external/aurweb
0
0
Fork 0
mirror of https://gitlab.archlinux.org/archlinux/aurweb.git synced 2025-02-03 10:43:03 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Remove the per-user session limit

Browse source 
This feature was originally introduced by
f961ffd9c7 as a fix for FS#12898
<https://bugs.archlinux.org/task/12898>.

As of today, it is broken because of the `q.SessionID IS NULL` condition
in the WHERE clause, which can’t be true because SessionID is not
nullable. As a consequence, the session limit was not applied.

The fact the absence of the session limit hasn’t caused any issue so
far, and hadn’t even been noticed, suggests the feature is unneeded.

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
This commit is contained in:
Frédéric Mangano-Tarumi 2020-07-29 13:46:10 +02:00 • committed by Lukas Fleischer
parent 71740a75a2
commit aca57c5de6
2 changed files with 0 additions and 16 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
conf/config.defaults
View file

@ -13,7 +13,6 @@ passwd_min_len = 8
default_lang = en
default_timezone = UTC
sql_debug = 0
max_sessions_per_user = 8
login_timeout = 7200
persistent_cookie_timeout = 2592000
max_filesize_uncompressed = 8388608

15
web/lib/acctfuncs.inc.php
View file

@ -596,21 +596,6 @@ function try_login() {
/* Generate a session ID and store it. */
while (!$logged_in && $num_tries < 5) {
$session_limit = config_get_int('options', 'max_sessions_per_user');
if ($session_limit) {
/*
* Delete all user sessions except the
* last ($session_limit - 1).
*/
$q = "DELETE FROM Sessions ";
$q.= "WHERE UsersId = " . $userID . " ";
$q.= "AND SessionID NOT IN (SELECT SessionID FROM Sessions ";
$q.= "WHERE UsersID = " . $userID . " ";
$q.= "ORDER BY LastUpdateTS DESC ";
$q.= "LIMIT " . ($session_limit - 1) . ")";
$dbh->query($q);
}
$new_sid = new_sid();
$q = "INSERT INTO Sessions (UsersID, SessionID, LastUpdateTS)"
." VALUES (" . $userID . ", '" . $new_sid . "', " . strval(time()) . ")";