MFH: fix bug #32944 (Disabling session.use_cookies doesn't prevent reading session...

diff --git a/NEWS b/NEWS
index 0701d670270e37af36f2b09b9b4494e7d1016ec5..941db230999efd1ef8c15467a746a6043e675f2c 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -18,6 +18,8 @@ PHP                                                                        NEWS
   (jwozniak23 at poczta dot onet dot pl, Tony).
 - Fixed bug #32956 (mysql_bind_result() doesn't support MYSQL_TYPE_NULL). (Georg)
 - Fixed bug #32947 (Incorrect option for mysqli default password). (Georg)
+- Fixed bug #32944 (Disabling session.use_cookies doesn't prevent reading 
+  session cookies). (Jani, Tony)
 - Fixed bug #32936 (http redirects URLs are not checked for control chars). (Ilia)
 - Fixed bug #32932 (Oracle LDAP: ldap_get_entries(), invalid pointer). (Jani)
 - Fixed bug #32930 (class extending DOMDocument doesn't clone properly). (Rob)

diff --git a/ext/session/session.c b/ext/session/session.c
index 4559e3e2d59bd9b1984e772ec880dd245bd08185..8db83409e59378cfe73819ddeffe8892d3d89e0e 100644 (file)
--- a/ext/session/session.c
+++ b/ext/session/session.c
@@ -1134,7 +1134,7 @@ PHPAPI void php_session_start(TSRMLS_D)
         */
 
        if (!PS(id)) {
-               if (zend_hash_find(&EG(symbol_table), "_COOKIE",
+               if (PS(use_cookies) && zend_hash_find(&EG(symbol_table), "_COOKIE",
                                        sizeof("_COOKIE"), (void **) &data) == SUCCESS &&
                                Z_TYPE_PP(data) == IS_ARRAY &&
                                zend_hash_find(Z_ARRVAL_PP(data), PS(session_name),