From 1c14156e941817bdcf3be5debad261ae7a6d8431 Mon Sep 17 00:00:00 2001 From: Jorg Sowa Date: Thu, 21 May 2026 22:44:33 +0200 Subject: [PATCH 1/4] fix: prevent creation of fixed sid --- ext/session/session.c | 8 ++-- .../rfc1867_sid_post_use_only_cookies.phpt | 44 +++++++++++++++++++ 2 files changed, 48 insertions(+), 4 deletions(-) create mode 100644 ext/session/tests/rfc1867_sid_post_use_only_cookies.phpt diff --git a/ext/session/session.c b/ext/session/session.c index a9838cafe666..b41bb6674968 100644 --- a/ext/session/session.c +++ b/ext/session/session.c @@ -1679,8 +1679,8 @@ PHPAPI zend_result php_session_start(void) /* {{{ */ * Cookies are preferred, because initially cookie and get * variables will be available. * URL/POST session ID may be used when use_only_cookies=Off. - * session.use_strice_mode=On prevents session adoption. - * Session based file upload progress uses non-cookie ID. + * session.use_strict_mode=On prevents session adoption. + * Session based file upload progress respects use_only_cookies. */ if (!PS(id)) { @@ -3247,7 +3247,7 @@ static zend_result php_session_rfc1867_callback(unsigned int event, void *event_ multipart_event_start *data = (multipart_event_start *) event_data; progress = ecalloc(1, sizeof(php_session_rfc1867_progress)); progress->content_length = data->content_length; - progress->sname_len = strlen(PS(session_name)); + progress->sname_len = strlen(PS(session_name)); PS(rfc1867_progress) = progress; } break; @@ -3269,7 +3269,7 @@ static zend_result php_session_rfc1867_callback(unsigned int event, void *event_ if (data->name && data->value && value_len) { size_t name_len = strlen(data->name); - if (name_len == progress->sname_len && memcmp(data->name, PS(session_name), name_len) == 0) { + if (!PS(use_only_cookies) && name_len == progress->sname_len && memcmp(data->name, PS(session_name), name_len) == 0) { zval_ptr_dtor(&progress->sid); ZVAL_STRINGL(&progress->sid, (*data->value), value_len); } else if (name_len == strlen(PS(rfc1867_name)) && memcmp(data->name, PS(rfc1867_name), name_len + 1) == 0) { diff --git a/ext/session/tests/rfc1867_sid_post_use_only_cookies.phpt b/ext/session/tests/rfc1867_sid_post_use_only_cookies.phpt new file mode 100644 index 000000000000..4cdbaae905c3 --- /dev/null +++ b/ext/session/tests/rfc1867_sid_post_use_only_cookies.phpt @@ -0,0 +1,44 @@ +--TEST-- +session rfc1867 upload progress does not use form SID when use_only_cookies=1 +--INI-- +file_uploads=1 +upload_max_filesize=1024 +session.save_path= +session.name=PHPSESSID +session.use_strict_mode=0 +session.use_cookies=1 +session.use_only_cookies=1 +session.upload_progress.enabled=1 +session.upload_progress.cleanup=0 +session.upload_progress.prefix=upload_progress_ +session.upload_progress.name=PHP_SESSION_UPLOAD_PROGRESS +session.upload_progress.freq=0 +session.save_handler=files +--EXTENSIONS-- +session +--SKIPIF-- + +--POST_RAW-- +Content-Type: multipart/form-data; boundary=---------------------------20896060251896012921717172737 +-----------------------------20896060251896012921717172737 +Content-Disposition: form-data; name="PHPSESSID" + +rfc1867-sid-post-use-only-cookies +-----------------------------20896060251896012921717172737 +Content-Disposition: form-data; name="PHP_SESSION_UPLOAD_PROGRESS" + +rfc1867_sid_post_use_only_cookies.php +-----------------------------20896060251896012921717172737 +Content-Disposition: form-data; name="file1"; filename="file1.txt" + +1 +-----------------------------20896060251896012921717172737-- +--FILE-- + +--EXPECT-- +bool(false) From d73f075e42a58635ecb293294794e69b84cb4238 Mon Sep 17 00:00:00 2001 From: Jorg Sowa Date: Sun, 14 Jun 2026 14:39:52 +0200 Subject: [PATCH 2/4] added entry in NEWS --- NEWS | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/NEWS b/NEWS index 4be7ba3fdb1d..dc52094f8c16 100644 --- a/NEWS +++ b/NEWS @@ -518,6 +518,11 @@ PHP NEWS . Fixed fuzzer targets failing to build in isolation. (Mrmaxmeier) . Fixed returns uninitialized value on LiteSpeed lsapi SAPI (Go Kudo) +- Session: + . Fixed session upload progress to respect session.use_only_cookies. + (jorgsowa) + + 27 Aug 2026, PHP 8.4.25 - Core: From b53f0a45319946f83b7dac66922ff3b4fb091555 Mon Sep 17 00:00:00 2001 From: Jorg Sowa Date: Wed, 14 Oct 2026 23:40:01 +0200 Subject: [PATCH 3/4] Remove default INI values from rfc1867 use_only_cookies test --- .../tests/rfc1867_sid_post_use_only_cookies.phpt | 10 ---------- 1 file changed, 10 deletions(-) diff --git a/ext/session/tests/rfc1867_sid_post_use_only_cookies.phpt b/ext/session/tests/rfc1867_sid_post_use_only_cookies.phpt index 4cdbaae905c3..31b4a80c10d4 100644 --- a/ext/session/tests/rfc1867_sid_post_use_only_cookies.phpt +++ b/ext/session/tests/rfc1867_sid_post_use_only_cookies.phpt @@ -1,19 +1,9 @@ --TEST-- session rfc1867 upload progress does not use form SID when use_only_cookies=1 --INI-- -file_uploads=1 upload_max_filesize=1024 -session.save_path= -session.name=PHPSESSID -session.use_strict_mode=0 -session.use_cookies=1 -session.use_only_cookies=1 -session.upload_progress.enabled=1 session.upload_progress.cleanup=0 -session.upload_progress.prefix=upload_progress_ -session.upload_progress.name=PHP_SESSION_UPLOAD_PROGRESS session.upload_progress.freq=0 -session.save_handler=files --EXTENSIONS-- session --SKIPIF-- From 441bc5615a5d35effc46ce5e62880e0cfc01d67e Mon Sep 17 00:00:00 2001 From: Jorg Sowa Date: Wed, 14 Oct 2026 23:44:46 +0200 Subject: [PATCH 4/4] [skip ci] Move NEWS entry to PHP 8.4.28 section --- NEWS | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/NEWS b/NEWS index dc52094f8c16..174c3614f264 100644 --- a/NEWS +++ b/NEWS @@ -66,6 +66,10 @@ PHP NEWS . Fixed a crash in readline_info() when completion_append_character contains a non-ASCII byte. (Weilin Du) +- Session: + . Fixed session upload progress to respect session.use_only_cookies. + (jorgsowa) + - SOAP: . Fixed use of uninitialized func in do_request() on OOM bailout. (David Carlier) @@ -518,11 +522,6 @@ PHP NEWS . Fixed fuzzer targets failing to build in isolation. (Mrmaxmeier) . Fixed returns uninitialized value on LiteSpeed lsapi SAPI (Go Kudo) -- Session: - . Fixed session upload progress to respect session.use_only_cookies. - (jorgsowa) - - 27 Aug 2026, PHP 8.4.25 - Core: