From 37eed230b948b3ae643b36423cad0f51d72bfb13 Mon Sep 17 00:00:00 2001 From: Jacek Ablewicz Date: Thu, 18 Sep 2014 12:23:52 +0200 Subject: [PATCH] Bug 12954 - Questionable logic regarding session handling in C4::Auth::checkauth() MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Note: This is probably not quite proper patch for this bug (and for sure not the best possible approach for fixing it); uploaded only as reference/proof of concept etc. While it does seem to fix the problem described in Bug 12954 comment #0, it most likely does have some side effects regarding anonymous search history storage and handling. I could replicate the issue without patch. The issue is no longer replicatable with patch. I sign off because the patch removes a "Software error" on Opac. Signed-off-by: Marc VĂ©ron --- C4/Auth.pm | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/C4/Auth.pm b/C4/Auth.pm index b808c66..55b3cf2 100644 --- a/C4/Auth.pm +++ b/C4/Auth.pm @@ -780,7 +780,7 @@ sub checkauth { } elsif ( !$lasttime || ($lasttime < time() - $timeout) ) { # timed logout - $info{'timed_out'} = 1; + $info{'timed_out'} = 1 if $lasttime; if ($session) { $session->delete(); $session->flush; @@ -1053,12 +1053,20 @@ sub checkauth { } else { + ## if we got here, it is an unsuccessfull login attempt if ($userid) { $info{'invalid_username_or_password'} = 1; - C4::Context->_unset_userenv($sessionID); } - $session->param('lasttime',time()); - $session->param('ip',$session->remote_addr()); + if ($session) { + $session->delete(); + $session->flush; + } + C4::Context->_unset_userenv($sessionID) if $sessionID; + $userid = undef; + $sessionID = undef; + ## probably not a good idea (at least not without setting up 'sessiontype' to 'anon' as well ?) + # $session->param('lasttime',time()); + # $session->param('ip',$session->remote_addr()); } } # END if ( $userid = $query->param('userid') ) elsif ($type eq "opac") { -- 1.7.10.4