@mbabker is there a reason why line 117 is not

if (is_null($this->config->get('session')) && $this->config->get('session') !== false)

and line 123 again not

if (is_null($this->config->get('session_name')) && $this->config->get('session') !== false)

This way session is disabled if in configuration there is a public $session = false;
Am I missing something here?

No idea

On Sunday, March 29, 2015, Dimitris Grammatiko notifications@github.com
wrote:

@mbabker https://github.com/mbabker is there a reason why line 117 is
not

if (is_null($this->config->get('session')) && $this->config->get('session') !== false)

and line 123 again not

if (is_null($this->config->get('session_name')) && $this->config->get('session') !== false)

This way session is disabled if in configuration there is a public
$session = false;
Am I missing something here?

—
Reply to this email directly or view it on GitHub
#6608 (comment).

Because the active user object is stored in the session (and get initialised by JFactory::getUser) I'd imagine disabling the session is effectively impossible anyhow

Storing the active user in the session isn't necessarily bad, but having JUser coupled to JSession (via JFactory) is a huge mistake.

I guess decoupling them will be huge b/c break?

I'd imagine so. I'm sure someone somewhere tries to refresh the active user details by directly editing the session. Allow it to work around that then their code breaks on those sites...

Closing for lack of interest.

@mbabker this was a good improvement and should be considered for Joomla
If you reopen it I will spend some time testing it

@mbabker some more infos on testing will be really appreciated.
I changed my php.ini to

[Session]
session.save_handler = files
session.save_path = /Applications/MAMP/tmp/php
session.use_cookies = 1
session.name = PHPSESSID
session.auto_start = 0
session.cookie_lifetime = 0
session.cookie_path = /
session.cookie_domain =
session.serialize_handler = php

session.gc_probability = 1
session.gc_divisor     = 200
session.gc_maxlifetime = 1440

session.bug_compat_42 = 1
session.bug_compat_warn = 1
session.referer_check =
session.entropy_length = 0
session.entropy_file =
session.cache_limiter = nocache
session.cache_expire = 180
session.use_trans_sid = 0
url_rewriter.tags = "a=href,area=href,frame=src,input=src,form=,fieldset="

but cannot figure out how to confirm that the session is not updated in db. PHPMyAmin?

IIRC I had session.gc_probability to 1 and session.gc_divisor at like 4 or something (so it would run on 1 in 4 page requests). You could probably log something in JSessionStorageDatabase to make note of when the method gets triggered. When it does, it should execute the same query that's removed from the application class here.

@wilsonge Don't merge this. Come to find out this is needed to clean the session table if you're using another session handler since JApplicationCms is inserting records into the session table no matter what.

the checkSession function?

Right. This garbage collect method is basically ensuring that expired sessions, regardless of handler, are purged out of the database because of that code in checkSession.

Superseded by #8862