Home » Authentication » LiveUser » Bug #3276

[2005-01-23 20:17 UTC] roehr at zilleon dot com

Description:
------------
Hi,

there is a conflict when using observers for both onLogout/postLogout and onIdled/onExpired. When a redirect is being used in the logout observer method the onIdled/onExpired events will not be triggered. Of course the logout should be triggered when the session is idled or expired but this should be done AFTER triggering the idle/expire events.

Please see below for a quick fix.

Thank you very much!

Best regards,
Torsten Roehr

Reproduce code:
---------------
Just change the order of some code lines:

Lines 899-901 from:
$this->logout();
$this->status = LIVEUSER_STATUS_EXPIRED;
$this->triggerEvent('onExpired');

to:
$this->status = LIVEUSER_STATUS_EXPIRED;
$this->triggerEvent('onExpired');
$this->logout();

And lines 906-908 from:
$this->logout();
$this->status = LIVEUSER_STATUS_IDLED;
$this->triggerEvent('onIdled');

to:
$this->status = LIVEUSER_STATUS_IDLED;
$this->triggerEvent('onIdled');
$this->logout();

[2005-01-23 20:45 UTC] smith at backendmedia dot com

Err isnt this just flipping around the issue? I guess 'onLogout' handler does make sense to be placed after the others since its is "more" common. Did I mention that I dislike redirect() for this very reason? It just seems like such an ugly thing to do.

[2005-01-23 22:33 UTC] roehr at zilleon dot com

Here's the diff:

@@ -894,18 +894,18 @@
$this->logout(false);
} elseif ($this->_auth->expireTime > 0 && $this->_auth->currentLogin > 0) {
// Check if authentication session is expired.
if (($this->_auth->currentLogin + $this->_auth->expireTime) < time()) {
- $this->logout();
$this->status = LIVEUSER_STATUS_EXPIRED;
$this->triggerEvent('onExpired');
+ $this->logout();
// Check if maximum idle time is reached.
} elseif (isset($_SESSION[$this->_options['session']['varname']]['idle']) &&
($_SESSION[$this->_options['session']['varname']]['idle'] + $this->_auth->idleTime) < time())
{
- $this->logout();
$this->status = LIVEUSER_STATUS_IDLED;
$this->triggerEvent('onIdled');
+ $this->logout();
}
}
}

[2005-01-25 10:27 UTC] smith at backendmedia dot com

This bug has been fixed in CVS.

In case this was a documentation problem, the fix will show up at the
end of next Sunday (CET) on pear.php.net.

In case this was a pear.php.net website problem, the change will show
up on the website in short time.

Thank you for the report, and for helping us make PEAR better.