Avoid session double-start in Setup.php

In PHP before 7.3, the double start doesn't really matter: session_id()
changes the ID even if it was already started, and the warning from
session_start() can just be ignored. Which is what we did.

In PHP 7.3, now session_id() also warns and no longer changes the ID. To
preserve the previous behavior, we'll need to explicitly close the old
session and open the new one.

Bug: T213489
Change-Id: I02a5be1c3adb326927c156fdd00663bccee37477

diff --git a/includes/Setup.php b/includes/Setup.php
index 61fad2d..4ebe426 100644 (file)
--- a/includes/Setup.php
+++ b/includes/Setup.php
@@ -872,11 +872,19 @@ if ( !defined( 'MW_NO_SESSION' ) && !$wgCommandLineMode ) {
 
        $session->renew();
        if ( MediaWiki\Session\PHPSessionHandler::isEnabled() &&
-               ( $session->isPersistent() || $session->shouldRememberUser() )
+               ( $session->isPersistent() || $session->shouldRememberUser() ) &&
+               session_id() !== $session->getId()
        ) {
                // Start the PHP-session for backwards compatibility
+               if ( session_id() !== '' ) {
+                       wfDebugLog( 'session', 'PHP session {old_id} was already started, changing to {new_id}', 'all', [
+                               'old_id' => session_id(),
+                               'new_id' => $session->getId(),
+                       ] );
+                       session_write_close();
+               }
                session_id( $session->getId() );
-               Wikimedia\quietCall( 'session_start' );
+               session_start();
        }
 
        unset( $session );