Skip to content

Commit 08b9310

Browse files
frederikboschcmb69
frederikbosch
authored and
cmb69
committed
1 parent 3ccd985 commit 08b9310

12 files changed

Lines changed: 149 additions & 27 deletions

‎ext/session/php_session.h‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -155,6 +155,7 @@ typedef struct _php_ps_globals {
155155
char *cookie_domain;
156156
zend_bool cookie_secure;
157157
zend_bool cookie_httponly;
158+
char *cookie_samesite;
158159
const ps_module *mod;
159160
const ps_module *default_mod;
160161
void *mod_data;

‎ext/session/session.c‎

Lines changed: 17 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -802,6 +802,7 @@ PHP_INI_BEGIN()
802802
STD_PHP_INI_ENTRY("session.cookie_domain", "", PHP_INI_ALL, OnUpdateSessionString, cookie_domain, php_ps_globals, ps_globals)
803803
STD_PHP_INI_ENTRY("session.cookie_secure", "0", PHP_INI_ALL, OnUpdateSessionBool, cookie_secure, php_ps_globals, ps_globals)
804804
STD_PHP_INI_ENTRY("session.cookie_httponly", "0", PHP_INI_ALL, OnUpdateSessionBool, cookie_httponly, php_ps_globals, ps_globals)
805+
STD_PHP_INI_ENTRY("session.cookie_samesite", "", PHP_INI_ALL, OnUpdateString, cookie_samesite, php_ps_globals, ps_globals)
805806
STD_PHP_INI_ENTRY("session.use_cookies", "1", PHP_INI_ALL, OnUpdateSessionBool, use_cookies, php_ps_globals, ps_globals)
806807
STD_PHP_INI_ENTRY("session.use_only_cookies", "1", PHP_INI_ALL, OnUpdateSessionBool, use_only_cookies, php_ps_globals, ps_globals)
807808
STD_PHP_INI_ENTRY("session.use_strict_mode", "0", PHP_INI_ALL, OnUpdateSessionBool, use_strict_mode, php_ps_globals, ps_globals)
@@ -1360,6 +1361,11 @@ static int php_session_send_cookie(void) /* {{{ */
13601361
smart_str_appends(&ncookie, COOKIE_HTTPONLY);
13611362
}
13621363

1364+
if (PS(cookie_samesite)[0]) {
1365+
smart_str_appends(&ncookie, COOKIE_SAMESITE);
1366+
smart_str_appends(&ncookie, PS(cookie_samesite));
1367+
}
1368+
13631369
smart_str_0(&ncookie);
13641370

13651371
php_session_remove_cookie(); /* remove already sent session ID cookie */
@@ -1658,18 +1664,18 @@ PHPAPI void session_adapt_url(const char *url, size_t urllen, char **new, size_t
16581664
* Userspace exported functions *
16591665
******************************** */
16601666

1661-
/* {{{ proto bool session_set_cookie_params(int lifetime [, string path [, string domain [, bool secure[, bool httponly]]]])
1667+
/* {{{ proto void session_set_cookie_params(int lifetime [, string path [, string domain [, bool secure[, bool httponly[, string samesite]]]]])
16621668
Set session cookie parameters */
16631669
static PHP_FUNCTION(session_set_cookie_params)
16641670
{
16651671
zval *lifetime;
1666-
zend_string *path = NULL, *domain = NULL;
1672+
zend_string *path = NULL, *domain = NULL, *samesite = NULL;
16671673
int argc = ZEND_NUM_ARGS();
16681674
zend_bool secure = 0, httponly = 0;
16691675
zend_string *ini_name;
16701676

16711677
if (!PS(use_cookies) ||
1672-
zend_parse_parameters(argc, "z|SSbb", &lifetime, &path, &domain, &secure, &httponly) == FAILURE) {
1678+
zend_parse_parameters(argc, "z|SSbbS", &lifetime, &path, &domain, &secure, &httponly, &samesite) == FAILURE) {
16731679
return;
16741680
}
16751681

