This is an old revision of the document!

PHP RFC: Fix handling of custom session handler return values


The logic in ext/session/mod_user.c is just plain wrong.


  • “[For all callback functions] Return value is TRUE for success, FALSE for failure.”

Yet in ext/session/mod_user.c:

 PS_FUNC(user) {
  /* blah blah */
  zval *retval = ps_call_handler(PSF(func), argc, argc);
  if (retval) {
     return Z_LVAL_P(retval);
  return FAILURE;

Remembering that SUCCESS == 0, and FAILURE == -1

So what does that mean for return values?

  • return false => return (int)false => return 0 => return SUCCESS
  • return true => return (int)true) => return 1 => return NeitherSUCCESSnorFAILURE


Change the FINISH macro in session.c to map true to SUCCESS, false to FAILURE, warn (and fail) for integer -1, and warn (but succeed) for anything else.

Backward Incompatible Changes

  • Anyone currently returning -1 for failure (because that's what ends up working as expected) now gets a warning.
  • Anyone returning false for failure now actually goes down the failure path (and this might be unexpected due to how long this has been wrong).

Proposed PHP Version(s)

Either 5.next (5.7?) or phpng due to the age of this bug.


rfc/session.user.return-value.1400190953.txt.gz · Last modified: 2017/09/22 13:28 (external edit)