Uh oh!
There was an error while loading.Please reload this page.
- Notifications
You must be signed in to change notification settings - Fork9.7k
[HttpFoundation] Added possibility to disable base_64 encoding of session#5483
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.
Already on GitHub?Sign in to your account
Uh oh!
There was an error while loading.Please reload this page.
Conversation
…sion data in PdoSessionHandlerThis may be necessary when sharing sessions with legacy applications. Added a setting called 'base64_encode' to the configuration array. By default, the base_64 encoding stays enabled, so it does not break BC. Unit tests included.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
else statement does not needed here, leave justreturn
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
Done
fabpot commentedSep 11, 2012
As said in the code comments, not encoding the data is not safe. So, I'm -1 on this change. |
Baachi commentedSep 11, 2012
I agree with fabien. Save the raw data into the database is not safe. |
mvrhov commentedSep 11, 2012
When PHP serializes the object with private or protected methods the \0 is put before the property name and this means, that the serialized string is not safe. |
This PR was merged into the 2.6-dev branch.Discussion----------[HttpFoundation] enhance PdoSessionHandler| Q | A| ------------- | ---| Bug fix? | yes| New feature? | yes| BC breaks? | yes| Deprecations? | no| Tests pass? | yes| Fixed tickets |#5483,#2067,#2382,#9029| License | MIT0. [x] Continuation of locking implementation (#10908): Implement different locking strategies - `PdoSessionHandler::LOCK_TRANSACTIONAL` (default): Issues a real row lock but requires a transaction - `PdoSessionHandler::LOCK_ADVISORY`: app-level lock, safe as long as only the PdoSessionHandler accesses sessions, advantage is it does not require a transaction (not implemented for oracle or sqlsrv yet) - `PdoSessionHandler::LOCK_NONE`: basically what is was before, prone to race conditions, means the last session write wins1. [x] Save session data as binary: Encoding session data was definitely the wrong solution. Session data is binary text (esp. when using other session.serialize_handler) that must stay as-is and thus must also be safed in a binary column. Base64 encoding session data just decreses performance and increases storage costs and is semantically wrong because it does not have a character encoding.That saving null bytes in Posgres won't work on a character column is also documented > First, binary strings specifically allow storing octets of value zero and other "non-printable" octets (usually, octets outside the range 32 to 126). Character strings disallow zero octets, and also disallow any other octet values and sequences of octet values that are invalid according to the database's selected character set encoding.http://www.postgresql.org/docs/9.1/static/datatype-binary.html#DATATYPE-BINARY-TABLE2. [x] Implement lazy connections that are only opened when session is used by either passing a dsn string explicitly or falling back to session.save_path ini setting.Fixes#90293. [x] add a create table method that creates the correct table depending on database vendor. This makes the class self-documenting and standalone useable.5. [x] add lifetime column to session table which allows to have different lifetimes for each session6. [x] add isSessionExpired() method to be able to distinguish between a new session and one that expired due to inactivity, e.g. to display flash message to user7. [x] added upgrade and changelog notesCommits-------1bc6680 [HttpFoundation] implement different locking strategies for sessions6f5748e adjust sqlite table definition5978fcf added upgrade and changelog notes for PdoSessionHandler182a5d3 [HttpFoundation] add create table method to pdo session handlere79229d [HttpFoundation] allow different lifetime per sessionaf1bb1f add test for null byte in session data251238d [HttpFoundation] implement lazy connect for pdo session handler7dad54c [HttpFoundation] remove base64 encoding of session data
This may be necessary when sharing sessions with legacy applications. Added a setting called 'base64_encode' to the configuration array. By default, the base_64 encoding stays enabled, so it does not break BC. Unit tests included.
Please let me know what kind of documentation would need to be updated.
Bug fix: no
Feature addition: yes
Backwards compatibility break: no
Symfony2 tests pass: yes
Todo: Update documentation
License of the code: MIT