#34300 [NEW]: imageinterlace does not set interlace bit on gif images

2005-08-29 Thread mjs15451 at hotmail dot com
From: mjs15451 at hotmail dot com
Operating system: Gentoo Linux
PHP version:  5.0.4
PHP Bug Type: GD related
Bug description:  imageinterlace does not set interlace bit on gif images

Description:

The imageinterlace function does not set the interlace bit on GIF images. 
It only works on PNG and JPG images.

Reproduce code:
---
$fileName = '/path/to/gif/file';
$resImage = @imagecreatefromgif($fileName);
imageinterlace($resImage, 1);
imagegif($resImage, $fileName);
imagedestroy($resImage);

Expected result:

The interlace bit should be set on the GIF image.

Actual result:
--
The interlace bit is not set on the GIF image.

-- 
Edit bug report at http://bugs.php.net/?id=34300&edit=1
-- 
Try a CVS snapshot (php4):   http://bugs.php.net/fix.php?id=34300&r=trysnapshot4
Try a CVS snapshot (php5.0): 
http://bugs.php.net/fix.php?id=34300&r=trysnapshot50
Try a CVS snapshot (php5.1): 
http://bugs.php.net/fix.php?id=34300&r=trysnapshot51
Fixed in CVS:http://bugs.php.net/fix.php?id=34300&r=fixedcvs
Fixed in release:http://bugs.php.net/fix.php?id=34300&r=alreadyfixed
Need backtrace:  http://bugs.php.net/fix.php?id=34300&r=needtrace
Need Reproduce Script:   http://bugs.php.net/fix.php?id=34300&r=needscript
Try newer version:   http://bugs.php.net/fix.php?id=34300&r=oldversion
Not developer issue: http://bugs.php.net/fix.php?id=34300&r=support
Expected behavior:   http://bugs.php.net/fix.php?id=34300&r=notwrong
Not enough info: 
http://bugs.php.net/fix.php?id=34300&r=notenoughinfo
Submitted twice: 
http://bugs.php.net/fix.php?id=34300&r=submittedtwice
register_globals:http://bugs.php.net/fix.php?id=34300&r=globals
PHP 3 support discontinued:  http://bugs.php.net/fix.php?id=34300&r=php3
Daylight Savings:http://bugs.php.net/fix.php?id=34300&r=dst
IIS Stability:   http://bugs.php.net/fix.php?id=34300&r=isapi
Install GNU Sed: http://bugs.php.net/fix.php?id=34300&r=gnused
Floating point limitations:  http://bugs.php.net/fix.php?id=34300&r=float
No Zend Extensions:  http://bugs.php.net/fix.php?id=34300&r=nozend
MySQL Configuration Error:   http://bugs.php.net/fix.php?id=34300&r=mysqlcfg


#24096 [Com]: session_regenerate_id() should optionally delete the old session file

2005-06-28 Thread mjs15451 at hotmail dot com
 ID:   24096
 Comment by:   mjs15451 at hotmail dot com
 Reported By:  pablo_sole at myp dot net dot ar
 Status:   Open
 Bug Type: Feature/Change Request
 Operating System: *
 PHP Version:  5.*, 4.*
 New Comment:

Thanks, Ilia, for implementing this option in PHP 5.1. I know many
people will be happy about this.  :-)


Previous Comments:


[2005-04-09 01:42:36] mjs15451 at hotmail dot com

Don't know if this works on PHP 4, but this is what I did to get
session_regenerate_id to delete the old session file in PHP 5.  Replace
the session_regenerate_id function in session.c with this function I
modded:

PHP_FUNCTION(session_regenerate_id)
{
char *oldID = empty_string;
if (PS(session_status) == php_session_active) {
if (PS(id)) {
oldID = PS(id); //save old id
efree(PS(id));
}

PS(id) = PS(mod)->s_create_sid(&PS(mod_data), NULL
TSRMLS_CC);

php_session_reset_id(TSRMLS_C);

if (oldID != empty_string)
PS(mod)->s_destroy(&PS(mod_data), oldID TSRMLS_CC); //delete old
session file

RETURN_TRUE;
}
RETURN_FALSE;
}



[2005-04-08 17:38:28] mjs15451 at hotmail dot com

I would definitely be for auto-destruction of the old session file as I
have come upon this problem as well and I have made a similar
enhancement suggestion under bug: http://bugs.php.net/bug.php?id=32631



[2003-06-10 23:50:40] pablo_sole at myp dot net dot ar

You're right, in my own case i use this function to do a per-page
session (following OWASP's "Guide to Build Secure Web Applications" or
something like that), so what i'm doing is to refresh the id every time
a user do a request, but without lost the "statefulness". So, if you
think this need to be supported by the php sessions code, was an honor
help you, if not... i already do a little patch to support it on my own
server.

pablo.



