Zen Cart Logo
Forums / Bug Reports / [Not a bug] typo in sessions.php?

[Not a bug] typo in sessions.php?

Views: 1,194

Results 1 to 3 of 3
24 Aug 2011, 11:45 AM
#1
paulm avatar

paulm

Totally Zenned

Join Date:
Nov 2003
Posts:
1,878
Plugin Contributions:
5

[Not a bug] typo in sessions.php?

It's a minor error, and does not cause any problems as it is, but I imagine it may lead to a real bug if the code is updated by someone who is not aware of this typo.

In includes/functions/sessions.php:

    if (!$SESS_LIFE = (SESSION_TIMEOUT_ADMIN > 900 ? 900 : SESSION_TIMEOUT_ADMIN)) {
      $SESS_LIFE = (SESSION_TIMEOUT_ADMIN > 900 ? 900 : SESSION_TIMEOUT_ADMIN);
    }
```(Under normal circumstances the 1st line is always executed, which sets $SESS_LIFE on every page call. The 2nd line will only be executed if SESSION_TIMEOUT_ADMIN is not true...)


Should be:
if (!$SESS_LIFE == (SESSION_TIMEOUT_ADMIN > 900 ? 900 : SESSION_TIMEOUT_ADMIN)) {
  $SESS_LIFE = (SESSION_TIMEOUT_ADMIN > 900 ? 900 : SESSION_TIMEOUT_ADMIN);
}

(note: similar error in several 1.3.x versions)
30 Aug 2011, 10:44 AM
#2
paulm avatar

paulm

Totally Zenned

Join Date:
Nov 2003
Posts:
1,878
Plugin Contributions:
5

Re: [Not a bug] typo in sessions.php?

I think I found where it's coming from. The (in)famous pre-zen-cart code used this:

    if (!$SESS_LIFE = get_cfg_var('session.gc_maxlifetime')) {
      $SESS_LIFE = 1440;
    }
```Which makes sense. $SESS_LIFE is set to the value of get_cfg_var('session.gc_maxlifetime'), but if the result is a non True value $SESS_LIFE is set to 1440. This prevents the session timeout to be zero under circumstances.

In Zen Cart 1.1 (and up) the code was copied, and edited to set a separate session timeout for the admin like this:
if (defined('DIR_WS_ADMIN')) {
  if (!$SESS_LIFE = (SESSION_TIMEOUT_ADMIN + 900)) {
    $SESS_LIFE = (SESSION_TIMEOUT_ADMIN + 900);
  }
} else {
  if (!$SESS_LIFE = get_cfg_var('session.gc_maxlifetime')) {
    $SESS_LIFE = 1440;
  }
}

To set SESS_LIFE to a safe value (which I assume is the intention) I would use something like:

if (IS_ADMIN_FLAG === true) {
$SESS_LIFE = (SESSION_TIMEOUT_ADMIN < 300 || SESSION_TIMEOUT_ADMIN > 900) ? 900 : SESSION_TIMEOUT_ADMIN)
} else {
if (!$SESS_LIFE = get_cfg_var('session.gc_maxlifetime')) {
$SESS_LIFE = 1440;
}
}

11 Sep 2011, 1:04 PM
#3
paulm avatar

paulm

Totally Zenned

Join Date:
Nov 2003
Posts:
1,878
Plugin Contributions:
5

Re: [Not a bug] typo in sessions.php?

Sorry, indeed not a bug, should have posted to code suggestions. But not really important, it just made me scratch my head :D
(I am sure though it can easily lead to a future bug)