fix: add int type hint to gc() in all session handlers (#10418)

Add int type hint to $max_lifetime in gc() for all 6 session handlers
to match SessionHandlerInterface, preventing SQL injection from
non-integer input.

Includes changelog entry in v4.8.0.rst under Method Signature Changes.

Author: gr8man

system/Session/Handlers/ArrayHandler.php

@@ -80,7 +80,7 @@ public function destroy($id): bool
      * @param int $max_lifetime Sessions that have not updated
      *                          for the last max_lifetime seconds will be removed.
      */
-    public function gc($max_lifetime): int
+    public function gc(int $max_lifetime): int
     {
         return 1;
     }

system/Session/Handlers/Database/PostgreHandler.php

@@ -59,7 +59,7 @@ protected function prepareData(string $data): string
      * @param int $max_lifetime Sessions that have not updated
      *                          for the last max_lifetime seconds will be removed.
      */
-    public function gc($max_lifetime): false|int
+    public function gc(int $max_lifetime): false|int
     {
         $separator = '\'';
         $interval  = implode($separator, ['', "{$max_lifetime} second", '']);

system/Session/Handlers/DatabaseHandler.php

@@ -276,7 +276,7 @@ public function destroy($id): bool
      *
      * @return false|int Returns the number of deleted sessions on success, or false on failure.
      */
-    public function gc($max_lifetime): false|int
+    public function gc(int $max_lifetime): false|int
     {
         return $this->db->table($this->table)->where(
             'timestamp <',

system/Session/Handlers/FileHandler.php

@@ -263,7 +263,7 @@ public function destroy($id): bool
      * @param int $max_lifetime Sessions that have not updated
      *                          for the last max_lifetime seconds will be removed.
      */
-    public function gc($max_lifetime): false|int
+    public function gc(int $max_lifetime): false|int
     {
         if (! is_dir($this->savePath) || ($directory = opendir($this->savePath)) === false) {
             $this->logger->debug("Session: Garbage collector couldn't list files under directory '" . $this->savePath . "'.");

system/Session/Handlers/MemcachedHandler.php

@@ -255,7 +255,7 @@ public function destroy($id): bool
      * @param int $max_lifetime Sessions that have not updated
      *                          for the last max_lifetime seconds will be removed.
      */
-    public function gc($max_lifetime): int
+    public function gc(int $max_lifetime): int
     {
         return 1;
     }

system/Session/Handlers/RedisHandler.php

@@ -341,7 +341,7 @@ public function destroy($id): bool
      * @param int $max_lifetime Sessions that have not updated
      *                          for the last max_lifetime seconds will be removed.
      */
-    public function gc($max_lifetime): int
+    public function gc(int $max_lifetime): int
     {
         return 1;
     }

user_guide_src/source/changelogs/v4.8.0.rst

@@ -73,6 +73,7 @@ Method Signature Changes
 - **Database:** The following methods have had their signatures updated to remove deprecated parameters:
     - ``CodeIgniter\Database\Forge::_createTable()`` no longer accepts the deprecated ``$ifNotExists`` parameter. The method signature is now ``_createTable(string $table, array $attributes)``.
 - **Model:** ``CodeIgniter\BaseModel`` now requires the ``chunkRows()``, ``chunkById()``, and ``chunkRowsById()`` methods. Custom classes extending ``BaseModel`` directly must implement them.
+- **Session:** The ``$max_lifetime`` parameter of the following ``gc()`` methods now has the native ``int`` type, matching ``SessionHandlerInterface``: ``ArrayHandler::gc()``, ``DatabaseHandler::gc()``, ``FileHandler::gc()``, ``MemcachedHandler::gc()``, ``PostgreHandler::gc()``, ``RedisHandler::gc()``.
 
 Property Scope Changes
 ======================