[2003-06-09 23:10:25] [EMAIL PROTECTED]

It is debatable whether the function should destroy the old session. 
The current behaviour is useful under a number of circumstances.
Auto-destruction could be added as a new feature though.

 -> Feature/Change request.



[2003-06-09 09:42:08] pablo_sole at myp dot net dot ar

testing the new session_regenerate_id i see that after upgrade de SID,
not unlink the old session file so, when you regenerate many times the
session could be used to make a DoS, or at least is not what it's
expected from the function.

Checking the source code, the routine free the SID and assign the new,
but not unlink the old file (just like in the php_session_destroy
routine).

A workaround could be unlink manualy on the fly, or patch the session.c
file.

Sorry my poor english, but is not my native language.

Any question, mail me.

pablo.

PD: I not have any "specific setup" or extra modules compiled in, and
for that reason i don't put it here.





-- 
Edit this bug report at http://bugs.php.net/?id=24096&edit=1


#33157 [NEW]: Missing htmlspecialchars_decode

2005-05-26 Thread mjs15451 at hotmail dot com
From: mjs15451 at hotmail dot com
Operating system: Linux 2.6.10
PHP version:  5.0.4
PHP Bug Type: *General Issues
Bug description:  Missing htmlspecialchars_decode

Description:

htmlspecialchars_decode() is missing.

Reproduce code:
---
echo htmlspecialchars_decode("asdf<>");

Expected result:

Should output:

asdf<>

Actual result:
--
Fatal error: Call to undefined function htmlspecialchars_decode()

I double checked my php version and I am definitely running php 5.0.4 and
according to the docs this function should be available in PHP 5.

http://us2.php.net/manual/en/function.htmlspecialchars-decode.php

I did the usual configure, make, make install.

./configure --prefix=/usr/lib/php --with-apxs2=/usr/sbin/apxs2
--with-openssl --with-zlib --enable-dio --with-bz2 --enable-calendar
--enable-bcmath --with-curl=/usr/include/curl --enable-exif
--enable-filepro --enable-ftp --with-ttf --enable-mbstring
--enable-zend-multibyte --without-mysql
--with-mysqli=/usr/lib/mysql/bin/mysql_config
--with-mysql-sock=/var/run/mysqld/mysql.sock --enable-sockets
--enable-sqllite-utf8 --enable-wddx --with-gettext=/usr/lib/gettext
--with-imagick=/usr --with-mcrypt --with-mhash --with-gd --with-jpeg-dir
--with-png-dir --with-freetype-dir --with-zlib-dir --with-libxml-dir

make 

make install

-- 
Edit bug report at http://bugs.php.net/?id=33157&edit=1
-- 
Try a CVS snapshot (php4):   http://bugs.php.net/fix.php?id=33157&r=trysnapshot4
Try a CVS snapshot (php5.0): 
http://bugs.php.net/fix.php?id=33157&r=trysnapshot50
Try a CVS snapshot (php5.1): 
http://bugs.php.net/fix.php?id=33157&r=trysnapshot51
Fixed in CVS:http://bugs.php.net/fix.php?id=33157&r=fixedcvs
Fixed in release:http://bugs.php.net/fix.php?id=33157&r=alreadyfixed
Need backtrace:  http://bugs.php.net/fix.php?id=33157&r=needtrace
Need Reproduce Script:   http://bugs.php.net/fix.php?id=33157&r=needscript
Try newer version:   http://bugs.php.net/fix.php?id=33157&r=oldversion
Not developer issue: http://bugs.php.net/fix.php?id=33157&r=support
Expected behavior:   http://bugs.php.net/fix.php?id=33157&r=notwrong
Not enough info: 
http://bugs.php.net/fix.php?id=33157&r=notenoughinfo
Submitted twice: 
http://bugs.php.net/fix.php?id=33157&r=submittedtwice
register_globals:http://bugs.php.net/fix.php?id=33157&r=globals
PHP 3 support discontinued:  http://bugs.php.net/fix.php?id=33157&r=php3
Daylight Savings:http://bugs.php.net/fix.php?id=33157&r=dst
IIS Stability:   http://bugs.php.net/fix.php?id=33157&r=isapi
Install GNU Sed: http://bugs.php.net/fix.php?id=33157&r=gnused
Floating point limitations:  http://bugs.php.net/fix.php?id=33157&r=float
No Zend Extensions:  http://bugs.php.net/fix.php?id=33157&r=nozend
MySQL Configuration Error:   http://bugs.php.net/fix.php?id=33157&r=mysqlcfg


