these commits bogus.
2002-03-06 09:02:31 +00:00
Yasuo Ohgaki
782462a4ca More TSRM work 2002-03-06 00:12:48 +00:00
Sebastian Bergmann
90613d2282 Maintain headers. 2002-02-28 08:29:35 +00:00
Sterling Hughes
ed6d751cd9 move to the ZEND_DECLARE_MODULE_GLOBALS() and ZEND_EXTERN_MODULE_GLOBALS
macros
2002-02-07 22:00:21 +00:00
foobar
86f123ba2e Export php_session_start(). 2002-02-05 01:28:55 +00:00
Yasuo Ohgaki
847fd9d595 Export php_session_register_module/serializer. 2002-01-16 04:56:35 +00:00
Sebastian Bergmann
38933514e1 Update headers. 2001-12-11 15:32:16 +00:00
Zeev Suraski
a702dc02f9 Fix session_unregister() 2001-12-06 14:20:20 +00:00
Zeev Suraski
2258453ba3 Remove PS_DEL_VAR macro, always use PS_DEL_VARL() 2001-12-06 13:33:10 +00:00
Doug MacEachern
8dd296dd7d AIX compiler doesn't like having a comma at the end of the enum
(Ryan Bloom <rbb@apache.org>)
2001-11-18 20:08:43 +00:00
Sascha Schumann
f341f630d3 Rewrite of unserializer which should be more maintainable and extensible.
Changes pass `make test´ and a couple of custom tests.

Enjoy.
2001-11-10 21:18:34 +00:00
Andrei Zmievski
adc9e9b587 Fix build. 2001-10-22 16:25:43 +00:00
Sterling Hughes
e302d6a5e8 Add an API function for setting the session id from a session module...
# The SRM folks wanted/needed this
2001-09-11 10:13:44 +00:00
Zeev Suraski
f7e7b42d4b Restore session_adapt_url() 2001-08-31 20:03:09 +00:00
Zeev Suraski
b080ddb867 Cleanup and clarify 2001-08-31 19:26:12 +00:00
Zeev Suraski
b781720b36 More fixes and refinements 2001-08-27 00:23:55 +00:00
Zeev Suraski
dc9769ea96 Fix trans-sid.
Still need to figure out how to turn trans-sid only when sessions
are actually used.
2001-08-26 11:14:35 +00:00
Zeev Suraski
7b73aee40f Make the session module more independent 2001-08-26 01:09:20 +00:00
Zeev Suraski
b8763a6f8c Get rid of TRANS_SID - it's always possible to use it now. 2001-08-25 16:09:23 +00:00
Zeev Suraski
13ff183225 Move the trans-sid mechanism to use the output buffering mechanism.
Advantages:
- Would work with the output buffering mechanism in general, and with
  output compression in particular
- Should yield better performance (untested as of yet)
2001-08-25 15:57:42 +00:00
Zeev Suraski
bc596544a1 add struct name 2001-08-25 12:47:12 +00:00
Zeev Suraski
e140b35b04 API update 2001-08-21 12:57:53 +00:00
Sascha Schumann
373b3e101e more tsrm cleanup -- output.c is not doing any fetches anymore 2001-08-05 15:55:43 +00:00
Sascha Schumann
8aef193056 more tsrm cleanup 2001-08-05 15:29:47 +00:00
Sascha Schumann
aafdfe82cb further tsrm cleanup 2001-08-05 14:36:51 +00:00
Zeev Suraski
d87cc976e1 Redesigned thread safety mechanism - nua nua 2001-07-28 11:36:37 +00:00
Zeev Suraski
fe6f8712a4 - Get rid of ELS_*(), and use TSRMLS_*() instead.
- Move to the new ts_allocate_id() API
This patch is *bound* to break some files, as I must have had typos somewhere.
If you use any uncommon extension, please try to build it...
2001-07-27 10:16:41 +00:00
Hartmut Holzgraefe
e15d0193d9 cleanup in preparation for session_readonly() 2001-07-11 13:27:27 +00:00
Sascha Schumann
ef13ab5750 Improve url scanner speed (up to 40% for large chunks of data)
and handle some corner cases better.  The scanner has been changed
to the format as proposed in "RE2C - A More Versatile Scanner Generator"
by Cowan et al.
2001-07-04 15:30:21 +00:00
Thies C. Arntzen
bd4f32cf12 - fixed the reference in session thingie
- regression test checked (this time;-)
- added new regression test for references
- references _between_ session variables also work in when the session var
  replaces an already existing global var (this was a brain twister)
- saved one strlen call per session variable
- fixed one tiny leak
2001-06-21 18:46:26 +00:00
Sebastian Bergmann
3f4a4a3643 Change copyright note. 2001-06-19 21:14:39 +00:00
Sascha Schumann
060983b184 Use zend_hash_add_empty_element 2001-05-19 14:51:39 +00:00
Sascha Schumann
9de9b7c1e9 add an interface for registering storage modules at run-time. 2001-05-03 15:48:49 +00:00
Andrei Zmievski
ea56318495 Patch from Sascha that abstracts session serializers. WDDX extension
now implements the encode/decode functions and registers them with
the session module.
2001-05-01 17:01:51 +00:00
Stanislav Malyshev
06de8e78cf Allow to send secure cookies 2000-10-28 17:13:28 +00:00
Sascha Schumann
4f757a3af0 Add session_adapt_url(). 2000-10-26 18:10:43 +00:00
Sascha Schumann
d2d5320ee8 Add session_write_close(). This is primarily intended to enable
script writers to release the lock associated with the session lock
before the request finishes.

