f3-factory / fatfree-core

Fat-Free Framework core library
GNU General Public License v3.0
207 stars 88 forks source link

Unwanted session start from \Template::instance()->render #320

Open radioboss opened 6 years ago

radioboss commented 6 years ago

When custom session handler is used (in my case it's \DB\SQL\Session), \Template::instance()->render call from a page where custom session handler is not initialized destroys the session cookie.

This appears to happen because of this code in base.php for the Preview->render method : if (isset($_COOKIE[session_name()]) && !headers_sent() && session_status()!=PHP_SESSION_ACTIVE) session_start();

Currently I work around this issue by calling unset($_COOKIE[session_name()]); before rendering, but I'd like to see an option to prevent render method starting the session in the first place.

ikkez commented 6 years ago

The problem is, you cannot access SESSION variables within the template, if the session was not started before. I can understand that starting a needless session is also less optimal, but there's currently no way to automatically know if there's access to a session var within a template or its filters and extentions. So to keep things working as they are right now, starting the session seems mandatory. Maybe we can adjust this behaviour with a setting and to let the developer decide when to start the session in a newer major version (v4).

radioboss commented 6 years ago

Yes, a parameter should do. Looking forward to v4, meanwhile I'll use the workaround.

Jiab77 commented 5 years ago

I'm using this code in my actual project to detect if the session array is initialized and not empty:

// Check if session is correctly initialized
// Return boolean
function session_active() {
    if (isset($_SESSION) && (is_array($_SESSION) && count($_SESSION)>0)) {
        return true;
    }
    else {
        return false;
    }
}

then just use it that way: if (session_active() === true) { #code }. it's pretty simple and can be minimized I guess.