#24096 [Com]: session_regenerate_id not delete the old session file

2005-04-12 Thread mjs15451 at hotmail dot com
 ID:   24096
 Comment by:   mjs15451 at hotmail dot com
 Reported By:  pablo_sole at myp dot net dot ar
 Status:   Open
 Bug Type: Feature/Change Request
 Operating System: linux rh8 apache 1.3.27
 PHP Version:  4.3.2
 New Comment:

I would definitely be for auto-destruction of the old session file as I
have come upon this problem as well and I have made a similar
enhancement suggestion under bug: http://bugs.php.net/bug.php?id=32631


Previous Comments:


[2003-06-10 23:50:40] pablo_sole at myp dot net dot ar

You're right, in my own case i use this function to do a per-page
session (following OWASP's "Guide to Build Secure Web Applications" or
something like that), so what i'm doing is to refresh the id every time
a user do a request, but without lost the "statefulness". So, if you
think this need to be supported by the php sessions code, was an honor
help you, if not... i already do a little patch to support it on my own
server.

pablo.



[2003-06-09 23:11:00] [EMAIL PROTECTED]

-> Open



[2003-06-09 23:10:25] [EMAIL PROTECTED]

It is debatable whether the function should destroy the old session. 
The current behaviour is useful under a number of circumstances.
Auto-destruction could be added as a new feature though.

 -> Feature/Change request.



[2003-06-09 09:42:08] pablo_sole at myp dot net dot ar

testing the new session_regenerate_id i see that after upgrade de SID,
not unlink the old session file so, when you regenerate many times the
session could be used to make a DoS, or at least is not what it's
expected from the function.

Checking the source code, the routine free the SID and assign the new,
but not unlink the old file (just like in the php_session_destroy
routine).

A workaround could be unlink manualy on the fly, or patch the session.c
file.

Sorry my poor english, but is not my native language.

Any question, mail me.

pablo.

PD: I not have any "specific setup" or extra modules compiled in, and
for that reason i don't put it here.





-- 
Edit this bug report at http://bugs.php.net/?id=24096&edit=1


#32631 [Opn]: sess_* owner & session_regenerate_id

2005-04-12 Thread mjs15451 at hotmail dot com
 ID:   32631
 User updated by:  mjs15451 at hotmail dot com
 Reported By:  mjs15451 at hotmail dot com
 Status:   Open
 Bug Type: Feature/Change Request
 Operating System: *
 PHP Version:  4.*, 5.*
 New Comment:

I believe this could be considered as a similar enhancement suggestion
to bug: http://bugs.php.net/bug.php?id=24096


Previous Comments:


[2005-04-08 17:00:08] mjs15451 at hotmail dot com

I wouldn't have mentioned it if I thought there was some documentation
for it somewhere.  Couldn't this be considered as en enhancement
suggestion?



[2005-04-08 09:10:24] [EMAIL PROTECTED]

Sorry, but your problem does not imply a bug in PHP itself.  For a
list of more appropriate places to ask for help using PHP, please
visit http://www.php.net/support.php as this bug system is not the
appropriate forum for asking support questions.  Due to the volume
of reports we can not explain in detail here why your report is not
a bug.  The support channels will be able to provide an explanation
for you.

Thank you for your interest in PHP.

This is not a support forum.



