Test failure in ext/session/tests/gh13856.phpt

[orlitzky]

Description

On Gentoo this test works flawlessly when it is supposed to emit warnings. The contents of gh13856.log are,

---- EXPECTED OUTPUT
Warning: SessionHandler::open(): open_basedir restriction in effect. File(%s) is not within the allowed path(s): (.) in %s on line %d

Warning: SessionHandler::close(): Parent session handler is not open in %s on line %d

Warning: session_start(): Failed to initialize storage module: user (path: ) in %s on line %d
---- ACTUAL OUTPUT

---- FAILED

We're running the test suite from within /var/lib/portage/tmp/portage/dev-lang/php-8.3.7/work/php-8.3.7, and with a command that is highly fudged but ideally equivalent to,

export TEST_PHP_EXTRA_ARGS="-n"
SKIP_IO_CAPTURE_TESTS=1 SKIP_PERF_SENSITIVE=1 REPORT_EXIT_STATUS=1 \
/var/lib/portage/tmp/portage/dev-lang/php-8.3.7/work/sapis-build/cli/sapi/cli/php \
/var/lib/portage/tmp/portage/dev-lang/php-8.3.7/work/sapis-build/cli/run-tests.php \
--offline -n -q -d "session.save_path=/var/lib/portage/tmp/portage/dev-lang/php-8.3.7/temp"

I can't yet explain the quiet test based on that, but it fails nonetheless.

PHP Version

PHP 8.3.7

Operating System

No response

[nielsdos]

I suppose it's possible that error_reporting is somehow overridden. If you add the following section to the testfile, under the --EXTENSIONS-- section, does it work then?

--INI--
error_reporting=-1

[orlitzky]

Giving it a try now, each round trip takes about an hour. Last data point: switching it to open_basedir=/dev/null doesn't help.

[orlitzky]

I suppose it's possible that error_reporting is somehow overridden. If you add the following section to the testfile, under the --EXTENSIONS-- section, does it work then?

--INI--
error_reporting=-1

Unfortunately this did not help.

[orlitzky]

Here's a silly question. In ext/session/mod_files.c I see,

PS_OPEN_FUNC(files)
{
        ps_files *data;
        const char *p, *last;
        const char *argv[3];
        int argc = 0;
	size_t dirdepth = 0;
	int filemode = 0600;

        if (*save_path == '\0') {
                /* if save path is an empty string, determine the temporary dir */
                save_path = php_get_temporary_directory();

                if (php_check_open_basedir(save_path)) {
                        return FAILURE;
                }
        }

Is that skipping the open_basedir() check entirely when session.save_path is defined?

[nielsdos]

Indeed, so the fix is to simply set the save_path to the empty string. Thanks for reporting.