stefangabos / Zebra_Session

A drop-in replacement for PHP's default session handler which stores session data in a MySQL database, providing better performance, better security and protection against session fixation and session hijacking
https://stefangabos.github.io/Zebra_Session/Zebra_Session/Zebra_Session.html
Other
172 stars 85 forks source link

Incorrect user-level lock name #16

Closed aheissenberger closed 5 years ago

aheissenberger commented 7 years ago

stack trace

Warning: mysqli_query(): (42000/3057): Incorrect user-level lock name 'session_cc306b6d344385e4069fb57d1650f23f7df633e10d07cb5896f8bdf113db0e35e13008b78ea137dc5e3bd74be9acfc42c86e632ee3ca5003e2626d5fc8f99dc2'. in /var/www/html/vendor/stefangabos/zebra_session/Zebra_Session.php on line 752
  |  
  | Call Stack:
  | 0.2160     242912   1. {main}() /var/www/html/ah_test_auth.php:0
  | 0.2250     263040   2. Zebra_Session->__construct() /var/www/html/ah_test_auth.php:20
  | 0.2251     267792   3. session_start() /var/www/html/vendor/stefangabos/zebra_session/Zebra_Session.php:269
  | 0.2251     268728   4. Zebra_Session->read() /var/www/html/vendor/stefangabos/zebra_session/Zebra_Session.php:269
  | 0.2251     269344   5. Zebra_Session->_mysql_query() /var/www/html/vendor/stefangabos/zebra_session/Zebra_Session.php:467
  | 0.2251     269392   6. mysqli_query() /var/www/html/vendor/stefangabos/zebra_session/Zebra_Session.php:752

Environment:

Test Cases maximum valid key length: 64 characters SELECT GET_LOCK('1234567890123456789012345678901234567890123456789012345678901234', '5');

fails with everything bigger: SELECT GET_LOCK('12345678901234567890123456789012345678901234567890123456789012345', '5');

mysql error: Incorrect user-level lock name '12345678901234567890123456789012345678901234567890123456789012345'.

aditional information the key length got smaller since the new implementation of GET_LOCK in mySQL 5.7.5 https://dev.mysql.com/doc/refman/5.7/en/miscellaneous-functions.html#function_get-lock https://github.com/go-sql-driver/mysql/issues/385

quick fix https://github.com/aheissenberger/Zebra_Session/commit/f84d0dfe9b7d572e73e4a6753edb74a406a30073

But I think it would better to create an extra column which contains this key to remove the constant creation of this key on every read request.

Additional I would suggest to add the information about different possible session key length based on the php.ini setting session.hash_function as this is very often set by the provider.

baoutch commented 7 years ago

As this is popping as first result on Google, in case anyone bumping on this error on Magento 1.X, this can be fixed by rewriting Mage_Index_Model_Resource_Helper_Mysql4 and changing setLock, releaseLock and isLocked methods changing $name by sha1($name) in query as advised in quick fix link.

stefangabos commented 5 years ago

Thank you for this!