Bugzilla – Attachment 31698 Details for
Bug 12954
Questionable logic regarding session handling in C4::Auth::checkauth()
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 12954 - Questionable logic regarding session handling in C4::Auth::checkauth()
Bug-12954---Questionable-logic-regarding-session-h.patch (text/plain), 2.15 KB, created by
Jacek Ablewicz
on 2014-09-18 10:40:10 UTC
(
hide
)
Description:
Bug 12954 - Questionable logic regarding session handling in C4::Auth::checkauth()
Filename:
MIME Type:
Creator:
Jacek Ablewicz
Created:
2014-09-18 10:40:10 UTC
Size:
2.15 KB
patch
obsolete
>From e08e668490d547cafab8fccfcc004fad593a29e6 Mon Sep 17 00:00:00 2001 >From: Jacek Ablewicz <abl@biblos.pk.edu.pl> >Date: Thu, 18 Sep 2014 12:23:52 +0200 >Subject: [PATCH] Bug 12954 - Questionable logic regarding session handling in > C4::Auth::checkauth() > >Note: This is probably not quite proper patch for this bug (and for sure >not the best possible approach for fixing it); uploaded only as >reference/proof of concept etc. While it does seem to fix the problem >described in Bug 12954 comment #0, it most likely does have some side >effects regarding anonymous search history storage and handling. >--- > C4/Auth.pm | 16 ++++++++++++---- > 1 file changed, 12 insertions(+), 4 deletions(-) > >diff --git a/C4/Auth.pm b/C4/Auth.pm >index 2b8a036..925728d 100644 >--- a/C4/Auth.pm >+++ b/C4/Auth.pm >@@ -734,7 +734,7 @@ sub checkauth { > } > elsif ( !$lasttime || ($lasttime < time() - $timeout) ) { > # timed logout >- $info{'timed_out'} = 1; >+ $info{'timed_out'} = 1 if $lasttime; > if ($session) { > $session->delete(); > $session->flush; >@@ -992,12 +992,20 @@ sub checkauth { > > } > else { >+ ## if we got here, it is an unsuccessfull login attempt > if ($userid) { > $info{'invalid_username_or_password'} = 1; >- C4::Context->_unset_userenv($sessionID); > } >- $session->param('lasttime',time()); >- $session->param('ip',$session->remote_addr()); >+ if ($session) { >+ $session->delete(); >+ $session->flush; >+ } >+ C4::Context->_unset_userenv($sessionID) if $sessionID; >+ $userid = undef; >+ $sessionID = undef; >+ ## probably not a good idea (at least not without setting up 'sessiontype' to 'anon' as well ?) >+ # $session->param('lasttime',time()); >+ # $session->param('ip',$session->remote_addr()); > } > } # END if ( $userid = $query->param('userid') ) > elsif ($type eq "opac") { >-- >1.7.10.4
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 12954
:
31698
|
34551
|
34829
|
35341
|
35412
|
37595