[2005-04-08 02:03:04] mjs15451 at hotmail dot com

Description:

I'm trying to build a secure application which can run in safe mode and
prevent session fixation and hijacking.  I would like to regenerate the
session id on every request and delete the old sess_* file immediately
after the new one is created.  If I cannot delete it immediately, I
have to rely on garbage collection which won't delete any files after
the session expiration time of 24 minutes or whatever you set it to. 
As a result, this generates a lot of session files which takes up
unnecessary space on the hard drive.  The problem with this scenario is
in safe mode I can't unlink the old session file because it's owned by
the server process which is obviously not the same uid/gid as the php
file.  I can't use session_destroy as it just destroys the current
session and when you start the session again, session_start just uses
the same file name again.  Would it be possible to give session_start
the ability to inherit the same ownership of the file in which it is
being called and apply that ownership to the sess_* file?  Or perhaps
would it be possible to have a flag for session_regenerate_id to unlink
the old file immediately instead of relying on garbage collection?  I'd
rather not have to use session_set_save_handler if that's possible as
the built-in functions are faster and I like speed.

Reproduce code:
---
session_start();
$oldSessionID = session_id();

/* 
new argument for session_regenerate_id could delete old sess_* file
immediately? 
*/

session_regenerate_id(); 

/* **OR** The sess_* file that was created with session_start(); could
have the same ownership as the template that called it so that one
could unlink it in safe mode? */

unlink(session_save_path(). "sess_" . $oldSessionID);


Expected result:

Either session_regenerate_id() deletes the old session file or the
sess_* file has the same ownership (and not the server process
ownership it currently has) to make it possible to unlink in safe mode.

Actual result:
--
It's not possible to unlink old sess_* file in safe mode and/or
session_regenerate_id() doesn't have the ability to delete the old
session file.  





-- 
Edit this bug report at http://bugs.php.net/?id=32631&edit=1


#24885 [Com]: session_destroy() should optionally take session id as parameter

2005-04-09 Thread mjs15451 at hotmail dot com
 ID:   24885
 Comment by:   mjs15451 at hotmail dot com
 Reported By:  dan at danposluns dot com
 Status:   Open
 Bug Type: Feature/Change Request
 Operating System: Mac OS X (Unix)
 PHP Version:  4.3.2
 New Comment:

I came up with a solution here since the php developers don't see a
need for this: http://bugs.php.net/bug.php?id=24096


Previous Comments:


[2003-07-31 09:40:21] dan at danposluns dot com

Description:

It would be very useful to have session_destroy() 
optionally take a session id as a parameter.

This would be useful for people who want to help 
prevent hijacked sessions by using 
session_regenerate_id(). A subsequent call to 
session_destroy([previous session id]) would keep 
hijackers from using the old session file, and is much 
simpler than trying to unlink the file manually.






-- 
Edit this bug report at http://bugs.php.net/?id=24885&edit=1


#24096 [Com]: session_regenerate_id not delete the old session file

2005-04-08 Thread mjs15451 at hotmail dot com
 ID:   24096
 Comment by:   mjs15451 at hotmail dot com
 Reported By:  pablo_sole at myp dot net dot ar
 Status:   Open
 Bug Type: Feature/Change Request
 Operating System: linux rh8 apache 1.3.27
 PHP Version:  4.3.2
 New Comment:

Don't know if this works on PHP 4, but this is what I did to get
session_regenerate_id to delete the old session file in PHP 5.  Replace
the session_regenerate_id function in session.c with this function I
modded:

PHP_FUNCTION(session_regenerate_id)
{
char *oldID = empty_string;
if (PS(session_status) == php_session_active) {
if (PS(id)) {
oldID = PS(id); //save old id
efree(PS(id));
}

PS(id) = PS(mod)->s_create_sid(&PS(mod_data), NULL
TSRMLS_CC);

php_session_reset_id(TSRMLS_C);

if (oldID != empty_string)
PS(mod)->s_destroy(&PS(mod_data), oldID TSRMLS_CC); //delete old
session file

RETURN_TRUE;
}
RETURN_FALSE;
}


Previous Comments:


[2005-04-08 17:38:28] mjs15451 at hotmail dot com

I would definitely be for auto-destruction of the old session file as I
have come upon this problem as well and I have made a similar
enhancement suggestion under bug: http://bugs.php.net/bug.php?id=32631



[2003-06-10 23:50:40] pablo_sole at myp dot net dot ar

You're right, in my own case i use this function to do a per-page
session (following OWASP's "Guide to Build Secure Web Applications" or
something like that), so what i'm doing is to refresh the id every time
a user do a request, but without lost the "statefulness". So, if you
think this need to be supported by the php sessions code, was an honor
help you, if not... i already do a little patch to support it on my own
server.

pablo.



