From 0945d2753aee346c14c2581b134ac46f6753a299 Mon Sep 17 00:00:00 2001 From: Jorg Sowa Date: Thu, 21 May 2026 22:44:33 +0200 Subject: [PATCH 1/5] fix: prevent creation of fixed sid --- ext/session/session.c | 8 ++-- .../rfc1867_sid_post_use_only_cookies.phpt | 44 +++++++++++++++++++ 2 files changed, 48 insertions(+), 4 deletions(-) create mode 100644 ext/session/tests/rfc1867_sid_post_use_only_cookies.phpt diff --git a/ext/session/session.c b/ext/session/session.c index a9838cafe666..b41bb6674968 100644 --- a/ext/session/session.c +++ b/ext/session/session.c @@ -1679,8 +1679,8 @@ PHPAPI zend_result php_session_start(void) /* {{{ */ * Cookies are preferred, because initially cookie and get * variables will be available. * URL/POST session ID may be used when use_only_cookies=Off. - * session.use_strice_mode=On prevents session adoption. - * Session based file upload progress uses non-cookie ID. + * session.use_strict_mode=On prevents session adoption. + * Session based file upload progress respects use_only_cookies. */ if (!PS(id)) { @@ -3247,7 +3247,7 @@ static zend_result php_session_rfc1867_callback(unsigned int event, void *event_ multipart_event_start *data = (multipart_event_start *) event_data; progress = ecalloc(1, sizeof(php_session_rfc1867_progress)); progress->content_length = data->content_length; - progress->sname_len = strlen(PS(session_name)); + progress->sname_len = strlen(PS(session_name)); PS(rfc1867_progress) = progress; } break; @@ -3269,7 +3269,7 @@ static zend_result php_session_rfc1867_callback(unsigned int event, void *event_ if (data->name && data->value && value_len) { size_t name_len = strlen(data->name); - if (name_len == progress->sname_len && memcmp(data->name, PS(session_name), name_len) == 0) { + if (!PS(use_only_cookies) && name_len == progress->sname_len && memcmp(data->name, PS(session_name), name_len) == 0) { zval_ptr_dtor(&progress->sid); ZVAL_STRINGL(&progress->sid, (*data->value), value_len); } else if (name_len == strlen(PS(rfc1867_name)) && memcmp(data->name, PS(rfc1867_name), name_len + 1) == 0) { diff --git a/ext/session/tests/rfc1867_sid_post_use_only_cookies.phpt b/ext/session/tests/rfc1867_sid_post_use_only_cookies.phpt new file mode 100644 index 000000000000..4cdbaae905c3 --- /dev/null +++ b/ext/session/tests/rfc1867_sid_post_use_only_cookies.phpt @@ -0,0 +1,44 @@ +--TEST-- +session rfc1867 upload progress does not use form SID when use_only_cookies=1 +--INI-- +file_uploads=1 +upload_max_filesize=1024 +session.save_path= +session.name=PHPSESSID +session.use_strict_mode=0 +session.use_cookies=1 +session.use_only_cookies=1 +session.upload_progress.enabled=1 +session.upload_progress.cleanup=0 +session.upload_progress.prefix=upload_progress_ +session.upload_progress.name=PHP_SESSION_UPLOAD_PROGRESS +session.upload_progress.freq=0 +session.save_handler=files +--EXTENSIONS-- +session +--SKIPIF-- + +--POST_RAW-- +Content-Type: multipart/form-data; boundary=---------------------------20896060251896012921717172737 +-----------------------------20896060251896012921717172737 +Content-Disposition: form-data; name="PHPSESSID" + +rfc1867-sid-post-use-only-cookies +-----------------------------20896060251896012921717172737 +Content-Disposition: form-data; name="PHP_SESSION_UPLOAD_PROGRESS" + +rfc1867_sid_post_use_only_cookies.php +-----------------------------20896060251896012921717172737 +Content-Disposition: form-data; name="file1"; filename="file1.txt" + +1 +-----------------------------20896060251896012921717172737-- +--FILE-- + +--EXPECT-- +bool(false) From 93f6891fde659fcfdf73b2571be39430b4c72354 Mon Sep 17 00:00:00 2001 From: Jorg Sowa Date: Sun, 14 Jun 2026 14:39:52 +0200 Subject: [PATCH 2/5] added entry in NEWS --- NEWS | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/NEWS b/NEWS index aa752e0af386..3950b81fef8c 100644 --- a/NEWS +++ b/NEWS @@ -544,6 +544,11 @@ PHP NEWS . Fixed fuzzer targets failing to build in isolation. (Mrmaxmeier) . Fixed returns uninitialized value on LiteSpeed lsapi SAPI (Go Kudo) +- Session: + . Fixed session upload progress to respect session.use_only_cookies. + (jorgsowa) + + 27 Aug 2026, PHP 8.4.25 - Core: From 9a4394b5a93fd147e2af8e74213781b5b34e5d85 Mon Sep 17 00:00:00 2001 From: Jorg Sowa Date: Wed, 14 Oct 2026 23:40:01 +0200 Subject: [PATCH 3/5] Remove default INI values from rfc1867 use_only_cookies test --- .../tests/rfc1867_sid_post_use_only_cookies.phpt | 10 ---------- 1 file changed, 10 deletions(-) diff --git a/ext/session/tests/rfc1867_sid_post_use_only_cookies.phpt b/ext/session/tests/rfc1867_sid_post_use_only_cookies.phpt index 4cdbaae905c3..31b4a80c10d4 100644 --- a/ext/session/tests/rfc1867_sid_post_use_only_cookies.phpt +++ b/ext/session/tests/rfc1867_sid_post_use_only_cookies.phpt @@ -1,19 +1,9 @@ --TEST-- session rfc1867 upload progress does not use form SID when use_only_cookies=1 --INI-- -file_uploads=1 upload_max_filesize=1024 -session.save_path= -session.name=PHPSESSID -session.use_strict_mode=0 -session.use_cookies=1 -session.use_only_cookies=1 -session.upload_progress.enabled=1 session.upload_progress.cleanup=0 -session.upload_progress.prefix=upload_progress_ -session.upload_progress.name=PHP_SESSION_UPLOAD_PROGRESS session.upload_progress.freq=0 -session.save_handler=files --EXTENSIONS-- session --SKIPIF-- From 7e8d09dd27af4c4a60263337cef73f9848b81f03 Mon Sep 17 00:00:00 2001 From: Jorg Sowa Date: Wed, 14 Oct 2026 23:44:46 +0200 Subject: [PATCH 4/5] [skip ci] Move NEWS entry to PHP 8.4.28 section --- NEWS | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/NEWS b/NEWS index 3950b81fef8c..6248858700b9 100644 --- a/NEWS +++ b/NEWS @@ -82,6 +82,10 @@ PHP NEWS . Fixed a crash in readline_info() when completion_append_character contains a non-ASCII byte. (Weilin Du) +- Session: + . Fixed session upload progress to respect session.use_only_cookies. + (jorgsowa) + - SOAP: . Fixed use of uninitialized func in do_request() on OOM bailout. (David Carlier) @@ -544,11 +548,6 @@ PHP NEWS . Fixed fuzzer targets failing to build in isolation. (Mrmaxmeier) . Fixed returns uninitialized value on LiteSpeed lsapi SAPI (Go Kudo) -- Session: - . Fixed session upload progress to respect session.use_only_cookies. - (jorgsowa) - - 27 Aug 2026, PHP 8.4.25 - Core: From dedab5a22c7deba7405e75ffdd644467705d19c2 Mon Sep 17 00:00:00 2001 From: Jorg Sowa Date: Fri, 16 Oct 2026 21:08:17 +0200 Subject: [PATCH 5/5] Clarify rfc1867 use_only_cookies test title --- ext/session/tests/rfc1867_sid_post_use_only_cookies.phpt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ext/session/tests/rfc1867_sid_post_use_only_cookies.phpt b/ext/session/tests/rfc1867_sid_post_use_only_cookies.phpt index 31b4a80c10d4..8a22b2613699 100644 --- a/ext/session/tests/rfc1867_sid_post_use_only_cookies.phpt +++ b/ext/session/tests/rfc1867_sid_post_use_only_cookies.phpt @@ -1,5 +1,5 @@ --TEST-- -session rfc1867 upload progress does not use form SID when use_only_cookies=1 +session rfc1867 upload progress ignores session ID from POST data with default session.use_only_cookies --INI-- upload_max_filesize=1024 session.upload_progress.cleanup=0