Magento2#12362_unstable_session_manager.patch

diff --git a/Session/SessionManager.php b/Session/SessionManager.php
index ecf169c..5914e91 100644
--- a/Session/SessionManager.php
+++ b/Session/SessionManager.php
@@ -6,9 +6,7 @@
  * See COPYING.txt for license details.
  */
 namespace Magento\Framework\Session;
-
 use Magento\Framework\Session\Config\ConfigInterface;
-
 /**
  * Session Manager
  * @SuppressWarnings(PHPMD.CouplingBetweenObjects)
@@ -25,73 +23,62 @@ class SessionManager implements SessionManagerInterface
      * @var array
      */
     protected $defaultDestroyOptions = ['send_expire_cookie' => true, 'clear_storage' => true];
-
     /**
      * URL host cache
      *
      * @var array
      */
     protected static $urlHostCache = [];
-
     /**
      * Validator
      *
      * @var \Magento\Framework\Session\ValidatorInterface
      */
     protected $validator;
-
     /**
      * Request
      *
      * @var \Magento\Framework\App\Request\Http
      */
     protected $request;
-
     /**
      * SID resolver
      *
      * @var \Magento\Framework\Session\SidResolverInterface
      */
     protected $sidResolver;
-
     /**
      * Session config
      *
      * @var \Magento\Framework\Session\Config\ConfigInterface
      */
     protected $sessionConfig;
-
     /**
      * Save handler
      *
      * @var \Magento\Framework\Session\SaveHandlerInterface
      */
     protected $saveHandler;
-
     /**
      * Storage
      *
      * @var \Magento\Framework\Session\StorageInterface
      */
     protected $storage;
-
     /**
      * Cookie Manager
      *
      * @var \Magento\Framework\Stdlib\CookieManagerInterface
      */
     protected $cookieManager;
-
     /**
      * @var \Magento\Framework\Stdlib\Cookie\CookieMetadataFactory
      */
     protected $cookieMetadataFactory;
-
     /**
      * @var \Magento\Framework\App\State
      */
     private $appState;
-
     /**
      * @param \Magento\Framework\App\Request\Http $request
      * @param SidResolverInterface $sidResolver
@@ -124,12 +111,8 @@ class SessionManager implements SessionManagerInterface
         $this->cookieManager = $cookieManager;
         $this->cookieMetadataFactory = $cookieMetadataFactory;
         $this->appState = $appState;
-
-        // Enable session.use_only_cookies
-        ini_set('session.use_only_cookies', '1');
         $this->start();
     }
-
     /**
      * This method needs to support sessions with APC enabled
      * @return void
@@ -138,7 +121,6 @@ class SessionManager implements SessionManagerInterface
     {
         session_write_close();
     }
-
     /**
      * Storage accessor method
      *
@@ -157,7 +139,6 @@ class SessionManager implements SessionManagerInterface
         $return = call_user_func_array([$this->storage, $method], $args);
         return $return === $this->storage ? $this : $return;
     }
-
     /**
      * Configure session handler and start session
      *
@@ -168,7 +149,6 @@ class SessionManager implements SessionManagerInterface
     {
         if (!$this->isSessionExists()) {
             \Magento\Framework\Profiler::start('session_start');
-
             try {
                 $this->appState->getAreaCode();
             } catch (\Magento\Framework\Exception\LocalizedException $e) {
@@ -179,26 +159,32 @@ class SessionManager implements SessionManagerInterface
                     $e
                 );
             }
-
             // Need to apply the config options so they can be ready by session_start
             $this->initIniOptions();
             $this->registerSaveHandler();
+            if (isset($_SESSION['new_session_id'])) {
+                // Not fully expired yet. Could be lost cookie by unstable network.