[2003-06-09 23:11:00] [EMAIL PROTECTED]

-> Open



[2003-06-09 23:10:25] [EMAIL PROTECTED]

It is debatable whether the function should destroy the old session. 
The current behaviour is useful under a number of circumstances.
Auto-destruction could be added as a new feature though.

 -> Feature/Change request.



[2003-06-09 09:42:08] pablo_sole at myp dot net dot ar

testing the new session_regenerate_id i see that after upgrade de SID,
not unlink the old session file so, when you regenerate many times the
session could be used to make a DoS, or at least is not what it's
expected from the function.

Checking the source code, the routine free the SID and assign the new,
but not unlink the old file (just like in the php_session_destroy
routine).

A workaround could be unlink manualy on the fly, or patch the session.c
file.

Sorry my poor english, but is not my native language.

Any question, mail me.

pablo.

PD: I not have any "specific setup" or extra modules compiled in, and
for that reason i don't put it here.





-- 
Edit this bug report at http://bugs.php.net/?id=24096&edit=1


#32631 [Opn]: sess_* owner & session_regenerate_id

2005-04-08 Thread mjs15451 at hotmail dot com
 ID:   32631
 User updated by:  mjs15451 at hotmail dot com
 Reported By:  mjs15451 at hotmail dot com
 Status:   Open
 Bug Type: Feature/Change Request
 Operating System: *
 PHP Version:  4.*, 5.*
 New Comment:

Just modify session.c with this code and recompile php: 

PHP_FUNCTION(session_regenerate_id)
{
char *oldID = empty_string;
if (PS(session_status) == php_session_active) {
if (PS(id)) {
oldID = PS(id); //save old id
efree(PS(id));
}

PS(id) = PS(mod)->s_create_sid(&PS(mod_data), NULL
TSRMLS_CC);

php_session_reset_id(TSRMLS_C);

if (oldID != empty_string)
PS(mod)->s_destroy(&PS(mod_data), oldID TSRMLS_CC); //delete old
session file

RETURN_TRUE;
}
RETURN_FALSE;
}


Previous Comments:


[2005-04-08 17:39:52] mjs15451 at hotmail dot com

I believe this could be considered as a similar enhancement suggestion
to bug: http://bugs.php.net/bug.php?id=24096



[2005-04-08 17:00:08] mjs15451 at hotmail dot com

I wouldn't have mentioned it if I thought there was some documentation
for it somewhere.  Couldn't this be considered as en enhancement
suggestion?



[2005-04-08 09:10:24] [EMAIL PROTECTED]

Sorry, but your problem does not imply a bug in PHP itself.  For a
list of more appropriate places to ask for help using PHP, please
visit http://www.php.net/support.php as this bug system is not the
appropriate forum for asking support questions.  Due to the volume
of reports we can not explain in detail here why your report is not
a bug.  The support channels will be able to provide an explanation
for you.

Thank you for your interest in PHP.

This is not a support forum.



[2005-04-08 02:03:04] mjs15451 at hotmail dot com

Description:

I'm trying to build a secure application which can run in safe mode and
prevent session fixation and hijacking.  I would like to regenerate the
session id on every request and delete the old sess_* file immediately
after the new one is created.  If I cannot delete it immediately, I
have to rely on garbage collection which won't delete any files after
the session expiration time of 24 minutes or whatever you set it to. 
As a result, this generates a lot of session files which takes up
unnecessary space on the hard drive.  The problem with this scenario is
in safe mode I can't unlink the old session file because it's owned by
the server process which is obviously not the same uid/gid as the php
file.  I can't use session_destroy as it just destroys the current
session and when you start the session again, session_start just uses
the same file name again.  Would it be possible to give session_start
the ability to inherit the same ownership of the file in which it is
being called and apply that ownership to the sess_* file?  Or perhaps
would it be possible to have a flag for session_regenerate_id to unlink
the old file immediately instead of relying on garbage collection?  I'd
rather not have to use session_set_save_handler if that's possible as
the built-in functions are faster and I like speed.

Reproduce code:
---
session_start();
$oldSessionID = session_id();

/* 
new argument for session_regenerate_id could delete old sess_* file
immediately? 
*/

session_regenerate_id(); 

/* **OR** The sess_* file that was created with session_start(); could
have the same ownership as the template that called it so that one
could unlink it in safe mode? */

unlink(session_save_path(). "sess_" . $oldSessionID);


Expected result:

Either session_regenerate_id() deletes the old session file or the
sess_* file has the same ownership (and not the server process
ownership it currently has) to make it possible to unlink in safe mode.

