fix(worker): reset ini settinfs and session if changed during worker request

Author: xavierleune

frankenphp.c

@@ -4,6 +4,7 @@
 #include <Zend/zend_interfaces.h>
 #include <Zend/zend_types.h>
 #include <errno.h>
+#include <ext/session/php_session.h>
 #include <ext/spl/spl_exceptions.h>
 #include <ext/standard/head.h>
 #include <inttypes.h>
@@ -73,6 +74,42 @@ bool should_filter_var = 0;
 __thread uintptr_t thread_index;
 __thread bool is_worker_thread = false;
 __thread zval *os_environment = NULL;
+__thread HashTable *worker_ini_snapshot = NULL;
+
+/* Session user handler names (same structure as PS(mod_user_names)).
+ * In PHP 8.2, mod_user_names is a union with .name.ps_* access.
+ * In PHP 8.3+, mod_user_names is a direct struct with .ps_* access. */
+typedef struct {
+  zval ps_open;
+  zval ps_close;
+  zval ps_read;
+  zval ps_write;
+  zval ps_destroy;
+  zval ps_gc;
+  zval ps_create_sid;
+  zval ps_validate_sid;
+  zval ps_update_timestamp;
+} session_user_handlers;
+
+/* Macro to access PS(mod_user_names) handlers across PHP versions */
+#if PHP_VERSION_ID >= 80300
+#define PS_MOD_USER_NAMES(handler) PS(mod_user_names).handler
+#else
+#define PS_MOD_USER_NAMES(handler) PS(mod_user_names).name.handler
+#endif
+
+#define FOR_EACH_SESSION_HANDLER(op)                                           \
+  op(ps_open);                                                                 \
+  op(ps_close);                                                                \
+  op(ps_read);                                                                 \
+  op(ps_write);                                                                \
+  op(ps_destroy);                                                              \
+  op(ps_gc);                                                                   \
+  op(ps_create_sid);                                                           \
+  op(ps_validate_sid);                                                         \
+  op(ps_update_timestamp)
+
+__thread session_user_handlers *worker_session_handlers_snapshot = NULL;
 
 void frankenphp_update_local_thread_context(bool is_worker) {
   is_worker_thread = is_worker;
@@ -174,6 +211,164 @@ static void frankenphp_release_temporary_streams() {
   ZEND_HASH_FOREACH_END();
 }
 
