composer/iTop
6
0
Fork 0
mirror of https://github.com/Combodo/iTop.git synced 2026-08-30 09:58:17 +02:00
Code Issues Packages Projects Releases Wiki Activity

N°9625 - Add Session::UnsetAll() method to ensure that even the "welcome" session value is correctly resetted (#970)

Browse Source 
* N°9625 - Add Session::UnsetAll() method to ensure that even the "welcome" session value is correctly resetted

* N°9625 - Add unit tests

* N°9625 - Improve robustness

* N°9625 - Code review updates

* N°9625 - Fix logoff page to ensure all authentication plugins are called before emptying the session
This commit is contained in:
Molkobain
2026-07-17 10:28:58 +02:00
committed by GitHub
parent 9fbc53cf00
commit 13fad9efc1
4 changed files with 41 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
application/loginwebpage.class.inc.php
View File

@@ -25,11 +25,11 @@
*/
use Combodo\iTop\Application\Branding;
use Combodo\iTop\Application\Helper\Session;
use Combodo\iTop\Application\WebPage\ErrorPage;
use Combodo\iTop\Application\WebPage\NiceWebPage;
use Combodo\iTop\Service\Events\EventData;
use Combodo\iTop\Service\Events\EventService;
use Combodo\iTop\Service\Session\Session;
/**
* Web page used for displaying the login form
@@ -369,16 +369,7 @@ class LoginWebPage extends NiceWebPage
public static function ResetSession()
{
// Unset all of the session variables.
Session::Unset('auth_user');
Session::Unset('login_state');
Session::Unset('can_logoff');
Session::Unset('archive_mode');
Session::Unset('impersonate_user');
Session::Unset('PluginProperties');
Session::Unset('UrlMakerClass');
Session::Unset('itop_env');
Session::Unset('obj_messages');
Session::Unset('profile_list');
Session::UnsetAll();
UserRights::_ResetSessionCache();
// If it's desired to kill the session, also delete the session cookie.
// Note: This will destroy the session, and not just the session data!

4
pages/logoff.php
View File

@@ -49,8 +49,6 @@ if (Session::IsSet('auth_user')) {
UserRights::Login($sAuthUser); // Set the user's language
}
LoginWebPage::ResetSession();
$bLoginDebug = MetaModel::GetConfig()->Get('login_debug');
if ($bLoginDebug) {
IssueLog::Info("---------------------------------");
@@ -88,7 +86,7 @@ if ($bLoginDebug) {
IssueLog::Info("--> Display logout page");
}
LoginWebPage::ResetSession(true);
LoginWebPage::ResetSession();
if ($bLoginDebug) {
$sSessionLog = session_id().' '.utils::GetSessionLog();
IssueLog::Info("SESSION: $sSessionLog");

21
sources/Service/Session/Session.php
View File

@@ -131,6 +131,23 @@ class Session
}
}
/**
* Unset all session variables, no matter if they were set by iTop or not
*
* @return void
* @since 3.3.0 N°9625
*/
public static function UnsetAll(): void
{
if (session_status() !== PHP_SESSION_ACTIVE) {
self::Start();
$_SESSION = [];
self::WriteClose();
} else {
$_SESSION = [];
}
}
/**
* @param string|array $key key to access to the session variable. To access to $_SESSION['a']['b'] $key must be ['a', 'b']
* @param $default
@@ -183,6 +200,10 @@ class Session
public static function ListVariables(): array
{
if (!isset($_SESSION)) {
return [];
}
return array_keys($_SESSION);
}

17
tests/php-unit-tests/unitary-tests/application/Session/SessionTest.php
View File

@@ -123,6 +123,23 @@ class SessionTest extends ItopTestCase
$this->assertFalse(Session::IsSet(['test1', 'test2', 'test3']));
}
public function testUnsetAll()
{
Session::Start();
Session::Set('test', 'OK');
Session::Set(['test1', 'test2', 'test3'], 'OK');
Session::Set('another_test', ['foo' => 'bar']);
$this->assertTrue(Session::IsSet('test'));
$this->assertTrue(Session::IsSet(['test1', 'test2', 'test3']));
$this->assertTrue(Session::IsSet('another_test'));
Session::UnsetAll();
$this->assertEmpty($_SESSION);
$this->assertFalse(Session::IsSet('test'));
$this->assertFalse(Session::IsSet(['test1', 'test2', 'test3']));
$this->assertFalse(Session::IsSet('another_test'));
}
public function testRegenerateId()
{
Session::Start();