User tests: Successful: Unsuccessful:
Pull Request resolves #
MetadataManager::createRecordIfNonExisting() checks whether a session metadata record exists before inserting it. The guard compares against the wrong constant:
$exists = $this->checkSessionRecordExists($session->getId());
// Only touch the database if the record does not already exist
if ($exists !== self::$sessionRecordExists) {
return;
}With this comparison the method returns when no record was found and only attempts the insert when a record is already present, which is the opposite of both the method name and the comment above the guard. The insert for an existing record then fails on the primary key and the failure is swallowed, so in practice the method has never created anything.
This PR compares against self::$sessionRecordDoesNotExist instead, so the record is inserted when it is missing. When the state cannot be determined because the existence query failed, nothing is written, matching the conservative handling in createOrUpdateRecord().
The method currently has no callers in the core code base, so no behavioural change is expected anywhere in the CMS; it is public API of a class marked @internal and should behave as documented for any consumer. A unit test class is added covering the missing, existing and undetermined record states; two of the three cases fail against the previous guard.
Run the new unit tests:
libraries/vendor/bin/phpunit tests/Unit/Libraries/Cms/Session/MetadataManagerTest.php
createRecordIfNonExisting() inserts nothing when the metadata record is missing and attempts a duplicate insert when it already exists, which fails on the primary key.
createRecordIfNonExisting() inserts the metadata record when it is missing, does nothing when it exists, and does nothing when the record state cannot be determined.
| Status | New | ⇒ | Pending |
| Category | ⇒ | Libraries Unit Tests |
Hi @laoneo, @richard67 @muhme could you take a look at #48561 when you have a chance? This patch focuses on rejecting malformed remember-me cookies. I am happy to make changes or add tests if that would help. Thanks for your time!
@ManoharPaturi I'm pretty sure this PR here and the other 2 where you pasted in your identical message from a 3rd PR (the remember-me cookie) have nothing to do with the remember-me cookie.
It is not really helpful in a volunteer driven open source project to keep maintainers busy with mass mentioned (which cause notifications).
I'm genuinely sorry for copying the same follow-up across unrelated PRs and tagging multiple maintainers.
Some of my earlier contributions had gone unanswered for a while, so I thought a follow-up would be appropriate, but I handled it poorly my bad(new here).
I understand that this creates unnecessary notifications and takes time away from volunteer maintainers. I'll make sure any future follow-ups are relevant to the specific PR and avoid mass mentions.
won't happen again.
This pull request has been automatically rebased to 6.2-dev. Joomla! 5.4 is now in security only mode.
| Title |
|
||||||
Hi @laoneo, @richard67 @muhme could you take a look at #48561 when you have a chance? This patch focuses on rejecting malformed remember-me cookies. I am happy to make changes or add tests if that would help. Thanks for your time!