Actual result:
--
It's not possible to unlink old sess_* file in safe mode and/or
session_regenerate_id() doesn't have the ability to delete the old
session file.  





-- 
Edit this bug report at http://bugs.php.net/?id=32631&edit=1


#32631 [Bgs->Opn]: sess_* owner & session_regenerate_id

2005-04-08 Thread mjs15451 at hotmail dot com
 ID:   32631
 User updated by:  mjs15451 at hotmail dot com
 Reported By:  mjs15451 at hotmail dot com
-Status:   Bogus
+Status:   Open
-Bug Type: Session related
+Bug Type: Feature/Change Request
 Operating System: *
 PHP Version:  4.*, 5.*
 New Comment:

I wouldn't have mentioned it if I thought there was some documentation
for it somewhere.  Couldn't this be considered as en enhancement
suggestion?


Previous Comments:


[2005-04-08 09:10:24] [EMAIL PROTECTED]

Sorry, but your problem does not imply a bug in PHP itself.  For a
list of more appropriate places to ask for help using PHP, please
visit http://www.php.net/support.php as this bug system is not the
appropriate forum for asking support questions.  Due to the volume
of reports we can not explain in detail here why your report is not
a bug.  The support channels will be able to provide an explanation
for you.

Thank you for your interest in PHP.

This is not a support forum.



[2005-04-08 02:03:04] mjs15451 at hotmail dot com

Description:

I'm trying to build a secure application which can run in safe mode and
prevent session fixation and hijacking.  I would like to regenerate the
session id on every request and delete the old sess_* file immediately
after the new one is created.  If I cannot delete it immediately, I
have to rely on garbage collection which won't delete any files after
the session expiration time of 24 minutes or whatever you set it to. 
As a result, this generates a lot of session files which takes up
unnecessary space on the hard drive.  The problem with this scenario is
in safe mode I can't unlink the old session file because it's owned by
the server process which is obviously not the same uid/gid as the php
file.  I can't use session_destroy as it just destroys the current
session and when you start the session again, session_start just uses
the same file name again.  Would it be possible to give session_start
the ability to inherit the same ownership of the file in which it is
being called and apply that ownership to the sess_* file?  Or perhaps
would it be possible to have a flag for session_regenerate_id to unlink
the old file immediately instead of relying on garbage collection?  I'd
rather not have to use session_set_save_handler if that's possible as
the built-in functions are faster and I like speed.

Reproduce code:
---
session_start();
$oldSessionID = session_id();

/* 
new argument for session_regenerate_id could delete old sess_* file
immediately? 
*/

session_regenerate_id(); 

/* **OR** The sess_* file that was created with session_start(); could
have the same ownership as the template that called it so that one
could unlink it in safe mode? */

unlink(session_save_path(). "sess_" . $oldSessionID);


Expected result:

Either session_regenerate_id() deletes the old session file or the
sess_* file has the same ownership (and not the server process
ownership it currently has) to make it possible to unlink in safe mode.

Actual result:
--
It's not possible to unlink old sess_* file in safe mode and/or
session_regenerate_id() doesn't have the ability to delete the old
session file.  





-- 
Edit this bug report at http://bugs.php.net/?id=32631&edit=1


#32631 [NEW]: sess_* owner & session_regenerate_id

2005-04-07 Thread mjs15451 at hotmail dot com
From: mjs15451 at hotmail dot com
Operating system: Linux
PHP version:  5.0.4
PHP Bug Type: Session related
Bug description:  sess_* owner & session_regenerate_id

Description:

I'm trying to build a secure application which can run in safe mode and
prevent session fixation and hijacking.  I would like to regenerate the
session id on every request and delete the old sess_* file immediately
after the new one is created.  If I cannot delete it immediately, I have
to rely on garbage collection which won't delete any files after the
session expiration time of 24 minutes or whatever you set it to.  As a
result, this generates a lot of session files which takes up unnecessary
space on the hard drive.  The problem with this scenario is in safe mode I
can't unlink the old session file because it's owned by the server process
which is obviously not the same uid/gid as the php file.  I can't use
session_destroy as it just destroys the current session and when you start
the session again, session_start just uses the same file name again.  Would
it be possible to give session_start the ability to inherit the same
ownership of the file in which it is being called and apply that ownership
to the sess_* file?  Or perhaps would it be possible to have a flag for
session_regenerate_id to unlink the old file immediately instead of
relying on garbage collection?  I'd rather not have to use
session_set_save_handler if that's possible as the built-in functions are
faster and I like speed.

