Summary of Changes

Once the session is closed (before write), Joomla\CMS\Session\Storage\JoomlaStorage::close() creates the base64-decoded serialized session registry within cloning the session registry object ($this->data):

	public function close(): void
	{
		// Before storing data to the session, we serialize and encode the Registry
		$_SESSION['joomla'] = base64_encode(serialize(clone $this->data));

		parent::close();
	}

Joomla\Registry\Registry object's magic clone unserializes serialized data:

	public function __clone()
	{
		$this->data = unserialize(serialize($this->data));
	}

This unserialize results in magic wakeup of all objects in the session registry.

Joomla\CMS\User instance in session has the magic wakeup which results in additional load of data.

Basically, we have a chain of User-related magic sleep/wakeup:

1. User::__sleep() - on Joomla\Registry\Registry::__clone() due to serialize()
2. User::__wakeup() - on Joomla\Registry\Registry::__clone() due to unserialize()
3. User::__sleep() - on Joomla\CMS\Session\Storage\JoomlaStorage::close() due to serialize()

This 2nd step is actually an extra wakeup which results in two extra DB queries which don't have any logic because the saved session contains only user ID (see User::__sleep()) and the session read re-loads the data via User::__wakeup().

I don't see any purpose of cloning the session registry before serializing it, any thoughts?

Testing Instructions

1. Log in Joomla, ensure that Database Type is MySQLi in global config.
2. Add full logging of SQL queries: edit libraries/vendor/joomla/database/src/DatabaseDriver.php and add after line 639 ($this->executed = $this->statement->execute();):

            file_put_contents(
                JPATH_SITE.'/tmp/'.microtime(true).'.txt',
                $this->sql .
                "\r\n" .
                print_r($bounded, true) .
                "\r\n" .
                print_r(debug_backtrace(2), true)
            );

3. Load Joomla page
4. See bunch of files in /tmp folder
5. Search for these two extra queries in the final files (order files by filename), note the :userid and :muserid bound params as your user ID:

SELECT *
FROM `#__users`
WHERE `id` = :userid

SELECT `g`.`id`,`g`.`title`
FROM `#__usergroups` AS `g`
INNER JOIN `#__user_usergroup_map` AS `m` ON `m`.`group_id` = `g`.`id`
WHERE `m`.`user_id` = :muserid

6. See the trace in files, these queries are the result of clone/sleep/wakeup described above.
7. Apply patch
8. Delete debug files
9. Re-load Joomla page
10. See less files (-2) - means no extra queries

Actual result BEFORE applying this Pull Request

Joomla executes extra two database queries on each page load for logged user.

Expected result AFTER applying this Pull Request

No extra queries. Joomla works as before.

Documentation Changes Required

No.