Debian Bug report logs - #521619
php5-cgi: one script curling another one with Cookie header on same web server result in a deadlock

[Message part 1 (text/plain, inline)]
Package: php5-cgi
Version: 5.2.9.dfsg.1-1
Severity: normal

Let's define two scripts, each one using session_start().
The first script calls the second one, using call, and setting a Cookie http header
with the current session in it.
It results in the second script never returning from that call.

Tested with lighttpd+fastcgi, apache2+modphp5, cherokee+fastcgi.

The only case where it doesn't hangs is calling the script directly from command-line :
php5 -f firstscript.php

Using php5-cgi from command line doesn't show anything due to 
"Cannot send session cookie - headers already sent"

I set up a simple example, see in attachment.

-- System Information:
Debian Release: squeeze/sid
  APT prefers unstable
  APT policy: (500, 'unstable'), (500, 'testing'), (500, 'stable'), (1, 'experimental')
Architecture: i386 (i686)

Kernel: Linux 2.6.29-rc7 (SMP w/2 CPU cores)
Locale: LANG=fr_FR.UTF-8, LC_CTYPE=fr_FR.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash

Versions of packages php5-cgi depends on:
ii  libbz2-1.0           1.0.5-1             high-quality block-sorting file co
ii  libc6                2.9-6               GNU C Library: Shared libraries
ii  libcomerr2           1.41.3-1            common error description library
ii  libdb4.6             4.6.21-13           Berkeley v4.6 Database Libraries [
ii  libgssapi-krb5-2     1.6.dfsg.4~beta1-12 MIT Kerberos runtime libraries - k
ii  libk5crypto3         1.6.dfsg.4~beta1-12 MIT Kerberos runtime libraries - C
ii  libkrb5-3            1.6.dfsg.4~beta1-12 MIT Kerberos runtime libraries
ii  libmagic1            5.00-1              File type determination library us
ii  libpcre3             7.8-2+b1            Perl 5 Compatible Regular Expressi
ii  libssl0.9.8          0.9.8g-15           SSL shared libraries
ii  libxml2              2.7.3.dfsg-1        GNOME XML library
ii  mime-support         3.44-1              MIME files 'mime.types' & 'mailcap
ii  php5-common          5.2.9.dfsg.1-1      Common files for packages built fr
ii  tzdata               2009d-1             time zone and daylight-saving time
ii  ucf                  3.0018              Update Configuration File: preserv
ii  zlib1g               1:1.2.3.3.dfsg-13   compression library - runtime

php5-cgi recommends no packages.

Versions of packages php5-cgi suggests:
ii  php-pear                  5.2.9.dfsg.1-1 PEAR - PHP Extension and Applicati

-- no debconf information

[session-hangs-example.tar.gz (application/x-gzip, attachment)]
one should read :
The first script calls the second one, using *CURL*

quotes from [1]
"as session data is locked to prevent concurrent writes only one script may operate on a session at any time"

[1]
http://www.php.net/manual/en/function.session-write-close.php

it's a feature :)

[Message part 1 (text/plain, inline)]
okay, closing the br then :)

On Sun, Mar 29, 2009 at 04:56:00AM +0200, Jérémy Lal wrote:
> it's a feature :)
> 
> 
> 
> _______________________________________________
> pkg-php-maint mailing list
> pkg-php-maint@lists.alioth.debian.org
> http://lists.alioth.debian.org/mailman/listinfo/pkg-php-maint
> 

-- 

[signature.asc (application/pgp-signature, inline)]

Debian Bug report logs - #521619 php5-cgi: one script curling another one with Cookie header on same web server result in a deadlock

Debian Bug report logs - #521619
php5-cgi: one script curling another one with Cookie header on same web server result in a deadlock