ext/session: disable session.upload_progress.enabled by default

NEWS

@@ -13,6 +13,9 @@ PHP                                                                        NEWS
   . Fixed bug GH-24461 (DISCARD ALL on persistent connection cleanup drops
     PgBouncer's prepared statements). (David Carlier, Artem Ukrainskiy)
 
+- Session:
+  . Changed default of session.upload_progress.enabled to 0. (jorgsowa)
+
 - SAPI:
   . Fixed infinite loop in sapi_header_op() for headers of 4 GiB or more.
     (Martin Mirchev)

UPGRADING

@@ -178,6 +178,10 @@ PHP 8.6 UPGRADE NOTES
         explicitly set this to "None" (and also set session.cookie_secure
         to 1).
     RFC: https://wiki.php.net/rfc/session_security_defaults
+  . The default of session.upload_progress.enabled is now 0 (was 1). Upload
+    progress tracking writes request data into the session, so it is now
+    opt-in. Applications that read upload progress from $_SESSION must
+    explicitly set this to 1.
   . SessionHandler::validateId() has been added and delegates to the
     configured save handler. A subclass that declares validateId() without
     a return type now emits a deprecation notice for the tentative bool

ext/session/session.c

@@ -975,7 +975,7 @@ PHP_INI_BEGIN()
 
 	/* Upload progress */
 	STD_PHP_INI_BOOLEAN("session.upload_progress.enabled",
-	                                                "1",     ZEND_INI_PERDIR, OnUpdateBool,        rfc1867_enabled, php_ps_globals, ps_globals)
+	                                                "0",     ZEND_INI_PERDIR, OnUpdateBool,        rfc1867_enabled, php_ps_globals, ps_globals)
 	STD_PHP_INI_BOOLEAN("session.upload_progress.cleanup",
 	                                                "1",     ZEND_INI_PERDIR, OnUpdateBool,        rfc1867_cleanup, php_ps_globals, ps_globals)
 	STD_PHP_INI_ENTRY("session.upload_progress.prefix",

ext/session/tests/upload_progress_disabled_by_default.phpt

@@ -0,0 +1,10 @@
+--TEST--
+session.upload_progress.enabled is disabled by default
+--EXTENSIONS--
+session
+--FILE--
+<?php
+var_dump(ini_get('session.upload_progress.enabled'));
+?>
+--EXPECT--
+string(1) "0"

php.ini-development

@@ -1445,11 +1445,11 @@ session.trans_sid_tags = "a=href,area=href,frame=src,form="
 ;session.trans_sid_hosts=""
 
 ; Enable upload progress tracking in $_SESSION
-; Default Value: On
-; Development Value: On
-; Production Value: On
+; Default Value: Off
+; Development Value: Off
+; Production Value: Off
 ; https://php.net/session.upload-progress.enabled
-;session.upload_progress.enabled = On
+;session.upload_progress.enabled = Off
 
 ; Cleanup the progress information as soon as all POST data has been read
 ; (i.e. upload completed).

php.ini-production

@@ -1447,11 +1447,11 @@ session.trans_sid_tags = "a=href,area=href,frame=src,form="
 ;session.trans_sid_hosts=""
 
 ; Enable upload progress tracking in $_SESSION
-; Default Value: On
-; Development Value: On
-; Production Value: On
+; Default Value: Off
+; Development Value: Off
+; Production Value: Off
 ; https://php.net/session.upload-progress.enabled
-;session.upload_progress.enabled = On
+;session.upload_progress.enabled = Off
 
 ; Cleanup the progress information as soon as all POST data has been read
 ; (i.e. upload completed).