@@ -1727,6 +1733,12 @@ static PHP_FUNCTION(session_set_cookie_params)
17271733
zend_string_release_ex(ini_name, 0);
17281734
}
17291735

1736+
if (argc > 5) {
1737+
ini_name = zend_string_init("session.cookie_samesite", sizeof("session.cookie_samesite") - 1, 0);
1738+
zend_alter_ini_entry(ini_name, samesite, PHP_INI_USER, PHP_INI_STAGE_RUNTIME);
1739+
zend_string_release(ini_name);
1740+
}
1741+
17301742
RETURN_TRUE;
17311743
}
17321744
/* }}} */
@@ -1746,6 +1758,7 @@ static PHP_FUNCTION(session_get_cookie_params)
17461758
add_assoc_string(return_value, "domain", PS(cookie_domain));
17471759
add_assoc_bool(return_value, "secure", PS(cookie_secure));
17481760
add_assoc_bool(return_value, "httponly", PS(cookie_httponly));
1761+
add_assoc_string(return_value, "samesite", PS(cookie_samesite));
17491762
}
17501763
/* }}} */
17511764

@@ -2630,6 +2643,7 @@ ZEND_BEGIN_ARG_INFO_EX(arginfo_session_set_cookie_params, 0, 0, 1)
26302643
ZEND_ARG_INFO(0, domain)
26312644
ZEND_ARG_INFO(0, secure)
26322645
ZEND_ARG_INFO(0, httponly)
2646+
ZEND_ARG_INFO(0, samesite)
26332647
ZEND_END_ARG_INFO()
26342648

26352649
ZEND_BEGIN_ARG_INFO(arginfo_session_class_open, 0)

‎ext/session/tests/session_get_cookie_params_basic.phpt‎

Lines changed: 12 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ session.cookie_path="/"
88
session.cookie_domain=""
99
session.cookie_secure=0
1010
session.cookie_httponly=0
11+
session.cookie_samesite=""
1112
--FILE--
1213
<?php
1314

@@ -22,17 +23,17 @@ ob_start();
2223
echo "*** Testing session_get_cookie_params() : basic functionality ***\n";
2324

2425
var_dump(session_get_cookie_params());
25-
var_dump(session_set_cookie_params(3600, "/path", "blah", FALSE, FALSE));
26+
var_dump(session_set_cookie_params(3600, "/path", "blah", FALSE, FALSE, "foo"));
2627
var_dump(session_get_cookie_params());
27-
var_dump(session_set_cookie_params(1234567890, "/guff", "foo", TRUE, TRUE));
28+
var_dump(session_set_cookie_params(1234567890, "/guff", "foo", TRUE, TRUE, "blah"));
2829
var_dump(session_get_cookie_params());
2930

3031
echo "Done";
3132
ob_end_flush();
3233
?>
3334
--EXPECT--
3435
*** Testing session_get_cookie_params() : basic functionality ***
35-
array(5) {
36+
array(6) {
3637
["lifetime"]=>
3738
int(0)
3839
["path"]=>
@@ -43,9 +44,11 @@ array(5) {
4344
bool(false)
4445
["httponly"]=>
4546
bool(false)
47+
["samesite"]=>
48+
string(0) ""
4649
}
4750
bool(true)
48-
array(5) {
51+
array(6) {
4952
["lifetime"]=>
5053
int(3600)
5154
["path"]=>
@@ -56,9 +59,11 @@ array(5) {
5659
bool(false)
5760
["httponly"]=>
5861
bool(false)
62+
["samesite"]=>
63+
string(3) "foo"
5964
}
6065
bool(true)
61-
array(5) {
66+
array(6) {
6267
["lifetime"]=>
6368
int(1234567890)
6469
["path"]=>
@@ -69,5 +74,7 @@ array(5) {
6974
bool(true)
7075
["httponly"]=>
7176
bool(true)
77+
["samesite"]=>
78+
string(4) "blah"
7279
}
7380
Done

