? Pending

User tests: Successful: Unsuccessful:

avatar mbabker
mbabker
8 Jan 2016

1) JSessionStorageDatabase is dependent on the application to insert the session record into the database table, the logic is added to the write() method to remove this dependency.
2) Garbage collection when the database session store is used is deferred to the end of the request cycle to help prevent a request failure solely because expired session records are being purged. As explained in the PHP documentation the gc() method is called when the session is started.
3) The code in JApplicationCms cleaning purged session records is adjusted to not cause a fatal error on a query failure.
4) The same query will only run if the database session handler is not in use; PHP's API will take care of this operation for the database handler.
5) JApplicationCms::checkSession() is adjusted to only manipulate the time column when not using the database session handler to preserve the record's integrity when written by the session API.

In theory, with these changes, the fatal error that is thrown at https://github.com/joomla/joomla-cms/blob/753ac184e5e8a822c63c42a07007437c6137c54e/libraries/cms/application/cms.php#L212 could be removed with these changes and the error handled silently. The user's request would be able to complete successfully without this query succeeding. No operation for the user is impaired when not using the database handler. When using the database handler, the session API's write method would be able to try and write the data to the session table (without the extra metadata (userid, username, client, and guest columns), none of which is required to have the session actually work) and a failure in the handler would just result in the session not persisting in a worst case scenario.

avatar mbabker mbabker - open - 8 Jan 2016
avatar mbabker mbabker - change - 8 Jan 2016
Status New Pending
avatar joomla-cms-bot joomla-cms-bot - change - 8 Jan 2016
Labels Added: ?
avatar brianteeman brianteeman - change - 12 Jan 2016
Category Authentication Libraries
avatar mbabker mbabker - change - 14 Feb 2016
Status Pending Closed
Closed_Date 0000-00-00 00:00:00 2016-02-14 23:18:31
Closed_By mbabker
avatar mbabker mbabker - close - 14 Feb 2016

Add a Comment

Login with GitHub to post a comment