From 5b2747e9cd693e66524dc415a71e3fa246f296f7 Mon Sep 17 00:00:00 2001 From: Bastian Lederer Date: Fri, 28 Nov 2025 14:44:44 +0100 Subject: [PATCH] Only set `session.sid_bits_per_character` for PHP < 8.4 PHP 8.4 has deprecated `session.sid_bits_per_character` along with `session.sid_length`, as part of a broader effort to standardize session ID generation for improved security and interoperability. --- library/Icinga/Web/Session/PhpSession.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/library/Icinga/Web/Session/PhpSession.php b/library/Icinga/Web/Session/PhpSession.php index 5aafc900f..5c9805a8b 100644 --- a/library/Icinga/Web/Session/PhpSession.php +++ b/library/Icinga/Web/Session/PhpSession.php @@ -68,7 +68,7 @@ class PhpSession extends Session if (version_compare(PHP_VERSION, '7.1.0') < 0) { $defaultCookieOptions['hash_function'] = true; $defaultCookieOptions['hash_bits_per_character'] = 5; - } else { + } elseif (version_compare(PHP_VERSION, '8.4.0') < 0) { $defaultCookieOptions['sid_bits_per_character'] = 5; }