• Aaron Wells's avatar
    Bug 1570744: Fixing session bugs · 83ec33f2
    Aaron Wells authored
    This patch does 2 things:
    
    1. It loads the session much earlier during init.php. We wind
    up creating one on *every* script load anyway, due to LiveUser's
    constructor. Sometimes it gets created earlier if other code
    tries to use it before then, which adds some unpredictability
    to things. Moving it up to the top of init.php reduces that
    unpredictability.
    
    2. It turns out that in PHP 5.3, using header_remove('Set-Cookie')
    to only doesn't remove session headers. But header_remove()
    (with no params) to remove *all* cookies does remove them. So
    I'm changing remove_duplicate_cookies() to use that instead.
    
    3. Also in PHP 5.3, session headers are visible in headers_list().
    In situations where your session id changes (due to session_destroy()
    and session_regenerate_id()), our use of array_unique() meant we
    would preserve the old and new session IDs and send both back
    to the browser. This patch makes remove_duplicate_cookies() aware
    of the current session ID, and it only preserves that one.
    
    Change-Id: I7a90b8692a5f97429415aa9a17451a44cd2109dd
    behatnotneeded: Covered by existing tests
    83ec33f2
init.php 16.1 KB