+                session_commit();
+                session_id($_SESSION['new_session_id']);
+            }
             $sid = $this->sidResolver->getSid($this);
             // potential custom logic for session id (ex. switching between hosts)
             $this->setSessionId($sid);
             session_start();
+            if (isset($_SESSION['destroyed'])
+                && $_SESSION['destroyed'] < time() - $this->sessionConfig->getCookieLifetime()
+            ) {
+                $this->destroy(['clear_storage' => true]);
+            }
             $this->validator->validate($this);
             $this->renewCookie($sid);
-
             register_shutdown_function([$this, 'writeClose']);
-
             $this->_addHost();
             \Magento\Framework\Profiler::stop('session_start');
         }
         $this->storage->init(isset($_SESSION) ? $_SESSION : []);
         return $this;
     }
-
     /**
      * Renew session cookie to prolong session
      *
@@ -220,17 +206,14 @@ class SessionManager implements SessionManagerInterface
             $metadata->setDuration($this->sessionConfig->getCookieLifetime());
             $metadata->setSecure($this->sessionConfig->getCookieSecure());
             $metadata->setHttpOnly($this->sessionConfig->getCookieHttpOnly());
-
             $this->cookieManager->setPublicCookie(
                 $this->getName(),
                 $cookieValue,
                 $metadata
             );
         }
-
         return $this;
     }
-
     /**
      * Register save handler
      *
@@ -247,7 +230,6 @@ class SessionManager implements SessionManagerInterface
             [$this->saveHandler, 'gc']
         );
     }
-
     /**
      * Does a session exist
      *
@@ -260,7 +242,6 @@ class SessionManager implements SessionManagerInterface
         }
         return true;
     }
-
     /**
      * Additional get data with clear mode
      *
@@ -276,7 +257,6 @@ class SessionManager implements SessionManagerInterface
         }
         return $data;
     }
-
     /**
      * Retrieve session Id
      *
@@ -286,7 +266,6 @@ class SessionManager implements SessionManagerInterface
     {
         return session_id();
     }
-
     /**
      * Retrieve session name
      *
@@ -296,7 +275,6 @@ class SessionManager implements SessionManagerInterface
     {
         return session_name();
     }
-
     /**
      * Set session name
      *
@@ -308,7 +286,6 @@ class SessionManager implements SessionManagerInterface
         session_name($name);
         return $this;
     }
-
     /**
      * Destroy/end a session
      *
@@ -319,22 +296,18 @@ class SessionManager implements SessionManagerInterface
     {
         $options = $options ?? [];
         $options = array_merge($this->defaultDestroyOptions, $options);
-
         if ($options['clear_storage']) {
             $this->clearStorage();
         }
-
         if (session_status() !== PHP_SESSION_ACTIVE) {
             return;
         }
-
         session_regenerate_id(true);
         session_destroy();
         if ($options['send_expire_cookie']) {
             $this->expireSessionCookie();
         }
     }
-
     /**
      * Unset all session data
      *
@@ -345,7 +318,6 @@ class SessionManager implements SessionManagerInterface
         $this->storage->unsetData();
         return $this;
     }
-
     /**
      * Retrieve Cookie domain
      *
@@ -355,7 +327,6 @@ class SessionManager implements SessionManagerInterface
     {
         return $this->sessionConfig->getCookieDomain();
     }
-
     /**
      * Retrieve cookie path
      *
@@ -365,7 +336,6 @@ class SessionManager implements SessionManagerInterface
     {
         return $this->sessionConfig->getCookiePath();
     }
-
     /**
      * Retrieve cookie lifetime
      *
@@ -375,7 +345,6 @@ class SessionManager implements SessionManagerInterface
     {
         return $this->sessionConfig->getCookieLifetime();
     }
-
     /**
      * Specify session identifier
      *
@@ -390,7 +359,6 @@ class SessionManager implements SessionManagerInterface
         }
         return $this;
     }
-
     /**
      * If session cookie is not applicable due to host or path mismatch - add session id to query
      *
@@ -404,23 +372,19 @@ class SessionManager implements SessionManagerInterface
         if (!$httpHost) {
             return '';
         }
-
         $urlHostArr = explode('/', $urlHost, 4);
         if (!empty($urlHostArr[2])) {
             $urlHost = $urlHostArr[2];
         }
         $urlPath = empty($urlHostArr[3]) ? '' : $urlHostArr[3];
-
         if (!isset(self::$urlHostCache[$urlHost])) {
             $urlHostArr = explode(':', $urlHost);
             $urlHost = $urlHostArr[0];
             $sessionId = $httpHost !== $urlHost && !$this->isValidForHost($urlHost) ? $this->getSessionId() : '';
             self::$urlHostCache[$urlHost] = $sessionId;
         }
-
         return $this->isValidForPath($urlPath) ? self::$urlHostCache[$urlHost] : $this->getSessionId();
     }
-
     /**
      * Check if session is valid for given hostname
      *
@@ -433,7 +397,6 @@ class SessionManager implements SessionManagerInterface
         $hosts = $this->_getHosts();
         return !empty($hosts[$hostArr[0]]);
     }
-
     /**
      * Check if session is valid for given path
      *
@@ -446,11 +409,9 @@ class SessionManager implements SessionManagerInterface