+/* Destructor for INI snapshot hash table entries */
+static void frankenphp_ini_snapshot_dtor(zval *zv) {
+  zend_string_release((zend_string *)Z_PTR_P(zv));
+}
+
+/* Save the current state of modified INI entries.
+ * This captures INI values set by the framework before the worker loop. */
+static void frankenphp_snapshot_ini(void) {
+  if (worker_ini_snapshot != NULL) {
+    return; /* Already snapshotted */
+  }
+
+  if (EG(modified_ini_directives) == NULL) {
+    /* Allocate empty table to mark as snapshotted */
+    ALLOC_HASHTABLE(worker_ini_snapshot);
+    zend_hash_init(worker_ini_snapshot, 0, NULL, frankenphp_ini_snapshot_dtor, 0);
+    return;
+  }
+
+  uint32_t num_modified = zend_hash_num_elements(EG(modified_ini_directives));
+  ALLOC_HASHTABLE(worker_ini_snapshot);
+  zend_hash_init(worker_ini_snapshot, num_modified, NULL, frankenphp_ini_snapshot_dtor, 0);
+
+  zend_ini_entry *ini_entry;
+  ZEND_HASH_FOREACH_PTR(EG(modified_ini_directives), ini_entry) {
+    if (ini_entry->value) {
+      zend_hash_add_ptr(worker_ini_snapshot, ini_entry->name,
+                        zend_string_copy(ini_entry->value));
+    }
+  }
+  ZEND_HASH_FOREACH_END();
+}
+
+/* Restore INI values to the state captured by frankenphp_snapshot_ini().
+ * - Entries in snapshot with changed values: restore to snapshot value
+ * - Entries not in snapshot: restore to startup default */
+static void frankenphp_restore_ini(void) {
+  if (worker_ini_snapshot == NULL || EG(modified_ini_directives) == NULL) {
+    return;
+  }
+
+  zend_ini_entry *ini_entry;
+  zend_string *snapshot_value;
+  zend_string *entry_name;
+
+  /* Collect entries to restore to default in a separate array.
+   * We cannot call zend_restore_ini_entry() during iteration because
+   * it calls zend_hash_del() on EG(modified_ini_directives). */
+  uint32_t max_entries = zend_hash_num_elements(EG(modified_ini_directives));
+  zend_string **entries_to_restore =
+      max_entries ? emalloc(max_entries * sizeof(zend_string *)) : NULL;
+  size_t restore_count = 0;
+
+  ZEND_HASH_FOREACH_STR_KEY_PTR(EG(modified_ini_directives), entry_name,
+                                ini_entry) {
+    snapshot_value = zend_hash_find_ptr(worker_ini_snapshot, entry_name);
+
+    if (snapshot_value == NULL) {
+      /* Entry was not in snapshot: collect for restore to startup default */
+      entries_to_restore[restore_count++] = zend_string_copy(entry_name);
+    } else if (!zend_string_equals(ini_entry->value, snapshot_value)) {
+      /* Entry was in snapshot but value changed: restore to snapshot value.
+       * zend_alter_ini_entry() does not delete from modified_ini_directives. */
+      zend_alter_ini_entry(entry_name, snapshot_value, PHP_INI_USER,
+                           PHP_INI_STAGE_RUNTIME);
+    }
+    /* else: Entry in snapshot with same value, nothing to do */
+  }
+  ZEND_HASH_FOREACH_END();
+
+  /* Now restore entries to default outside of iteration */
+  for (size_t i = 0; i < restore_count; i++) {
+    zend_restore_ini_entry(entries_to_restore[i], PHP_INI_STAGE_RUNTIME);
+    zend_string_release(entries_to_restore[i]);
+  }
+  if (entries_to_restore) {
+    efree(entries_to_restore);
+  }
+}
+
+/* Save session user handlers set before the worker loop.
+ * This allows frameworks to define custom session handlers that persist. */
+static void frankenphp_snapshot_session_handlers(void) {
+  if (worker_session_handlers_snapshot != NULL) {
+    return; /* Already snapshotted */
+  }
+
+  /* Check if session module is loaded */
+  if (zend_hash_str_find_ptr(&module_registry, "session",
+                             sizeof("session") - 1) == NULL) {
+    return; /* Session module not available */
+  }
+
+  /* Check if user session handlers are defined */
+  if (Z_ISUNDEF(PS_MOD_USER_NAMES(ps_open))) {
+    return; /* No user handlers to snapshot */
+  }
+
+  worker_session_handlers_snapshot = emalloc(sizeof(session_user_handlers));
+
+  /* Copy each handler zval with incremented reference count */
+#define SNAPSHOT_HANDLER(h)                                                    \
+  if (!Z_ISUNDEF(PS_MOD_USER_NAMES(h))) {                                      \
+    ZVAL_COPY(&worker_session_handlers_snapshot->h, &PS_MOD_USER_NAMES(h));    \
+  } else {                                                                     \
+    ZVAL_UNDEF(&worker_session_handlers_snapshot->h);                          \
+  }
+
+  FOR_EACH_SESSION_HANDLER(SNAPSHOT_HANDLER);
+
+#undef SNAPSHOT_HANDLER
+}
+
+/* Restore session user handlers from snapshot after RSHUTDOWN freed them. */
+static void frankenphp_restore_session_handlers(void) {
+  if (worker_session_handlers_snapshot == NULL) {
+    return;
+  }
+
+  /* Restore each handler zval.
+   * Session RSHUTDOWN already freed the handlers via zval_ptr_dtor and set
+   * them to UNDEF, so we don't need to destroy them again. We simply copy
+   * from the snapshot (which holds its own reference). */
+#define RESTORE_HANDLER(h)                                                     \
+  if (!Z_ISUNDEF(worker_session_handlers_snapshot->h)) {                       \
+    ZVAL_COPY(&PS_MOD_USER_NAMES(h), &worker_session_handlers_snapshot->h);    \
+  }
+
+  FOR_EACH_SESSION_HANDLER(RESTORE_HANDLER);
+
+#undef RESTORE_HANDLER
+}
+
+/* Free worker state when the worker script terminates. */
+static void frankenphp_cleanup_worker_state(void) {
+  /* Free INI snapshot */
+  if (worker_ini_snapshot != NULL) {
+    zend_hash_destroy(worker_ini_snapshot);
+    FREE_HASHTABLE(worker_ini_snapshot);
+    worker_ini_snapshot = NULL;
+  }
+
+  /* Free session handlers snapshot */
+  if (worker_session_handlers_snapshot != NULL) {
+#define FREE_HANDLER(h)                                                        \
+  if (!Z_ISUNDEF(worker_session_handlers_snapshot->h)) {                       \
+    zval_ptr_dtor(&worker_session_handlers_snapshot->h);                       \
+  }
+
+    FOR_EACH_SESSION_HANDLER(FREE_HANDLER);
+
+#undef FREE_HANDLER
+
+    efree(worker_session_handlers_snapshot);
+    worker_session_handlers_snapshot = NULL;
+  }
+}
+
 /* Adapted from php_request_shutdown */
 static void frankenphp_worker_request_shutdown() {
   /* Flush all output buffers */
@@ -208,6 +403,12 @@ bool frankenphp_shutdown_dummy_request(void) {
     return false;
   }
 
+  /* Snapshot INI and session handlers BEFORE shutdown.
+   * The framework has set these up before the worker loop, and we want
+   * to preserve them. Session RSHUTDOWN will free the handlers. */
+  frankenphp_snapshot_ini();
+  frankenphp_snapshot_session_handlers();
+
   frankenphp_worker_request_shutdown();
 
   return true;
@@ -263,6 +464,12 @@ static int frankenphp_worker_request_startup() {
 
     frankenphp_reset_super_globals();
 
+    /* Restore INI values changed during the previous request back to their
+     * snapshot state (captured in frankenphp_shutdown_dummy_request).
+     * This ensures framework settings persist while request-level changes
+     * are reset. */
+    frankenphp_restore_ini();
+
     const char **module_name;
     zend_module_entry *module;
     for (module_name = MODULES_TO_RELOAD; *module_name; module_name++) {
@@ -272,6 +479,12 @@ static int frankenphp_worker_request_startup() {
         module->request_startup_func(module->type, module->module_number);
       }
     }
+
+    /* Restore session handlers AFTER session RINIT.
+     * Session RSHUTDOWN frees mod_user_names callbacks, so we must restore
+     * them before user code runs. This must happen after RINIT because
+     * session RINIT may reset some state. */
+    frankenphp_restore_session_handlers();
   }
   zend_catch { retval = FAILURE; }
   zend_end_try();
@@ -617,6 +830,9 @@ static zend_module_entry frankenphp_module = {
     STANDARD_MODULE_PROPERTIES};
 
 static void frankenphp_request_shutdown() {
+  if (is_worker_thread) {
+    frankenphp_cleanup_worker_state();
+  }
   php_request_shutdown((void *)0);
   frankenphp_free_request_context();
 }