KohanaPHP » Kohana v3.x

Unexpected behavior may arise when using register_shutdown_function and if the function called by register_shutdown_function uses the Session.

This is apparent when I use the Captcha module. When Captcha class is instantiated, it calls register_shutdown_function to run Captcha::update_response_session which calls the Session::instance()->set().

The problem arises when the Session is instantiated before the Captcha. For example, if I use Auth(which calls the Session) first, Session::write will be registered before Captcha::update_response_session causing the Session::instance()->set() attempt to fail.

This problem may be solved by making sure that Session::write is called last. Or by alerting developers to take this issue in consideration and avoid calling Session::instance()->get() on their register_shutdown_function calls.

A dirty fix in making sure Session::write is called last would be something like this:

public static function instance($type = NULL, $id = NULL)
    {
        if ($type === NULL)
        {
            // Use the default type
            $type = Session::$default;
        }

        if ( ! isset(Session::$instances[$type]))
        {
            // Load the configuration for this type
            $config = Kohana::config('session')->get($type);

            // Set the session class name
            $class = 'Session_'.ucfirst($type);

            // Create a new session instance
            Session::$instances[$type] = $session = new $class($config, $id);

            // Make sure the Session::write is the last to be called on shutdown
            register_shutdown_function(array('Session', 'prepare'), $session);
        }

        return Session::$instances[$type];
    }

    public static function prepare($session)
    {
        // Write the session at shutdown
        register_shutdown_function(array($session, 'write'));
    }

Instead of registering write, register a prepare function first which will insert the Session::write to the end of the queue.