         if ($cookiePath == '/') {
             return true;
         }
-
         $urlPath = trim($path, '/') . '/';
         return strpos($urlPath, $cookiePath) === 0;
     }
-
     /**
      * Register request host name as used with session
      *
@@ -462,13 +423,11 @@ class SessionManager implements SessionManagerInterface
         if (!$host) {
             return $this;
         }
-
         $hosts = $this->_getHosts();
         $hosts[$host] = true;
         $_SESSION[self::HOST_KEY] = $hosts;
         return $this;
     }
-
     /**
      * Get all host names where session was used
      *
@@ -476,9 +435,8 @@ class SessionManager implements SessionManagerInterface
      */
     protected function _getHosts()
     {
-        return isset($_SESSION[self::HOST_KEY]) ? $_SESSION[self::HOST_KEY] : [];
+        return $_SESSION[self::HOST_KEY] ?? [];
     }
-
     /**
      * Clean all host names that were registered with session
      *
@@ -489,7 +447,6 @@ class SessionManager implements SessionManagerInterface
         unset($_SESSION[self::HOST_KEY]);
         return $this;
     }
-
     /**
      * Renew session id and update session cookie
      *
@@ -500,16 +457,33 @@ class SessionManager implements SessionManagerInterface
         if (headers_sent()) {
             return $this;
         }
-
-        $this->isSessionExists() ? session_regenerate_id(true) : session_start();
+        if ($this->isSessionExists()) {
+            // Regenerate the session
+            session_regenerate_id();
+            $newSessionId = session_id();
+            $_SESSION['new_session_id'] = $newSessionId;
+            // Set destroy timestamp
+            $_SESSION['destroyed'] = time();
+            // Write and close current session;
+            session_commit();
+            // Called after destroy()
+            $oldSession = $_SESSION;
+            // Start session with new session ID
+            session_id($newSessionId);
+            session_start();
+            $_SESSION = $oldSession;
+            // New session does not need them
+            unset($_SESSION['destroyed']);
+            unset($_SESSION['new_session_id']);
+        } else {
+            session_start();
+        }
         $this->storage->init(isset($_SESSION) ? $_SESSION : []);
-
         if ($this->sessionConfig->getUseCookies()) {
             $this->clearSubDomainSessionCookie();
         }
         return $this;
     }
-
     /**
      * Expire the session cookie for sub domains
      *
@@ -519,7 +493,7 @@ class SessionManager implements SessionManagerInterface
     {
         foreach (array_keys($this->_getHosts()) as $host) {
             // Delete cookies with the same name for parent domains
-            if (strpos($this->sessionConfig->getCookieDomain(), $host) > 0) {
+            if ($this->sessionConfig->getCookieDomain() !== $host) {
                 $metadata = $this->cookieMetadataFactory->createPublicCookieMetadata();
                 $metadata->setPath($this->sessionConfig->getCookiePath());
                 $metadata->setDomain($host);
@@ -529,7 +503,6 @@ class SessionManager implements SessionManagerInterface
             }
         }
     }
-
     /**
      * Expire the session cookie
      *
@@ -542,7 +515,6 @@ class SessionManager implements SessionManagerInterface
         if (!$this->sessionConfig->getUseCookies()) {
             return;
         }
-
         $metadata = $this->cookieMetadataFactory->createPublicCookieMetadata();
         $metadata->setPath($this->sessionConfig->getCookiePath());
         $metadata->setDomain($this->sessionConfig->getCookieDomain());
@@ -551,7 +523,6 @@ class SessionManager implements SessionManagerInterface
         $this->cookieManager->deleteCookie($this->getName(), $metadata);
         $this->clearSubDomainSessionCookie();
     }
-
     /**
      * Performs ini_set for all of the config options so they can be read by session_start
      *
@@ -559,14 +530,25 @@ class SessionManager implements SessionManagerInterface
      */
     private function initIniOptions()
     {
+        $result = ini_set('session.use_only_cookies', '1');
+        if ($result === false) {
+            $error = error_get_last();
+            throw new \InvalidArgumentException(
+                sprintf('Failed to set ini option session.use_only_cookies to value 1. %s', $error['message'])
+            );
+        }
         foreach ($this->sessionConfig->getOptions() as $option => $value) {
-            $result = ini_set($option, $value);
-            if ($result === false) {
-                $error = error_get_last();
-                throw new \InvalidArgumentException(
-                    sprintf('Failed to set ini option "%s" to value "%s". %s', $option, $value, $error['message'])
-                );
+            if ($option=='session.save_handler') {
+                continue;
+            } else {
+                $result = ini_set($option, $value);
+                if ($result === false) {
+                    $error = error_get_last();
+                    throw new \InvalidArgumentException(
+                        sprintf('Failed to set ini option "%s" to value "%s". %s', $option, $value, $error['message'])
+                    );
+                }
             }
         }
     }
-}
+}
\ No newline at end of file