From: Yasuo Ohgaki <yohgaki@php.net>
Date: Fri, 9 Aug 2013 09:05:07 +0000 (+0900)
Subject: Fixed Bug #65315 session.hash_function silently fallback to default md5
X-Git-Tag: php-5.6.0alpha1~329
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=b6b425d2cf767e47e9d05fbfe1328f1485a488ef;p=php

Fixed Bug #65315 session.hash_function silently fallback to default md5
---

diff --git a/NEWS b/NEWS
index c679b90a65..02fa05ede8 100644
--- a/NEWS
+++ b/NEWS
@@ -7,6 +7,10 @@ PHP                                                                        NEWS
   . Implemented internal operator overloading
     (RFC: https://wiki.php.net/rfc/operator_overloading_gmp). (Nikita)
 
+- Session:
+  . Fixed Bug #65315 (session.hash_function silently fallback to default md5)
+    (Yasuo)
+
 - mysqlnd:
   . Disabled flag for SP OUT variables for 5.5+ servers as they are not natively
     supported by the overlying APIs. (Andrey)
diff --git a/ext/session/session.c b/ext/session/session.c
index c02a10d7bf..aee3308568 100644
--- a/ext/session/session.c
+++ b/ext/session/session.c
@@ -727,6 +727,7 @@ static PHP_INI_MH(OnUpdateHashFunc) /* {{{ */
 }
 #endif /* HAVE_HASH_EXT }}} */
 
+	php_error_docref(NULL TSRMLS_CC, E_WARNING, "session.configuration 'session.hash_function' must be existing hash function. %s does not exist.", new_value);
 	return FAILURE;
 }
 /* }}} */
diff --git a/ext/session/tests/session_hash_function_basic.phpt b/ext/session/tests/session_hash_function_basic.phpt
new file mode 100644
index 0000000000..8b14a88337
--- /dev/null
+++ b/ext/session/tests/session_hash_function_basic.phpt
@@ -0,0 +1,50 @@
+--TEST--
+Test session.hash_function ini setting : basic functionality
+--SKIPIF--
+<?php include('skipif.inc'); ?>
+--FILE--
+<?php
+
+ob_start();
+
+echo "*** Testing session.hash_function : basic functionality ***\n";
+
+var_dump(ini_set('session.hash_function', 'md5'));
+var_dump(session_start());
+var_dump(!empty(session_id()), session_id());
+var_dump(session_destroy());
+
+var_dump(ini_set('session.hash_function', 'sha1'));
+var_dump(session_start());
+var_dump(!empty(session_id()), session_id());
+var_dump(session_destroy());
+
+var_dump(ini_set('session.hash_function', 'none')); // Should fail
+var_dump(session_start());
+var_dump(!empty(session_id()), session_id());
+var_dump(session_destroy());
+
+
+echo "Done";
+ob_end_flush();
+?>
+--EXPECTF--
+*** Testing session.hash_function : basic functionality ***
+string(1) "0"
+bool(true)
+bool(true)
+string(32) "%s"
+bool(true)
+string(3) "md5"
+bool(true)
+bool(true)
+string(40) "%s"
+bool(true)
+
+Warning: ini_set(): session.hash_func must be existing hash function. none does not exist. in %s/session_hash_function_basic.php on line 17
+bool(false)
+bool(true)
+bool(true)
+string(40) "%s"
+bool(true)
+Done