Bug 29942 - Spurious commit in mysql session storage
Summary: Spurious commit in mysql session storage
Status: RESOLVED DUPLICATE of bug 17427
Alias: None
Product: Koha
Classification: Unclassified
Component: Database (show other bugs)
Version: unspecified
Hardware: All All
: P5 - low major (vote)
Assignee: Bugs List
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2022-01-25 15:08 UTC by Andreas Jonsson
Modified: 2023-05-03 10:42 UTC (History)
3 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Andreas Jonsson 2022-01-25 15:08:38 UTC
The DBI storage driver for CGI::Session
commits any on-going transactions in its destructor subroutine.

Consequently if SessionStorage is set to mysql, instantiating a
session and assigning it to a local variable inside a transaction will
unexpectedly cause the transaction to be committed as illustrated by
the below script.

I have reported this issue upstream and created pull requests but it
is unclear if anyone is maintaining CGI::Session.

https://rt.cpan.org/Ticket/Display.html?id=140855
https://github.com/cromedome/cgi-session/pull/5

We should maybe consider maintaining our own fork of CGI::Session.    
    
#!/usr/bin/perl -w

use DBI;
use C4::Auth;
use Koha::Database;

use strict;

my $dbh = C4::Context->dbh;
my $schema = Koha::Database->schema;

print "SessionStorage: '" . C4::Context->preference('SessionStorage') . "'\n";

sub test {
    my $session = C4::Auth::get_session("");
}

$dbh->do("CREATE TABLE IF NOT EXISTS `tmp_test_cgi_session` (foo TINYTEXT)");

eval {
    $schema->txn_do(sub {
        my $sth = $dbh->prepare("INSERT INTO `tmp_test_cgi_session` VALUES ('foo')");
        $sth->execute();

        test();

        die "error";
    });
};

if ($@) {
    print $@, "\n";
}

my $sth = $dbh->prepare("SELECT * FROM `tmp_test_cgi_session`;");
$sth->execute();

# The INSERT of the foo row should have been rolled back, but isn't when 
# SessionStorage is 'mysql'. 
while (my $row = $sth->fetchrow_arrayref) {
    print $row->[0], "\n"; 
}

$dbh->do("DROP TABLE `tmp_test_cgi_session`");
Comment 1 Marcel de Rooy 2022-01-25 15:46:32 UTC
Yes, it seems that it does not move anymore. 22 issues in the last 10 years or so.
Note that we are now already working too on a report that will bring down the number of sessions by fixing issues in Auth.pm on the Koha side.

Look for Data::Session to find an earlier attempt to move away from this CPAN module. A bottleneck was how it used CGI.
Comment 2 Marcel de Rooy 2022-01-25 15:47:49 UTC
Koha::Session should not be that hard to write given the specs?
Comment 3 Tomás Cohen Arazi 2023-04-21 12:51:43 UTC
(In reply to Marcel de Rooy from comment #2)
> Koha::Session should not be that hard to write given the specs?

Agreed
Comment 4 Jonathan Druart 2023-05-03 10:42:04 UTC

*** This bug has been marked as a duplicate of bug 17427 ***