composer/iTop
6
0
Fork 0
mirror of https://github.com/Combodo/iTop.git synced 2026-04-19 16:48:42 +02:00
Code Issues Packages Projects Releases Wiki Activity

Prevent a catchable fatal error when using memcache(d) as the session handler (regression introduced when fixing n°1778).

Browse Source
This commit is contained in:
Denis
2018-11-23 16:56:07 +01:00
parent f37f3c4c22
commit 1b4b71cb35
1 changed files with 21 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
core/userrights.class.inc.php
View File

@@ -1331,7 +1331,15 @@ class UserRights
{
$_SESSION['profile_list'] = self::ListProfiles();
}
// Protection against session fixation/injection: generate a new session id.
// Alas a PHP bug (technically a bug in the memcache session handler, https://bugs.php.net/bug.php?id=71187)
// causes session_regenerate_id to fail with a catchable fatal error in PHP 7.0 if the session handler is memcache(d).
// The bug has been fixed in PHP 7.2, but in case session_regenerate_id()
// fails we just silently ignore the error and keep the same session id...
$old_error_handler = set_error_handler(array(__CLASS__, 'VoidErrorHandler'));
session_regenerate_id();
if ($old_error_handler !== null) set_error_handler($old_error_handler);
}
public static function _ResetSessionCache()
@@ -1345,6 +1353,19 @@ class UserRights
unset($_SESSION['archive_allowed']);
}
}
/**
* Fake error handler to silently discard fatal errors
* @param int $iErrNo
* @param string $sErrStr
* @param string $sErrFile
* @param int $iErrLine
* @return boolean
*/
public static function VoidErrorHandler($iErrno, $sErrStr, $sErrFile, $iErrLine)
{
return true; // Ignore the error
}
}
/**