‎ext/session/tests/session_get_cookie_params_variation1.phpt‎

Lines changed: 35 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ session.cookie_path="/"
88
session.cookie_domain=""
99
session.cookie_secure=0
1010
session.cookie_httponly=0
11+
session.cookie_samesite=""
1112
--FILE--
1213
<?php
1314

@@ -32,13 +33,15 @@ ini_set("session.cookie_secure", TRUE);
3233
var_dump(session_get_cookie_params());
3334
ini_set("session.cookie_httponly", TRUE);
3435
var_dump(session_get_cookie_params());
36+
ini_set("session.cookie_samesite", "foo");
37+
var_dump(session_get_cookie_params());
3538

3639
echo "Done";
3740
ob_end_flush();
3841
?>
3942
--EXPECT--
4043
*** Testing session_get_cookie_params() : variation ***
41-
array(5) {
44+
array(6) {
4245
["lifetime"]=>
4346
int(0)
4447
["path"]=>
@@ -49,8 +52,10 @@ array(5) {
4952
bool(false)
5053
["httponly"]=>
5154
bool(false)
55+
["samesite"]=>
56+
string(0) ""
5257
}
53-
array(5) {
58+
array(6) {
5459
["lifetime"]=>
5560
int(3600)
5661
["path"]=>
@@ -61,8 +66,10 @@ array(5) {
6166
bool(false)
6267
["httponly"]=>
6368
bool(false)
69+
["samesite"]=>
70+
string(0) ""
6471
}
65-
array(5) {
72+
array(6) {
6673
["lifetime"]=>
6774
int(3600)
6875
["path"]=>
@@ -73,8 +80,10 @@ array(5) {
7380
bool(false)
7481
["httponly"]=>
7582
bool(false)
83+
["samesite"]=>
84+
string(0) ""
7685
}
77-
array(5) {
86+
array(6) {
7887
["lifetime"]=>
7988
int(3600)
8089
["path"]=>
@@ -85,8 +94,10 @@ array(5) {
8594
bool(false)
8695
["httponly"]=>
8796
bool(false)
97+
["samesite"]=>
98+
string(0) ""
8899
}
89-
array(5) {
100+
array(6) {
90101
["lifetime"]=>
91102
int(3600)
92103
["path"]=>
@@ -97,8 +108,10 @@ array(5) {
97108
bool(true)
98109
["httponly"]=>
99110
bool(false)
111+
["samesite"]=>
112+
string(0) ""
100113
}
101-
array(5) {
114+
array(6) {
102115
["lifetime"]=>
103116
int(3600)
104117
["path"]=>
@@ -109,6 +122,22 @@ array(5) {
109122
bool(true)
110123
["httponly"]=>
111124
bool(true)
125+
["samesite"]=>
126+
string(0) ""
127+
}
128+
array(6) {
129+
["lifetime"]=>
130+
int(3600)
131+
["path"]=>
132+
string(5) "/path"
133+
["domain"]=>
134+
string(3) "foo"
135+
["secure"]=>
136+
bool(true)
137+
["httponly"]=>
138+
bool(true)
139+
["samesite"]=>
140+
string(3) "foo"
112141
}
113142
Done
114143

‎ext/session/tests/session_set_cookie_params_variation3.phpt‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ session.cookie_domain=foo
1010
ob_start();
1111

1212
/*
13-
* Prototype : void session_set_cookie_params(int $lifetime [, string $path [, string $domain [, bool $secure [, bool $httponly]]]])
13+
* Prototype : void session_set_cookie_params(int $lifetime [, string $path [, string $domain [, bool $secure [, bool $httponly[, string $samesite]]]]])
1414
* Description : Set the session cookie parameters
1515
* Source code : ext/session/session.c
1616
*/

