In PHP before 7.3, the double start doesn't really matter: session_id()
changes the ID even if it was already started, and the warning from
session_start() can just be ignored. Which is what we did.
In PHP 7.3, now session_id() also warns and no longer changes the ID. To
preserve the previous behavior, we'll need to explicitly close the old
session and open the new one.
Bug: T213489
Change-Id: I02a5be1c3adb326927c156fdd00663bccee37477
$session->renew();
if ( MediaWiki\Session\PHPSessionHandler::isEnabled() &&
- ( $session->isPersistent() || $session->shouldRememberUser() )
+ ( $session->isPersistent() || $session->shouldRememberUser() ) &&
+ session_id() !== $session->getId()
) {
// Start the PHP-session for backwards compatibility
+ if ( session_id() !== '' ) {
+ wfDebugLog( 'session', 'PHP session {old_id} was already started, changing to {new_id}', 'all', [
+ 'old_id' => session_id(),
+ 'new_id' => $session->getId(),
+ ] );
+ session_write_close();
+ }
session_id( $session->getId() );
- Wikimedia\quietCall( 'session_start' );
+ session_start();
}
unset( $session );