You can pass arrays now to session_set_save_handler(), so that the handlers
can be located in an object for better abstraction.
2000-10-11 19:47:15 +00:00
Sascha Schumann
5bbddee81e Rename symbols whose first character was an underscore. 2000-09-06 14:16:12 +00:00
Sascha Schumann
607486391a Extend HTTP headers for private-caching and add a new PHP function
session_cache_limiter.

Submitted by: Jon Parise <jon@csh.rit.edu>
2000-09-01 15:56:26 +00:00
Sascha Schumann
e8101d4f7b Unify use of my email address 2000-07-10 10:09:15 +00:00
Zeev Suraski
9bfd5e5e55 Save more overhead. Look for the serializer/save_handler only when they're actually modified. 2000-05-26 13:02:11 +00:00
Zeev Suraski
fb69f854af Use the INI framework in the session module 2000-05-26 11:12:49 +00:00
Sterling Hughes
149e6181e5 @-added session_get_cookie_params (sterling) 2000-03-30 18:50:09 +00:00
Sascha Schumann
f50de70308 GC now prints out how many session objects were removed 2000-03-29 20:37:29 +00:00
Andrei Zmievski
ac7d60ecec Changed HTTP_STATE_VARS to HTTP_SESSION_VARS.
@ Changed $HTTP_STATE_VARS to $HTTP_SESSION_VARS. Use only the latter
@ version now! (Andrei)
2000-03-13 15:49:13 +00:00
Andrei Zmievski
c77aa759ea Implemented setting of session cookie parameters.
@ Added session_set_cookie_params() function. (Andrei)
2000-02-04 23:34:24 +00:00
Thies C. Arntzen
64c6e1e90e sessions are now written via a _php_session_shutdown which is registered
via php_register_pre_request_shutdown().
2000-01-15 13:09:32 +00:00
Zeev Suraski
972631be71 - Added flush() support to SAPI
- Got rid of the old flush() implemenetation in favour of the new one
- Added implicit_flush() support to the output buffering layer.
@- Added implicit_flush() to control whether flush() should be called
@  implicitly after any output (Zeev)
2000-01-13 17:37:25 +00:00
Sascha Schumann
996216b499 Add cache_limiter and cache_expire options. Rename extern_referer_check
to referer_check.
1999-12-12 14:16:55 +00:00
Stig Bakken
ae1b7bf4b8 @Fix warnings compiling in maintainer mode. (Stig)
Fix warnings compiling in maintainer mode.
Install DB/common.php and DB/mysql.php on "make install".
# We still have a warning from http_config.h:97.  Rasmus? :-)
1999-12-05 10:29:06 +00:00
Andrei Zmievski
20190c966d Session variables now obey track_vars and gpc_globals settings.
If track_vars is on then decoded variables appear in $HTTP_STATE_VARS
array. If gpc_globals is on, then session vars are decoded into global
variables. If both are on, then globals and $HTTP_STATE_VARS contents
are references to each other.