‎ext/session/tests/session_set_cookie_params_variation5.phpt‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ session.cookie_httponly=TRUE
1010
ob_start();
1111

1212
/*
13-
* Prototype : void session_set_cookie_params(int $lifetime [, string $path [, string $domain [, bool $secure [, bool $httponly]]]])
13+
* Prototype : void session_set_cookie_params(int $lifetime [, string $path [, string $domain [, bool $secure [, bool $httponly[, string $samesite]]]]])
1414
* Description : Set the session cookie parameters
1515
* Source code : ext/session/session.c
1616
*/

‎ext/session/tests/session_set_cookie_params_variation6.phpt‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
--TEST--
2+
Test session_set_cookie_params() function : variation
3+
--INI--
4+
session.cookie_samesite=test
5+
--SKIPIF--
6+
<?php include('skipif.inc'); ?>
7+
--FILE--
8+
<?php
9+
10+
ob_start();
11+
12+
/*
13+
* Prototype : void session_set_cookie_params(int $lifetime [, string $path [, string $domain [, bool $secure [, bool $samesite[, string $samesite]]]]])
14+
* Description : Set the session cookie parameters
15+
* Source code : ext/session/session.c
16+
*/
17+
18+
echo "*** Testing session_set_cookie_params() : variation ***\n";
19+
20+
var_dump(ini_get("session.cookie_samesite"));
21+
var_dump(session_set_cookie_params(3600, "/path", "blah", FALSE, FALSE, "nothing"));
22+
var_dump(ini_get("session.cookie_samesite"));
23+
var_dump(session_start());
24+
var_dump(ini_get("session.cookie_samesite"));
25+
var_dump(session_set_cookie_params(3600, "/path", "blah", FALSE, TRUE, "test"));
26+
var_dump(ini_get("session.cookie_samesite"));
27+
var_dump(session_destroy());
28+
var_dump(ini_get("session.cookie_samesite"));
29+
var_dump(session_set_cookie_params(3600, "/path", "blah", FALSE, FALSE, "other"));
30+
var_dump(ini_get("session.cookie_samesite"));
31+
32+
echo "Done";
33+
ob_end_flush();
34+
?>
35+
--EXPECTF--
36+
*** Testing session_set_cookie_params() : variation ***
37+
string(4) "test"
38+
bool(true)
39+
string(7) "nothing"
40+
bool(true)
41+
string(7) "nothing"
42+
43+
Warning: session_set_cookie_params(): Cannot change session cookie parameters when session is active in %s on line 18
44+
bool(false)
45+
string(7) "nothing"
46+
bool(true)
47+
string(7) "nothing"
48+
bool(true)
49+
string(5) "other"
50+
Done

‎ext/standard/basic_functions.c‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1436,6 +1436,7 @@ ZEND_BEGIN_ARG_INFO_EX(arginfo_setcookie, 0, 0, 1)
14361436
ZEND_ARG_INFO(0, domain)
14371437
ZEND_ARG_INFO(0, secure)
14381438
ZEND_ARG_INFO(0, httponly)
1439+
ZEND_ARG_INFO(0, samesite)
14391440
ZEND_END_ARG_INFO()
14401441

14411442
ZEND_BEGIN_ARG_INFO_EX(arginfo_setrawcookie, 0, 0, 1)
@@ -1446,6 +1447,7 @@ ZEND_BEGIN_ARG_INFO_EX(arginfo_setrawcookie, 0, 0, 1)
14461447
ZEND_ARG_INFO(0, domain)
14471448
ZEND_ARG_INFO(0, secure)
14481449
ZEND_ARG_INFO(0, httponly)
1450+
ZEND_ARG_INFO(0, samesite)
14491451
ZEND_END_ARG_INFO()
14501452

14511453
ZEND_BEGIN_ARG_INFO_EX(arginfo_headers_sent, 0, 0, 0)

0 commit comments

Comments
 (0)