From 1b52ddd9c603c403d98a255dae998621e0f62e21 Mon Sep 17 00:00:00 2001 From: Brad Jorsch Date: Sat, 12 Jan 2019 14:16:52 -0500 Subject: [PATCH] Avoid session double-start in Setup.php In PHP before 7.3, the double start doesn't really matter: session_id() changes the ID even if it was already started, and the warning from session_start() can just be ignored. Which is what we did. In PHP 7.3, now session_id() also warns and no longer changes the ID. To preserve the previous behavior, we'll need to explicitly close the old session and open the new one. Bug: T213489 Change-Id: I02a5be1c3adb326927c156fdd00663bccee37477 --- includes/Setup.php | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/includes/Setup.php b/includes/Setup.php index 61fad2db59..4ebe426b0a 100644 --- a/includes/Setup.php +++ b/includes/Setup.php @@ -872,11 +872,19 @@ if ( !defined( 'MW_NO_SESSION' ) && !$wgCommandLineMode ) { $session->renew(); if ( MediaWiki\Session\PHPSessionHandler::isEnabled() && - ( $session->isPersistent() || $session->shouldRememberUser() ) + ( $session->isPersistent() || $session->shouldRememberUser() ) && + session_id() !== $session->getId() ) { // Start the PHP-session for backwards compatibility + if ( session_id() !== '' ) { + wfDebugLog( 'session', 'PHP session {old_id} was already started, changing to {new_id}', 'all', [ + 'old_id' => session_id(), + 'new_id' => $session->getId(), + ] ); + session_write_close(); + } session_id( $session->getId() ); - Wikimedia\quietCall( 'session_start' ); + session_start(); } unset( $session ); -- 2.20.1