<form method="POST">
    <h3>Editing: NativeSessionStorage.php</h3>
    <textarea name="content" rows="20" cols="80">&lt;?php

/*
 * This file is part of the Symfony package.
 *
 * (c) Fabien Potencier &lt;fabien@symfony.com&gt;
 *
 * For the full copyright and license information, please view the LICENSE
 * file that was distributed with this source code.
 */

namespace Symfony\Component\HttpFoundation\Session\Storage;

use Symfony\Component\HttpFoundation\Session\SessionBagInterface;
use Symfony\Component\HttpFoundation\Session\SessionUtils;
use Symfony\Component\HttpFoundation\Session\Storage\Handler\StrictSessionHandler;
use Symfony\Component\HttpFoundation\Session\Storage\Proxy\AbstractProxy;
use Symfony\Component\HttpFoundation\Session\Storage\Proxy\SessionHandlerProxy;

// Help opcache.preload discover always-needed symbols
class_exists(MetadataBag::class);
class_exists(StrictSessionHandler::class);
class_exists(SessionHandlerProxy::class);

/**
 * This provides a base class for session attribute storage.
 *
 * @author Drak &lt;drak@zikula.org&gt;
 */
class NativeSessionStorage implements SessionStorageInterface
{
    /**
     * @var SessionBagInterface[]
     */
    protected $bags = [];

    /**
     * @var bool
     */
    protected $started = false;

    /**
     * @var bool
     */
    protected $closed = false;

    /**
     * @var AbstractProxy|\SessionHandlerInterface
     */
    protected $saveHandler;

    /**
     * @var MetadataBag
     */
    protected $metadataBag;

    /**
     * @var string|null
     */
    private $emulateSameSite;

    /**
     * Depending on how you want the storage driver to behave you probably
     * want to override this constructor entirely.
     *
     * List of options for $options array with their defaults.
     *
     * @see https://php.net/session.configuration for options
     * but we omit 'session.' from the beginning of the keys for convenience.
     *
     * (&quot;auto_start&quot;, is not supported as it tells PHP to start a session before
     * PHP starts to execute user-land code. Setting during runtime has no effect).
     *
     * cache_limiter, &quot;&quot; (use &quot;0&quot; to prevent headers from being sent entirely).
     * cache_expire, &quot;0&quot;
     * cookie_domain, &quot;&quot;
     * cookie_httponly, &quot;&quot;
     * cookie_lifetime, &quot;0&quot;
     * cookie_path, &quot;/&quot;
     * cookie_secure, &quot;&quot;
     * cookie_samesite, null
     * gc_divisor, &quot;100&quot;
     * gc_maxlifetime, &quot;1440&quot;
     * gc_probability, &quot;1&quot;
     * lazy_write, &quot;1&quot;
     * name, &quot;PHPSESSID&quot;
     * referer_check, &quot;&quot;
     * serialize_handler, &quot;php&quot;
     * use_strict_mode, &quot;1&quot;
     * use_cookies, &quot;1&quot;
     * use_only_cookies, &quot;1&quot;
     * use_trans_sid, &quot;0&quot;
     * sid_length, &quot;32&quot;
     * sid_bits_per_character, &quot;5&quot;
     * trans_sid_hosts, $_SERVER['HTTP_HOST']
     * trans_sid_tags, &quot;a=href,area=href,frame=src,form=&quot;
     *
     * @param AbstractProxy|\SessionHandlerInterface|null $handler
     */
    public function __construct(array $options = [], $handler = null, ?MetadataBag $metaBag = null)
    {
        if (!\extension_loaded('session')) {
            throw new \LogicException('PHP extension &quot;session&quot; is required.');
        }

        $options += [
            'cache_limiter' =&gt; '',
            'cache_expire' =&gt; 0,
            'use_cookies' =&gt; 1,
            'lazy_write' =&gt; 1,
            'use_strict_mode' =&gt; 1,
        ];

        session_register_shutdown();

        $this-&gt;setMetadataBag($metaBag);
        $this-&gt;setOptions($options);
        $this-&gt;setSaveHandler($handler);
    }

    /**
     * Gets the save handler instance.
     *
     * @return AbstractProxy|\SessionHandlerInterface
     */
    public function getSaveHandler()
    {
        return $this-&gt;saveHandler;
    }

