[2.3][HttpFoundation] PDO Session handling enhancements #7634
Conversation
For webhosts that have ini_set restricted (for security purposes), don't just blindly use ini_set if the INI setting is already set to what we need.
The rest of the Handler class assumes that a PDOException gets thrown when there's an issue, but doesn't enforce that requirement. This change explicitly sets that attribute.
| ini_set('session.cache_limiter', ''); // disable by default because it's managed by HeaderBag (if used) | ||
| ini_set('session.use_cookies', 1); | ||
| session_cache_limiter(''); | ||
| if (ini_get('session.use_cookies') != 1) ini_set('session.use_cookies', 1); |
| @@ -49,6 +49,7 @@ public function __construct(\PDO $pdo, array $dbOptions = array()) | |||
| throw new \InvalidArgumentException('You must provide the "db_table" option for a PdoSessionStorage.'); | |||
| } | |||
|
|
|||
| $pdo->setAttribute(\PDO::ATTR_ERRMODE, \PDO::ERRMODE_EXCEPTION); | |||
There was a problem hiding this comment.
the caller of this code - which created the pdo connection - may not like the fact that pdo will throw exceptions after creating this handler with it..
I think it would be better and less offensive to throw an exception when the ERRMODE is not EXCEPTION - than the user may decide if he likes to switch the ERRMODE (and therfore may change his other code which relies on his pdo connection and this setting) or not.
There was a problem hiding this comment.
Sure thing; that change is added in now!
Don't just change the PDO object attribute without asking; throw an InvalidArgument Exception instead. Check that the ini_set() call succeeded after its called.
| @@ -48,7 +48,9 @@ public function __construct(\PDO $pdo, array $dbOptions = array()) | |||
| if (!array_key_exists('db_table', $dbOptions)) { | |||
| throw new \InvalidArgumentException('You must provide the "db_table" option for a PdoSessionStorage.'); | |||
| } | |||
|
|
|||
| if ($pdo->getAttribute(\PDO::ATTR_ERRMODE) != \PDO::ERRMODE_EXCEPTION) { | |||
| throw new \InvalidArgumentException("Session Handler PDO must be set to throw Exceptions on error."); | |||
There was a problem hiding this comment.
the message should be more explicit, so a users knows what todo, e.g.
sprintf('"%s" requires PDO connection attribute PDO::ATTR_ERRMODE set to PDO::ERRMODE_EXCEPTION', __CLASS__)There was a problem hiding this comment.
Sure thing; added in a more descriptive error, with class name, and code fragment to update the PDO error mode. Along the same reasoning, should the error message two lines above be updated to use the class name as well, since "a PdoSessionStorage" doesn't match the class name (PdoSessionHandler)?
There was a problem hiding this comment.
you should add a unit test proving the exception is thrown as expected when ERRMODE differes from EXCEPTION
There was a problem hiding this comment.
Good point; I added in a few more unit tests for checking that situation, and ensuring a few other runtime errors are indeed getting thrown when they should.
| @@ -48,7 +48,9 @@ public function __construct(\PDO $pdo, array $dbOptions = array()) | |||
| if (!array_key_exists('db_table', $dbOptions)) { | |||
| throw new \InvalidArgumentException('You must provide the "db_table" option for a PdoSessionStorage.'); | |||
| } | |||
|
|
|||
| if ($pdo->getAttribute(\PDO::ATTR_ERRMODE) != \PDO::ERRMODE_EXCEPTION) { | |||
When making a comparison, use the strictest comparison possible, and put the literal comparator first.
| if (false === ini_set('session.use_cookies', 1)) { | ||
| throw new \RuntimeException('Failed to initialize the session to use cookies'); | ||
| } | ||
| } |
There was a problem hiding this comment.
Please revert this to just ini_set('session.use_cookies', 1);
|
@MidnightLightning - could you please add a CHANGELOG.md entry for this (it's in the HttpfFoundation component root. |
|
@fabpot - this PR seems ok to merge IMO |
PdoSessionHandlerclass assumes that the PDO object is set to throw exceptions, not errors. I added a line in the constructor to set that attribute, so configuration/query errors are able to be seen and caught a lot easier.