Merge remote-tracking branch 'upstream/develop' into 4.4

system/Entity/Entity.php

@@ -259,19 +259,19 @@ class Entity implements JsonSerializable
             return $this->original !== $this->attributes;
         }
 
-        $key = $this->mapProperty($key);
+        $dbColumn = $this->mapProperty($key);
 
         // Key doesn't exist in either
-        if (! array_key_exists($key, $this->original) && ! array_key_exists($key, $this->attributes)) {
+        if (! array_key_exists($dbColumn, $this->original) && ! array_key_exists($dbColumn, $this->attributes)) {
             return false;
         }
 
         // It's a new element
-        if (! array_key_exists($key, $this->original) && array_key_exists($key, $this->attributes)) {
+        if (! array_key_exists($dbColumn, $this->original) && array_key_exists($dbColumn, $this->attributes)) {
             return true;
         }
 
-        return $this->original[$key] !== $this->attributes[$key];
+        return $this->original[$dbColumn] !== $this->attributes[$dbColumn];
     }
 
     /**
@@ -447,19 +447,19 @@ class Entity implements JsonSerializable
      */
     public function __set(string $key, $value = null)
     {
-        $key = $this->mapProperty($key);
+        $dbColumn = $this->mapProperty($key);
 
         // Check if the field should be mutated into a date
-        if (in_array($key, $this->dates, true)) {
+        if (in_array($dbColumn, $this->dates, true)) {
             $value = $this->mutateDate($value);
         }
 
-        $value = $this->castAs($value, $key, 'set');
+        $value = $this->castAs($value, $dbColumn, 'set');
 
         // if a setter method exists for this key, use that method to
         // insert this value. should be outside $isNullable check,
         // so maybe wants to do sth with null value automatically
-        $method = 'set' . str_replace(' ', '', ucwords(str_replace(['-', '_'], ' ', $key)));
+        $method = 'set' . str_replace(' ', '', ucwords(str_replace(['-', '_'], ' ', $dbColumn)));
 
         // If a "`_set` + $key" method exists, it is a setter.
         if (method_exists($this, '_' . $method)) {
@@ -479,7 +479,7 @@ class Entity implements JsonSerializable
         // class properties that are undefined, though they cannot be
         // saved. Useful for grabbing values through joins, assigning
         // relationships, etc.
-        $this->attributes[$key] = $value;
+        $this->attributes[$dbColumn] = $value;
 
         return $this;
     }
@@ -500,12 +500,12 @@ class Entity implements JsonSerializable
      */
     public function __get(string $key)
     {
-        $key = $this->mapProperty($key);
+        $dbColumn = $this->mapProperty($key);
 
         $result = null;
 
         // Convert to CamelCase for the method
-        $method = 'get' . str_replace(' ', '', ucwords(str_replace(['-', '_'], ' ', $key)));
+        $method = 'get' . str_replace(' ', '', ucwords(str_replace(['-', '_'], ' ', $dbColumn)));
 
         // if a getter method exists for this key,
         // use that method to insert this value.
@@ -519,17 +519,17 @@ class Entity implements JsonSerializable
 
         // Otherwise return the protected property
         // if it exists.
-        elseif (array_key_exists($key, $this->attributes)) {
+        elseif (array_key_exists($dbColumn, $this->attributes)) {
-            $result = $this->attributes[$key];
+            $result = $this->attributes[$dbColumn];
         }
 
         // Do we need to mutate this into a date?
-        if (in_array($key, $this->dates, true)) {
+        if (in_array($dbColumn, $this->dates, true)) {
             $result = $this->mutateDate($result);
         }
         // Or cast it as something?
         elseif ($this->_cast) {
-            $result = $this->castAs($result, $key);
+            $result = $this->castAs($result, $dbColumn);
         }
 
         return $result;
@@ -545,15 +545,15 @@ class Entity implements JsonSerializable
             return false;
         }
 
-        $key = $this->mapProperty($key);
+        $dbColumn = $this->mapProperty($key);
 
-        $method = 'get' . str_replace(' ', '', ucwords(str_replace(['-', '_'], ' ', $key)));
+        $method = 'get' . str_replace(' ', '', ucwords(str_replace(['-', '_'], ' ', $dbColumn)));
 
         if (method_exists($this, $method)) {
             return true;
         }
 
-        return isset($this->attributes[$key]);
+        return isset($this->attributes[$dbColumn]);
     }
 