Reproduce code:
---
session_start();
$oldSessionID = session_id();

/* 
new argument for session_regenerate_id could delete old sess_* file
immediately? 
*/

session_regenerate_id(); 

/* **OR** The sess_* file that was created with session_start(); could
have the same ownership as the template that called it so that one could
unlink it in safe mode? */

unlink(session_save_path(). "sess_" . $oldSessionID);


Expected result:

Either session_regenerate_id() deletes the old session file or the sess_*
file has the same ownership (and not the server process ownership it
currently has) to make it possible to unlink in safe mode.

Actual result:
--
It's not possible to unlink old sess_* file in safe mode and/or
session_regenerate_id() doesn't have the ability to delete the old session
file.  

-- 
Edit bug report at http://bugs.php.net/?id=32631&edit=1
-- 
Try a CVS snapshot (php4):   http://bugs.php.net/fix.php?id=32631&r=trysnapshot4
Try a CVS snapshot (php5.0): 
http://bugs.php.net/fix.php?id=32631&r=trysnapshot50
Try a CVS snapshot (php5.1): 
http://bugs.php.net/fix.php?id=32631&r=trysnapshot51
Fixed in CVS:http://bugs.php.net/fix.php?id=32631&r=fixedcvs
Fixed in release:http://bugs.php.net/fix.php?id=32631&r=alreadyfixed
Need backtrace:  http://bugs.php.net/fix.php?id=32631&r=needtrace
Need Reproduce Script:   http://bugs.php.net/fix.php?id=32631&r=needscript
Try newer version:   http://bugs.php.net/fix.php?id=32631&r=oldversion
Not developer issue: http://bugs.php.net/fix.php?id=32631&r=support
Expected behavior:   http://bugs.php.net/fix.php?id=32631&r=notwrong
Not enough info: 
http://bugs.php.net/fix.php?id=32631&r=notenoughinfo
Submitted twice: 
http://bugs.php.net/fix.php?id=32631&r=submittedtwice
register_globals:http://bugs.php.net/fix.php?id=32631&r=globals
PHP 3 support discontinued:  http://bugs.php.net/fix.php?id=32631&r=php3
Daylight Savings:http://bugs.php.net/fix.php?id=32631&r=dst
IIS Stability:   http://bugs.php.net/fix.php?id=32631&r=isapi
Install GNU Sed: http://bugs.php.net/fix.php?id=32631&r=gnused
Floating point limitations:  http://bugs.php.net/fix.php?id=32631&r=float
No Zend Extensions:  http://bugs.php.net/fix.php?id=32631&r=nozend
MySQL Configuration Error:   http://bugs.php.net/fix.php?id=32631&r=mysqlcfg


#29335 [Fbk->Opn]: mysqli_fetch_array resulttype

2004-07-25 Thread mjs15451 at hotmail dot com
 ID:   29335
 User updated by:  mjs15451 at hotmail dot com
 Reported By:  mjs15451 at hotmail dot com
-Status:   Feedback
+Status:   Open
 Bug Type: MySQL related
 Operating System: Linux
 PHP Version:  5.0.0
 New Comment:

CREATE TABLE `mailbox` (
  `username` varchar(255) NOT NULL default '',
  `password` varchar(255) NOT NULL default '',
  `name` varchar(255) NOT NULL default '',
  `maildir` varchar(255) NOT NULL default '',
  `quota` int(10) NOT NULL default '-1',
  `domain` varchar(255) NOT NULL default '',
  `created` datetime NOT NULL default '-00-00 00:00:00',
  `modified` datetime NOT NULL default '-00-00 00:00:00',
  `active` tinyint(4) NOT NULL default '1',
  PRIMARY KEY  (`username`),
  KEY `username` (`username`)
) ENGINE=MyISAM DEFAULT CHARSET=utf8;


INSERT INTO `mailbox` VALUES ('user1', 'testtest', 'User 1',
'example.com/user1/', 0, 'example.com', '2004-07-25 00:00:00',
'2004-07-25 00:00:00', 1);
INSERT INTO `mailbox` VALUES ('user2', 'testtest', 'User 2',
'example.com/user2/', 0, 'example.com', '2004-07-25 00:00:00',
'2004-07-25 00:00:00', 1);

