(php_get_session_var) Always return FAILURE if no data source was found.

Noticed by: Sebastian Bergmann

Because track vars are always initialized, get_session_var failed
to work in the register_globals=1 case.

It is now possible again to store session variables in global vars.

Correcting some english in the comment...

Forgot to update source default.

ws fix

- Fixed bug: #17977, session build as shared works now with mm handler too.
- Added listing of save handlers into phpinfo() output

This option enables administrators to make their users invulnerable to
attacks which involve passing session ids in URLs.

Changing email address.

- Fix the way code was outcommented
- Remove unused STR_CAT macro
- Remove limits/tests based on unused macro
- Implement cache_limiter(private) using private_no_expire

Revert Preston's patch

Change default directory for session data from /tmp (non-portable) to none.
Default directory for session data (if not specified) is same (platform-specific) directory used for temporary files.

Change default directory for session data from /tmp (non-portable) to none.
Default directory for session data (if not specified) is same (platform-specific) directory used for temporary files.
This is backwards compatible and removes the need for explicitly specifying the session.save_path on Win32.

show more ...

re-add accidentily nuked session_adapt_url()

simplify handling of variables by maintaining two strings which
are simply appended instead of traversing the hash table on each
URL/form.

also fix an unconditional segfault in rshut

simplify handling of variables by maintaining two strings which
are simply appended instead of traversing the hash table on each
URL/form.

also fix an unconditional segfault in rshutdown due to efree'ing
a static char *.

remove remove_var, add reset_vars. move the function declarations
into the right header file.

show more ...

Fix ZTS build.

@ - Added output_add_rewrite_var() and output_remove_rewrite_var() to inject
@ and remove variables from the URL-Rewriter. (thies)
i have also modified the session module to use this - so i

@ - Added output_add_rewrite_var() and output_remove_rewrite_var() to inject
@ and remove variables from the URL-Rewriter. (thies)
i have also modified the session module to use this - so it doesn't
need to fiddle with the output-system any more

show more ...

revert session_set_userdata - diffent patch will come shortly

@ - added session_set_userdata() which enables you to specify one variable
@ that will be kept in the browser in addition to the session-id. This
@ only works when using trans-sid session

@ - added session_set_userdata() which enables you to specify one variable
@ that will be kept in the browser in addition to the session-id. This
@ only works when using trans-sid sessions (no cookie). (thies)

show more ...

three less strlen invocations

- Proper use of underscores (s/createsid/create_sid/)
- Bump the API date and remove extra cpp macro
- Pass TSRMLS appropiately to the create_sid function

Added field to ps_module structure to hold function pointer for the creation
of the session ID string. Default PS_MOD() macro sets this to be the default
creation routine. PS_MOD_SID() macro

Added field to ps_module structure to hold function pointer for the creation
of the session ID string. Default PS_MOD() macro sets this to be the default
creation routine. PS_MOD_SID() macro sets this to a handlers session ID
creation routine.

show more ...

Because of the feature "don't try to send a cookie, if the sid
was contained in get/post variables" (which I still am not convinced
of completely), we need a separate variable which determine

Because of the feature "don't try to send a cookie, if the sid
was contained in get/post variables" (which I still am not convinced
of completely), we need a separate variable which determines whether
to define SID in the event that a cookie was not sent.

Noticed by: Matt Allen

show more ...

whitespace..

Do the estrdups after checking for parameter constraints.

No real memory leaks though, because they are catched by the
memory manager.

SID shall be defined to name=id, if the client did not supply
a cookie.

Merge in session API changes (carry around tsrm context)

Now PHP_SESSION_API is defined to the date of the last change,
so that externa source-code can handle changes more gracefully.