ext/session: prevent creation of fixed sid in php_session_rfc1867

[jorgsowa]

The RFC1867 multipart callback captures the session ID from form data to identify which session to write the upload progress to. When session.use_only_cookies=1 this capture was not guarded, allowing the session ID to be accepted from a form field despite the setting's documented contract of "only accept session ID from cookies."

php_session_rfc1867_early_find_sid() already guards $_GET lookup behind use_only_cookies, but the form field capture in MULTIPART_EVENT_FORMDATA had no such guard.

This commit adds the missing check so that when use_only_cookies=1 and no cookie is present, the form-supplied session ID is ignored and the upload progress is written to a randomly generated session instead.

I don't know if this is a security fix, so I point to the 8.4 branch.

[Girgias]

This seems sensible, but not super familiar with RFC 1867, maybe @iluuu1994 or @bukka have some comments?

[jorgsowa]

I have added missing entry in NEWS.

[jorgsowa]

Is it safe to merge this PR? I have rebased on fresh branch right now.

[iluuu1994]

This didn't have a proper review yet, it's on my list. But feature freeze...

[Sjord]

Changes look good to me.

How does this relate to PHP RFC: Deprecate GET/POST sessions?

[jorgsowa]

I removed defaults from INI section in test.

[Sjord]

I removed defaults from INI section in test.

I think it would make sense to explicitly set use_only_cookies=1 again, since that is the condition that the test is supposed to test.

[jorgsowa]

What's the point if this is default and it will be removed in next PHP versions?

[Sjord]

I thought it would be needed because it is mentioned in the title that it tests this condition:

session rfc1867 upload progress does not use form SID when use_only_cookies=1

If you say use_only_cookies is always set, perhaps this title could use some work?