ID: 49557 Updated by: j...@php.net Reported By: maxtjh at hotmail dot com -Status: Open +Status: Bogus Bug Type: Session related Operating System: Windox XP SP2 PHP Version: 5.2.10 New Comment:
session_regenerate_id() does not destroy the session. RTFM: http://php.net/session_regenerate_id and notice the optional parameter. Previous Comments: ------------------------------------------------------------------------ [2009-09-15 02:56:15] maxtjh at hotmail dot com Description: ------------ Output for Test.php Current SID: 1e2rcu3s63pv5r0m0omuckmmc6 $_SESSION => array(0) { } -------------------------------------- Output for Test.php?set=1 Current SID: 1e2rcu3s63pv5r0m0omuckmmc6 Session has been set with 'a' and 'b' $_SESSION => array(2) { ["a"]=> string(3) "aaa" ["b"]=> string(3) "bbb" } -------------------------------------- Output for Test.php?reset=1 Current SID: 1e2rcu3s63pv5r0m0omuckmmc6 Session has been set with empty array and new SID is regenerated. New sid: hathl18bl00gedoqeia2q6dq36 $_SESSION => array(0) { } -------------------------------------- After go throught these 3 URL, $_SESSION should be equal to empty array before regenarate new session id. But it get wrong here: Change current session id (hathl18bl00gedoqeia2q6dq36) with old session id (1e2rcu3s63pv5r0m0omuckmmc6) in cookie and enter Test.php without any get method. $_SESSION should be an empty array but it show this: Current SID: 1e2rcu3s63pv5r0m0omuckmmc6 $_SESSION => array(2) { ["a"]=> string(3) "aaa" ["b"]=> string(3) "bbb" } Reproduce code: --------------- session_start(); echo 'Current SID: '.session_id().'<br/>'; if(isset($_GET['set'])) { $_SESSION=array('a'=>'aaa','b'=>'bbb'); echo 'Session has been set with \'a\' and \'b\''.'<br/>'; } if(isset($_GET['reset'])) { $_SESSION=array(); session_regenerate_id(); echo 'Session has been set with empty array and new SID is regenerated.'.'<br/>'; echo 'New sid: '.session_id().'<br/>'; } echo '$_SESSION => '; echo var_dump($_SESSION).'<br/>'; Expected result: ---------------- Current SID: 1e2rcu3s63pv5r0m0omuckmmc6 $_SESSION => array(0) { } Actual result: -------------- Current SID: 1e2rcu3s63pv5r0m0omuckmmc6 $_SESSION => array(2) { ["a"]=> string(3) "aaa" ["b"]=> string(3) "bbb" } ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=49557&edit=1
