The DBI storage driver for CGI::Session commits any on-going transactions in its destructor subroutine. Consequently if SessionStorage is set to mysql, instantiating a session and assigning it to a local variable inside a transaction will unexpectedly cause the transaction to be committed as illustrated by the below script. I have reported this issue upstream and created pull requests but it is unclear if anyone is maintaining CGI::Session. https://rt.cpan.org/Ticket/Display.html?id=140855 https://github.com/cromedome/cgi-session/pull/5 We should maybe consider maintaining our own fork of CGI::Session. #!/usr/bin/perl -w use DBI; use C4::Auth; use Koha::Database; use strict; my $dbh = C4::Context->dbh; my $schema = Koha::Database->schema; print "SessionStorage: '" . C4::Context->preference('SessionStorage') . "'\n"; sub test { my $session = C4::Auth::get_session(""); } $dbh->do("CREATE TABLE IF NOT EXISTS `tmp_test_cgi_session` (foo TINYTEXT)"); eval { $schema->txn_do(sub { my $sth = $dbh->prepare("INSERT INTO `tmp_test_cgi_session` VALUES ('foo')"); $sth->execute(); test(); die "error"; }); }; if ($@) { print $@, "\n"; } my $sth = $dbh->prepare("SELECT * FROM `tmp_test_cgi_session`;"); $sth->execute(); # The INSERT of the foo row should have been rolled back, but isn't when # SessionStorage is 'mysql'. while (my $row = $sth->fetchrow_arrayref) { print $row->[0], "\n"; } $dbh->do("DROP TABLE `tmp_test_cgi_session`");
Yes, it seems that it does not move anymore. 22 issues in the last 10 years or so. Note that we are now already working too on a report that will bring down the number of sessions by fixing issues in Auth.pm on the Koha side. Look for Data::Session to find an earlier attempt to move away from this CPAN module. A bottleneck was how it used CGI.
Koha::Session should not be that hard to write given the specs?
(In reply to Marcel de Rooy from comment #2) > Koha::Session should not be that hard to write given the specs? Agreed
*** This bug has been marked as a duplicate of bug 17427 ***