Re: [RCD] Custom Session Handlers (was: Update 0.9.1 released)

On 05/27/2013 02:20 PM, till wrote:

As far as I understand, what happens in a request, stays in a request. I don't see how one request would override another.

Consider two requests:

• [R1] start file upload
• [R2] start file upload
• [R2] finish upload, save file info into $_SESSION['uploads'], exit
• [R1] finish upload, save file info into $_SESSION['uploads'], exit

In such case:

1. Will R1 overwrite $_SESSION['uploads'] set by R2? Yes. This however

I'm not sure now. It's also possible that because of session locking R2 will not finish before R1. 2. Will it lock session file while uploading which makes impossible to show upload progress?

They do — but RoundCube's session handling does something else which makes it incompatible with Suhosin.

This is known suhosin issue and I posted to the list already a link to PR that fixes it. So, please stop digging suhosin issue here.

https://github.com/stefanesser/suhosin/pull/26