Regardless of the session storage handler used the database session table is cleared based on the result of a modulo operation in JApplicationCms::loadSession(). When using the database for session storage the table is therefore likely be cleared far more often than per the PHPRC gc_ settings, resulting in unnecessary operations. It also renders the database storage handler's gc() method a little redundant and potentially breaks custom handler gc() methods that utilise session table data prior to their deletion.

Summary of Changes

Amended JApplicationCms::loadSession() so that it won't remove expired sessions from the database when the database storage handler is being used; they will instead be removed only on execution of JSessionStorageDatabase::gc().

Testing Instructions

• Set the PHPRC so garbage collector runs on every execution.
• Set the session lifetime in Joomla's config to a short duration.
• Populate the #__session table.
• After the created sessions' lifetimes have expired confirm the expired sessions are not removed from the #__session table on execution of JApplicationCms::loadSession() but on execution of JSessionStorageDatabase::gc().
• Switch the session handler to anything other than 'Database' in Joomla's config.
• Populate the #__session table again.
• After the created sessions' lifetimes have expired confirm the expired session are removed in JApplicationCms::loadSession() if the result of the modulo operation is not 0.

Documentation Changes Required

None