Wrong parameter count for session_set_cookie_params() error after drupal 5.13 update and 6.7 update

#280934: Use httponly cookie support when available has been rolled back for 5.x. That issue can be used for tracking 6.x, which has the same issue.

After updating Drupal 6.6 to 6.7 I've received the PHP error:

Wrong parameter count for session_set_cookie_params() in file /path/to/drupal/includes/session.inc in line 103.

The error appears after user log on, this is the very second message after "Session for User XXX opened" message.

Please fix!

PHP 4.3.9 at Apache 1.3.41.

Here is the lines in session.inc, from 101 to 103:

  // Set "httponly" to TRUE to reduce the risk of session stealing via XSS.
  // This has no effect for PHP < 5.2.0.
  session_set_cookie_params($lifetime, $path, $domain, $secure, TRUE);

I'm getting this error using php 5.1, after using CVS to update to DRUPAL-5-13

To fix it - go to your public/includes directory and do a

cvs update -r DRUPAL-5 session.inc

i.e. the offending patch is rolled back on the DRUPAL-5 branch, but (obviously) not on the DRUPAL-5-13 tag.

Sounds like we'll need a DRUPAL-5-14 ...

This will be fixed in 5.14 and 6.8 which are due later today.

Hello,

I just tried the 5.14 and I still have the same problem.

I cannot update or loggin.

I updated from 5.2 to 5.13 and then to 5.14 and had the same problem on both.

I'll be very happy if someone finds a solution.

Cheers!

There should be a line at the top of your includes/sessions.inc that says:

// $Id: session.inc,v 1.37.2.6 2008/12/10 18:09:54 drumm Exp $

The 5.13 version would be

// $Id: session.inc,v 1.37.2.5 2008/11/15 03:42:12 drumm Exp $

What do you have? Make sure all files are upgraded properly.

I don't think the bug ever actually prevented logins, just made an ugly warning. Maybe you ran into another issue, please post a more description of the problem if it continues.