";
}
$result = mysqli_query ($link, 'SELECT * FROM mailbox');
//Bad Code which doesn't print username
while ($row = mysqli_fetch_array ($result)){ //notice MYSQLI_BOTH,
MYSQL_ASSOC or MYSQLI_NUM missing
print "username:" . $row['username'] . ""; //username will not
output
}
?>


According to the docs on
http://us2.php.net/manual/en/function.mysqli-fetch-array.php:

mixed mysqli_fetch_array ( object result [, int resulttype])

The optional second argument resulttype is a constant indicating what
type of array should be produced from the current row data. The
possible values for this parameter are the constants MYSQLI_ASSOC,
MYSQLI_NUM, or MYSQLI_BOTH. By default the mysqli_fetch_array()
function will assume MYSQLI_BOTH for this parameter.

I don't see this happening with the second loop of this query.  I am
running Linux kernel 2.4.22, Apache 2.0.50, PHP 5.0.0 and Mysql
4.1.3beta


Previous Comments:
----------------

[2004-07-23 18:07:37] [EMAIL PROTECTED]

I can't reproduce it. 
 
please provide a short reproducable sample script. 



[2004-07-22 18:25:46] mjs15451 at hotmail dot com

Description:

If a resulttype is not specified when looping through a query, the
resulting array from mysqli_fetch_array does not return any data. 
MYSQLI_BOTH should be the default value for mysqli_fetch_array.


I'm also using MySQL 4.1.3beta

Reproduce code:
---
while ($row = mysqli_fetch_array($result)){
echo $row[0];
}

Expected result:

$row[0] should return the first column of the query. 

Actual result:
--
The while loop executes for the number of rows returned in the query
but $row[0] does not return any data.





-- 
Edit this bug report at http://bugs.php.net/?id=29335&edit=1


#29335 [NEW]: mysqli_fetch_array resulttype

2004-07-22 Thread mjs15451 at hotmail dot com
From: mjs15451 at hotmail dot com
Operating system: Linux
PHP version:  5.0.0
PHP Bug Type: MySQL related
Bug description:  mysqli_fetch_array resulttype

Description:

If a resulttype is not specified when looping through a query, the
resulting array from mysqli_fetch_array does not return any data. 
MYSQLI_BOTH should be the default value for mysqli_fetch_array.


I'm also using MySQL 4.1.3beta

Reproduce code:
---
while ($row = mysqli_fetch_array($result)){
echo $row[0];
}

Expected result:

$row[0] should return the first column of the query. 

Actual result:
--
The while loop executes for the number of rows returned in the query but
$row[0] does not return any data.

-- 
Edit bug report at http://bugs.php.net/?id=29335&edit=1
-- 
Try a CVS snapshot (php4):  http://bugs.php.net/fix.php?id=29335&r=trysnapshot4
Try a CVS snapshot (php5):  http://bugs.php.net/fix.php?id=29335&r=trysnapshot5
Fixed in CVS:   http://bugs.php.net/fix.php?id=29335&r=fixedcvs
Fixed in release:   http://bugs.php.net/fix.php?id=29335&r=alreadyfixed
Need backtrace: http://bugs.php.net/fix.php?id=29335&r=needtrace
Need Reproduce Script:  http://bugs.php.net/fix.php?id=29335&r=needscript
Try newer version:  http://bugs.php.net/fix.php?id=29335&r=oldversion
Not developer issue:http://bugs.php.net/fix.php?id=29335&r=support
Expected behavior:  http://bugs.php.net/fix.php?id=29335&r=notwrong
Not enough info:http://bugs.php.net/fix.php?id=29335&r=notenoughinfo
Submitted twice:http://bugs.php.net/fix.php?id=29335&r=submittedtwice
register_globals:   http://bugs.php.net/fix.php?id=29335&r=globals
PHP 3 support discontinued: http://bugs.php.net/fix.php?id=29335&r=php3
Daylight Savings:   http://bugs.php.net/fix.php?id=29335&r=dst
IIS Stability:  http://bugs.php.net/fix.php?id=29335&r=isapi
Install GNU Sed:http://bugs.php.net/fix.php?id=29335&r=gnused
Floating point limitations: http://bugs.php.net/fix.php?id=29335&r=float