Fix #79413: session_create_id() fails for active sessions

The comment on `PS_VALIDATE_SID_FUNC(files)` is very clear that the
function is supposed to return `SUCCESS` if the session alre

Fix #79413: session_create_id() fails for active sessions

The comment on `PS_VALIDATE_SID_FUNC(files)` is very clear that the
function is supposed to return `SUCCESS` if the session already exists.
So to detect a collision, we have to check for `SUCCESS`, not
`FAILURE`.

We also fix the wrong condition in session_regenerate_id() as well.

show more ...

Fix bug #79221 - Null Pointer Dereference in PHP Session Upload Progress

Fix bug #79221 - Null Pointer Dereference in PHP Session Upload Progress

Fix #79091: heap use-after-free in session_create_id()

If the `new_id` is released, we must not use it again.

Fix #77911: Wrong warning for session.sid_bits_per_character

Fix #76688: Disallow excessive parameters after options array

Support for samesite cookies with array syntax

Allows using an alternative array argument with
support for the samesite option on the following
functions:
setcookie
setrawcoo

Support for samesite cookies with array syntax

Allows using an alternative array argument with
support for the samesite option on the following
functions:
setcookie
setrawcookie
session_set_cookie_params

show more ...

implement same site cookie see https://bugs.php.net/bug.php?id=72230 see https://tools.ietf.org/html/draft-west-first-party-cookies-07 see https://scotthelme.co.uk/csrf-is-dead/

Fix typos in code comments

Remove unused Git attributes ident

The $Id$ keywords were used in Subversion where they can be substituted
with filename, last revision number change, last changed date, and last
use

Remove unused Git attributes ident

The $Id$ keywords were used in Subversion where they can be substituted
with filename, last revision number change, last changed date, and last
user who changed it.

In Git this functionality is different and can be done with Git attribute
ident. These need to be defined manually for each file in the
.gitattributes file and are afterwards replaced with 40-character
hexadecimal blob object name which is based only on the particular file
contents.

This patch simplifies handling of $Id$ keywords by removing them since
they are not used anymore.

show more ...

Uze ZVAL_COPY_DEREF() instead of ZVAL_DEREF() and ZVAL_COPY()

Use zval_ptr_dtor() imstead of zval_dtor()

Replace legacy zval_dtor() by zval_ptr_dtor_nogc() or even more specialized destructors.
zval_dtor() doesn't make a lot of sense in PHP-7.* and it's used incorrectly in some places.
Its occur

Replace legacy zval_dtor() by zval_ptr_dtor_nogc() or even more specialized destructors.
zval_dtor() doesn't make a lot of sense in PHP-7.* and it's used incorrectly in some places.
Its occurances should be replaced by zval_ptr_dtor() or zval_ptr_dtor_nogc(), or even more specialized destructors.

show more ...

se zval_ptr_dtor_str() instead of zend_string_release_ex(Z_STR(*), 0)

Use zend_string_release_ex() instread of zend_string_release() in places, where we sure about string persistence.

Fix some misspellings

year++

year++

year++

Move constants into read-only data segment

Intern auto global name strings in first place

Avoid unnecessary reference-counting on strings.

Clarify bin_to_readable code

I got a bit of a scare when I first saw this code. Turns out that
the way it's used inlen==outlen and that's why it works.

move zend_ato*() to size_t and remove casts

Fixed bug #74833, SID constant created with wrong module number