The /decoder functions now just need to call php_set_session_var()
this behavior.

@ -Session vars are now decoded into $HTTP_STATE_VARS[] array and the
@ globals, depending on track_vars and gpc_globals settings (Andrei)

# Encoding source is currently only globals. We may want to change this
# in the future.
1999-12-04 17:02:04 +00:00
Sascha Schumann
6a30ec5343 Change session.lifetime to session.cookie_lifetime. And:
@ - Added session.cookie_path and session.cookie_domain (Sascha)
1999-10-31 13:26:40 +00:00
Sascha Schumann
23882d31c4 Add session.use_cookies option 1999-10-22 08:10:08 +00:00
Sascha Schumann
55272d3df8 add user-level callbacks 1999-09-17 05:40:59 +00:00
Sascha Schumann
fa0f9ed367 wddx decode works as well 1999-09-16 12:55:31 +00:00
Sascha Schumann
a597f24b5e wddx serialization works now 1999-09-16 12:00:58 +00:00
Sascha Schumann
276c815f04 update macro 1999-09-12 00:31:23 +00:00
Sascha Schumann
f040ce584d add transparent session id propagation
this uses a custom scanner which detects relative URIs and changes
  them appropiately.
  must be explicitly enabled with --enable-trans-sid
  (normal case is not affected, since session_adapt_uris defaults to
   void statement. Compiler should eliminate dead code in output.c then.)
1999-09-11 23:47:16 +00:00
Andrey Hristov
9706aa1daa - Added session_unset() function
- Fixed double session globals shutdown crash
- Added warning when session_destroy() is called without session_start()
1999-09-11 22:31:04 +00:00
Sascha Schumann
533ef3988b - support for external entropy sources
- extern_referer_chk => extern_referer_check
- kill a warning in mod_files.c
1999-09-11 17:20:31 +00:00
Sascha Schumann
c49cdc9a64 remove superflicious enumaration 1999-09-04 08:21:36 +00:00
Sascha Schumann
49824ee8cb - fix potential buffer problem in send_cookie
- fix gc probability algorithm
- don't access mod_data directly
- initial version of mm support for session data storage

  This works pretty good, but we need to create the initial mm pool
  from the parent process/thread. Still looking for a clean way to do that.
1999-08-27 21:03:22 +00:00
Sascha Schumann
070dfe0833 - add session.extern_referer_chk
- use combined lcg in session id creation
1999-08-21 20:48:40 +00:00
Sascha Schumann
2a39219142 we don't need php_sid 1999-07-15 19:51:13 +00:00
Sascha Schumann
68de8a2842 that should be included 1st 1999-07-15 19:31:39 +00:00
Sascha Schumann
1f02914005 implement a simple API in the case someone wants to define his/her own serialization stuff 1999-07-01 05:45:48 +00:00
Andrey Hristov
88ed2002da Added session expiration. 1999-06-29 15:39:59 +00:00
Andrey Hristov
a6aacfd2b6 Added session_is_registered(varname) function. 1999-06-28 15:46:56 +00:00
Zeev Suraski
1798a0183a * Fix a buglet in the session module
* Make some renames in the session module - avoid having a function called 'delete'
  so that we don't piss any C++ compilers.  Also rename the {startup,shutdown}_globals
  to {startup,shutdown}_session_globals, so that they're a bit less general names,
  and made them static.
* Remove uselss variables
1999-06-11 09:23:00 +00:00
Sascha Schumann
d8a9548cb2 - some cleanups
- add gc logic
- add session_destroy()
1999-06-07 16:43:24 +00:00