     /**
@@ -565,9 +565,9 @@ class Entity implements JsonSerializable
             return;
         }
 
-        $key = $this->mapProperty($key);
+        $dbColumn = $this->mapProperty($key);
 
-        unset($this->attributes[$key]);
+        unset($this->attributes[$dbColumn]);
     }
 
     /**
@@ -575,10 +575,10 @@ class Entity implements JsonSerializable
      */
     protected function isMappedDbColumn(string $key): bool
     {
-        $maybeColumnName = $this->mapProperty($key);
+        $dbColumn = $this->mapProperty($key);
 
-        // Property name which has mapped column name
+        // The $key is a property name which has mapped db column name
-        if ($key !== $maybeColumnName) {
+        if ($key !== $dbColumn) {
             return false;
         }
 

system/Session/Session.php

@@ -266,21 +266,13 @@ class Session implements SessionInterface
     }
 
     /**
-     * Does a full stop of the session:
+     * Destroys the current session.
      *
-     * - destroys the session
+     * @deprecated Use destroy() instead.
-     * - unsets the session id
-     * - destroys the session cookie
      */
     public function stop()
     {
-        setcookie(
+        $this->destroy();
-            $this->sessionCookieName,
-            session_id(),
-            ['expires' => 1, 'path' => $this->cookie->getPath(), 'domain' => $this->cookie->getDomain(), 'secure' => $this->cookie->isSecure(), 'httponly' => true]
-        );
-
-        session_regenerate_id(true);
     }
 
     /**

user_guide_src/source/changelogs/v4.3.5.rst

@@ -9,6 +9,12 @@ Release Date: Unreleased
     :local:
     :depth: 3
 
+SECURITY
+********
+
+- Fixed that ``Session::stop()`` did not destroy the session.
+  See :ref:`Session Library <session-stop>` for details.
+
 BREAKING
 ********
 
@@ -21,6 +27,9 @@ Changes
 Deprecations
 ************
 
+- **Session:** The :ref:`Session::stop() <session-stop>` method is deprecated.
+  Use the :ref:`Session::destroy() <session-destroy>` instead.
+
 Bugs Fixed
 **********
 

user_guide_src/source/installation/upgrade_435.rst

@@ -18,6 +18,18 @@ Mandatory File Changes
 Breaking Changes
 ****************
 
+Session::stop()
+===============
+
+Prior to v4.3.5, the ``Session::stop()`` method did not destroy the session due
+to a bug. This method has been modified to destroy the session, and now deprecated
+because it is exactly the same as the ``Session::destroy()`` method. So use the
+:ref:`Session::destroy <session-destroy>` method instead.
+
+If you have code to depend on the bug, replace it with ``session_regenerate_id(true)``.
+
+See also :ref:`Session Library <session-stop>`.
+
 Breaking Enhancements
 *********************
 

user_guide_src/source/libraries/sessions.rst

@@ -345,6 +345,11 @@ intend to reuse that same key in the same request, you'd want to use
 Destroying a Session
 ====================
 
+.. _session-destroy:
+
+destroy()
+---------
+
 To clear the current session (for example, during a logout), you may
 simply use either PHP's `session_destroy() <https://www.php.net/session_destroy>`_
 function, or the library's ``destroy()`` method. Both will work in exactly the
@@ -357,11 +362,20 @@ same way:
     tempdata) will be destroyed permanently and functions will be
     unusable during the same request after you destroy the session.
 
-You may also use the ``stop()`` method to completely kill the session
+.. _session-stop:
-by removing the old session ID, destroying all data, and destroying
-the cookie that contained the session ID:
 
-.. literalinclude:: sessions/038.php
+stop()
+------
+
+.. deprecated:: 4.3.5
+
+The session class also has the ``stop()`` method.
+
+.. warning:: Prior to v4.3.5, this method did not destroy the session due to a bug.
+
+Starting with v4.3.5, this method has been modified to destroy the session.
+However, it is deprecated because it is exactly the same as the ``destroy()``
+method. Use the ``destroy()`` method instead.
 
 Accessing Session Metadata
 ==========================

user_guide_src/source/libraries/sessions/038.php

@@ -1,3 +0,0 @@
-<?php
-
-$session->stop();