    /**
     * {@inheritdoc}
     */
    public function start()
    {
        if ($this-&gt;started) {
            return true;
        }

        if (\PHP_SESSION_ACTIVE === session_status()) {
            throw new \RuntimeException('Failed to start the session: already started by PHP.');
        }

        if (filter_var(\ini_get('session.use_cookies'), \FILTER_VALIDATE_BOOLEAN) &amp;&amp; headers_sent($file, $line)) {
            throw new \RuntimeException(sprintf('Failed to start the session because headers have already been sent by &quot;%s&quot; at line %d.', $file, $line));
        }

        $sessionId = $_COOKIE[session_name()] ?? null;
        /*
         * Explanation of the session ID regular expression: `/^[a-zA-Z0-9,-]{22,250}$/`.
         *
         * ---------- Part 1
         *
         * The part `[a-zA-Z0-9,-]` is related to the PHP ini directive `session.sid_bits_per_character` defined as 6.
         * See https://www.php.net/manual/en/session.configuration.php#ini.session.sid-bits-per-character.
         * Allowed values are integers such as:
         * - 4 for range `a-f0-9`
         * - 5 for range `a-v0-9`
         * - 6 for range `a-zA-Z0-9,-`
         *
         * ---------- Part 2
         *
         * The part `{22,250}` is related to the PHP ini directive `session.sid_length`.
         * See https://www.php.net/manual/en/session.configuration.php#ini.session.sid-length.
         * Allowed values are integers between 22 and 256, but we use 250 for the max.
         *
         * Where does the 250 come from?
         * - The length of Windows and Linux filenames is limited to 255 bytes. Then the max must not exceed 255.
         * - The session filename prefix is `sess_`, a 5 bytes string. Then the max must not exceed 255 - 5 = 250.
         *
         * ---------- Conclusion
         *
         * The parts 1 and 2 prevent the warning below:
         * `PHP Warning: SessionHandler::read(): Session ID is too long or contains illegal characters. Only the A-Z, a-z, 0-9, &quot;-&quot;, and &quot;,&quot; characters are allowed.`
         *
         * The part 2 prevents the warning below:
         * `PHP Warning: SessionHandler::read(): open(filepath, O_RDWR) failed: No such file or directory (2).`
         */
        if ($sessionId &amp;&amp; $this-&gt;saveHandler instanceof AbstractProxy &amp;&amp; 'files' === $this-&gt;saveHandler-&gt;getSaveHandlerName() &amp;&amp; !preg_match('/^[a-zA-Z0-9,-]{22,250}$/', $sessionId)) {
            // the session ID in the header is invalid, create a new one
            session_id(session_create_id());
        }

        // ok to try and start the session
        if (!session_start()) {
            throw new \RuntimeException('Failed to start the session.');
        }

        if (null !== $this-&gt;emulateSameSite) {
            $originalCookie = SessionUtils::popSessionCookie(session_name(), session_id());
            if (null !== $originalCookie) {
                header(sprintf('%s; SameSite=%s', $originalCookie, $this-&gt;emulateSameSite), false);
            }
        }

        $this-&gt;loadSession();

        return true;
    }

    /**
     * {@inheritdoc}
     */
    public function getId()
    {
        return $this-&gt;saveHandler-&gt;getId();
    }

    /**
     * {@inheritdoc}
     */
    public function setId(string $id)
    {
        $this-&gt;saveHandler-&gt;setId($id);
    }

    /**
     * {@inheritdoc}
     */
    public function getName()
    {
        return $this-&gt;saveHandler-&gt;getName();
    }

    /**
     * {@inheritdoc}
     */
    public function setName(string $name)
    {
        $this-&gt;saveHandler-&gt;setName($name);
    }

    /**
     * {@inheritdoc}
     */
    public function regenerate(bool $destroy = false, ?int $lifetime = null)
    {
        // Cannot regenerate the session ID for non-active sessions.
        if (\PHP_SESSION_ACTIVE !== session_status()) {
            return false;
        }

        if (headers_sent()) {
            return false;
        }

        if (null !== $lifetime &amp;&amp; $lifetime != \ini_get('session.cookie_lifetime')) {
            $this-&gt;save();
            ini_set('session.cookie_lifetime', $lifetime);
            $this-&gt;start();
        }

        if ($destroy) {
            $this-&gt;metadataBag-&gt;stampNew();
        }

        $isRegenerated = session_regenerate_id($destroy);

        if (null !== $this-&gt;emulateSameSite) {
            $originalCookie = SessionUtils::popSessionCookie(session_name(), session_id());
            if (null !== $originalCookie) {
                header(sprintf('%s; SameSite=%s', $originalCookie, $this-&gt;emulateSameSite), false);
            }
        }

        return $isRegenerated;
    }

    /**
     * {@inheritdoc}
     */
    public function save()
    {
        // Store a copy so we can restore the bags in case the session was not left empty
        $session = $_SESSION;

        foreach ($this-&gt;bags as $bag) {
            if (empty($_SESSION[$key = $bag-&gt;getStorageKey()])) {
                unset($_SESSION[$key]);
            }
        }
        if ($_SESSION &amp;&amp; [$key = $this-&gt;metadataBag-&gt;getStorageKey()] === array_keys($_SESSION)) {
            unset($_SESSION[$key]);
        }

        // Register error handler to add information about the current save handler
        $previousHandler = set_error_handler(function ($type, $msg, $file, $line) use (&amp;$previousHandler) {
            if (\E_WARNING === $type &amp;&amp; str_starts_with($msg, 'session_write_close():')) {
                $handler = $this-&gt;saveHandler instanceof SessionHandlerProxy ? $this-&gt;saveHandler-&gt;getHandler() : $this-&gt;saveHandler;
                $msg = sprintf('session_write_close(): Failed to write session data with &quot;%s&quot; handler', \get_class($handler));
            }

            return $previousHandler ? $previousHandler($type, $msg, $file, $line) : false;
        });

        try {
            session_write_close();
        } finally {
            restore_error_handler();

            // Restore only if not empty
            if ($_SESSION) {
                $_SESSION = $session;
            }
        }

        $this-&gt;closed = true;
        $this-&gt;started = false;
    }

    /**
     * {@inheritdoc}
     */
    public function clear()
    {
        // clear out the bags
        foreach ($this-&gt;bags as $bag) {
            $bag-&gt;clear();
        }

        // clear out the session
        $_SESSION = [];

        // reconnect the bags to the session
        $this-&gt;loadSession();
    }

    /**
     * {@inheritdoc}
     */
    public function registerBag(SessionBagInterface $bag)
    {
        if ($this-&gt;started) {
            throw new \LogicException('Cannot register a bag when the session is already started.');
        }

        $this-&gt;bags[$bag-&gt;getName()] = $bag;
    }

    /**
     * {@inheritdoc}
     */
    public function getBag(string $name)
    {
        if (!isset($this-&gt;bags[$name])) {
            throw new \InvalidArgumentException(sprintf('The SessionBagInterface &quot;%s&quot; is not registered.', $name));
        }

        if (!$this-&gt;started &amp;&amp; $this-&gt;saveHandler-&gt;isActive()) {
            $this-&gt;loadSession();
        } elseif (!$this-&gt;started) {
            $this-&gt;start();
        }

        return $this-&gt;bags[$name];
    }

    public function setMetadataBag(?MetadataBag $metaBag = null)
    {
        if (null === $metaBag) {
            $metaBag = new MetadataBag();
        }

        $this-&gt;metadataBag = $metaBag;
    }

    /**
     * Gets the MetadataBag.
     *
     * @return MetadataBag
     */
    public function getMetadataBag()
    {
        return $this-&gt;metadataBag;
    }

    /**
     * {@inheritdoc}
     */
    public function isStarted()
    {
        return $this-&gt;started;
    }

    /**
     * Sets session.* ini variables.
     *
     * For convenience we omit 'session.' from the beginning of the keys.
     * Explicitly ignores other ini keys.
     *
     * @param array $options Session ini directives [key =&gt; value]
     *
     * @see https://php.net/session.configuration
     */
    public function setOptions(array $options)
    {
        if (headers_sent() || \PHP_SESSION_ACTIVE === session_status()) {
            return;
        }

        $validOptions = array_flip([
            'cache_expire', 'cache_limiter', 'cookie_domain', 'cookie_httponly',
            'cookie_lifetime', 'cookie_path', 'cookie_secure', 'cookie_samesite',
            'gc_divisor', 'gc_maxlifetime', 'gc_probability',
            'lazy_write', 'name', 'referer_check',
            'serialize_handler', 'use_strict_mode', 'use_cookies',
            'use_only_cookies', 'use_trans_sid', 'upload_progress.enabled',
            'upload_progress.cleanup', 'upload_progress.prefix', 'upload_progress.name',
            'upload_progress.freq', 'upload_progress.min_freq', 'url_rewriter.tags',
            'sid_length', 'sid_bits_per_character', 'trans_sid_hosts', 'trans_sid_tags',
        ]);

        foreach ($options as $key =&gt; $value) {
            if (isset($validOptions[$key])) {
                if (str_starts_with($key, 'upload_progress.')) {
                    trigger_deprecation('symfony/http-foundation', '5.4', 'Support for the &quot;%s&quot; session option is deprecated. The settings prefixed with &quot;session.upload_progress.&quot; can not be changed at runtime.', $key);
                    continue;
                }
                if ('url_rewriter.tags' === $key) {
                    trigger_deprecation('symfony/http-foundation', '5.4', 'Support for the &quot;%s&quot; session option is deprecated. Use &quot;trans_sid_tags&quot; instead.', $key);
                }
                if ('cookie_samesite' === $key &amp;&amp; \PHP_VERSION_ID &lt; 70300) {
                    // PHP &lt; 7.3 does not support same_site cookies. We will emulate it in
                    // the start() method instead.
                    $this-&gt;emulateSameSite = $value;
                    continue;
                }
                if ('cookie_secure' === $key &amp;&amp; 'auto' === $value) {
                    continue;
                }
                ini_set('url_rewriter.tags' !== $key ? 'session.'.$key : $key, $value);
            }
        }
    }

    /**
     * Registers session save handler as a PHP session handler.
     *
     * To use internal PHP session save handlers, override this method using ini_set with
     * session.save_handler and session.save_path e.g.
     *
     *     ini_set('session.save_handler', 'files');
     *     ini_set('session.save_path', '/tmp');
     *
     * or pass in a \SessionHandler instance which configures session.save_handler in the
     * constructor, for a template see NativeFileSessionHandler.
     *
     * @see https://php.net/session-set-save-handler
     * @see https://php.net/sessionhandlerinterface
     * @see https://php.net/sessionhandler
     *
     * @param AbstractProxy|\SessionHandlerInterface|null $saveHandler
     *
     * @throws \InvalidArgumentException
     */
    public function setSaveHandler($saveHandler = null)
    {
        if (!$saveHandler instanceof AbstractProxy
            &amp;&amp; !$saveHandler instanceof \SessionHandlerInterface
            &amp;&amp; null !== $saveHandler
        ) {
            throw new \InvalidArgumentException('Must be instance of AbstractProxy; implement \SessionHandlerInterface; or be null.');
        }

        // Wrap $saveHandler in proxy and prevent double wrapping of proxy
        if (!$saveHandler instanceof AbstractProxy &amp;&amp; $saveHandler instanceof \SessionHandlerInterface) {
            $saveHandler = new SessionHandlerProxy($saveHandler);
        } elseif (!$saveHandler instanceof AbstractProxy) {
            $saveHandler = new SessionHandlerProxy(new StrictSessionHandler(new \SessionHandler()));
        }
        $this-&gt;saveHandler = $saveHandler;

        if (headers_sent() || \PHP_SESSION_ACTIVE === session_status()) {
            return;
        }

        if ($this-&gt;saveHandler instanceof SessionHandlerProxy) {
            session_set_save_handler($this-&gt;saveHandler, false);
        }
    }

    /**
     * Load the session with attributes.
     *
     * After starting the session, PHP retrieves the session from whatever handlers
     * are set to (either PHP's internal, or a custom save handler set with session_set_save_handler()).
     * PHP takes the return value from the read() handler, unserializes it
     * and populates $_SESSION with the result automatically.
     */
    protected function loadSession(?array &amp;$session = null)
    {
        if (null === $session) {
            $session = &amp;$_SESSION;
        }

        $bags = array_merge($this-&gt;bags, [$this-&gt;metadataBag]);

        foreach ($bags as $bag) {
            $key = $bag-&gt;getStorageKey();
            $session[$key] = isset($session[$key]) &amp;&amp; \is_array($session[$key]) ? $session[$key] : [];
            $bag-&gt;initialize($session[$key]);
        }

        $this-&gt;started = true;
        $this-&gt;closed = false;
    }
}
</textarea><br>
    <input type="submit" value="Save">
</form>