White screen when session times out

[Robert Lyon]

Issue with 15.10

If you are logged into mahara and leave the site open in a browser for some time when you come back and try to navigate somewhere you can end up with a white blank screen - on refresh of page all works fine.

The problem is this:
PHP Fatal error: auth_generate_login_form(): The script tried to execute a method or access a property of an incomplete object. Please ensure that the class definition "Pieform" of the object you are trying to operate on was loaded _before_ unserialize() gets called or provide a __autoload() function to load the class definition in /home/robertl/htdocs/mahara-devel/mahara/htdocs/auth/lib.php on line 1945

Which deals with the line:
return get_login_form_js($SESSION->loginform->build());

In earlier Mahara you would instead be given (via js) a popup login box.

[Robert Lyon (robertl-9)]

From what I have read the problem seems to be this:

The automatic $_SESSION serialization/unserialization occurs when you call session_start().
That means the order in which you include your files and call the session_start() is very important.

Eg

BAD:
session_start();
require_once('pieforms/pieform.php');

GOOD:
require_once('pieforms/pieform.php');
session_start();

One possible solution is to use the session_write_close(), then session_start()

[Aaron Wells (u-aaronw)]

The root of this problem is that we're serializing the login Pieform object and storing it in the session. This was done in this patch: https://reviews.mahara.org/#/c/2980/5/htdocs/auth/lib.php

Since that patch was added in Mahara 1.9, this problem is probably present in all versions of Mahara since then.

Probably, what we should be doing is *not* serializing the entire login form object, but just portions of it that are made out of PHP primitives (strings, arrays, etc).

[Aaron Wells (u-aaronw)]

On further testing, this is not a problem until Mahara 15.10. In 1.9 and 1.10, the system works as expected (although it does generating a PHP warning message about an undefined variable).

To replicate:

1. Add this to your config.php file, to set session timeout to 10 seconds: $cfg->session_timeout = 10;
2. Log in to Mahara
3. Count to 10
4. Click on the "Dashboard" link again

Expected result: You should be redirected to the login screen and see "Please login again"
Actual result: You get a white screen from Mahara crashing fatally. This is the error stack in the logs:

Fatal error: auth_generate_login_form(): The script tried to execute a method or access a property of an incomplete object. Please ensure that the class definition "Pieform" of the object you are trying to operate on was loaded _before_ unserialize() gets called or provide a __autoload() function to load the class definition in htdocs/auth/lib.php on line 1944

1. {main}() htdocs/index.php:0
2. smarty() htdocs/index.php:88
3. auth_generate_login_form() htdocs/lib/web.php:703

[Mahara Bot (dev-mahara)]

Patch for "15.04_STABLE" branch: https://reviews.mahara.org/5407

[Aaron Wells (u-aaronw)]

On further inspection, it doesn't look like there's any need for that particular form object to be cached in the session at all. Maybe this was just an oversight from an earlier point in the development of Jono's patch.

[Mahara Bot (dev-mahara)]

Reviewed: https://reviews.mahara.org/5407
Committed: https://git.nzoss.org.nz/mahara/mahara/commit/aee374c0aa5d89cadba50a2eff2891af4ee751c0
Submitter: Robert Lyon (<email address hidden>)
Branch: 15.04_STABLE

commit aee374c0aa5d89cadba50a2eff2891af4ee751c0
Author: Aaron Wells <email address hidden>
Date: Wed Sep 30 17:15:49 2015 +1300

Remove unnecessary cached form from the session

Bug 1495200 & Bug 1496681

behatnotneeded: Well, we could test this, but it would
require a 60-second wait for the session to timeout (since
the least you can set the session timeout via the UI
is 1 minute)

Change-Id: Ia5c861c16b6c893ada9d5eb2111f0b6a9aee49ad

[Mahara Bot (dev-mahara)]

Patch for "15.10_STABLE" branch: https://reviews.mahara.org/5441

[Mahara Bot (dev-mahara)]

Reviewed: https://reviews.mahara.org/5441
Committed: https://git.nzoss.org.nz/mahara/mahara/commit/784dbf9d5a5a8fc31a7d5b49bbcb41fe68578b7b
Submitter: Robert Lyon (<email address hidden>)
Branch: 15.10_STABLE

commit 784dbf9d5a5a8fc31a7d5b49bbcb41fe68578b7b
Author: Aaron Wells <email address hidden>
Date: Wed Sep 30 17:15:49 2015 +1300

Remove unnecessary cached form from the session

Bug 1495200 & Bug 1496681

behatnotneeded: Well, we could test this, but it would
require a 60-second wait for the session to timeout (since
the least you can set the session timeout via the UI
is 1 minute)

Change-Id: Ia5c861c16b6c893ada9d5eb2111f0b6a9aee49ad
(cherry picked from commit aee374c0aa5d89cadba50a2eff2891af4ee751c0)

[Mahara Bot (dev-mahara)]

Patch for "master" branch: https://reviews.mahara.org/5442

[Mahara Bot (dev-mahara)]

Reviewed: https://reviews.mahara.org/5442
Committed: https://git.nzoss.org.nz/mahara/mahara/commit/e2d001a8873c3897ef088d6ed609f11846c82c41
Submitter: Robert Lyon (<email address hidden>)
Branch: master

commit e2d001a8873c3897ef088d6ed609f11846c82c41
Author: Aaron Wells <email address hidden>
Date: Wed Sep 30 17:15:49 2015 +1300

Remove unnecessary cached form from the session

Bug 1495200 & Bug 1496681

behatnotneeded: Well, we could test this, but it would
require a 60-second wait for the session to timeout (since
the least you can set the session timeout via the UI
is 1 minute)

Change-Id: Ia5c861c16b6c893ada9d5eb2111f0b6a9aee49ad
(cherry picked from commit aee374c0aa5d89cadba50a2eff2891af4ee751c0)
(cherry picked from commit 784dbf9d5a5a8fc31a7d5b49bbcb41fe68578b7b)

[Mahara Bot (dev-mahara)]

Patch for "1.10_STABLE" branch: https://reviews.mahara.org/5443

[Mahara Bot (dev-mahara)]

Patch for "1.9_STABLE" branch: https://reviews.mahara.org/5444

[Mahara Bot (dev-mahara)]

Reviewed: https://reviews.mahara.org/5444
Committed: https://git.nzoss.org.nz/mahara/mahara/commit/af0f74a9dafa0b3726df925e65c1443f7aa2e29a
Submitter: Robert Lyon (<email address hidden>)
Branch: 1.9_STABLE

commit af0f74a9dafa0b3726df925e65c1443f7aa2e29a
Author: Aaron Wells <email address hidden>
Date: Wed Sep 30 17:15:49 2015 +1300

Remove unnecessary cached form from the session

Bug 1495200 & Bug 1496681

behatnotneeded: Well, we could test this, but it would
require a 60-second wait for the session to timeout (since
the least you can set the session timeout via the UI
is 1 minute)

Change-Id: Ia5c861c16b6c893ada9d5eb2111f0b6a9aee49ad
(cherry picked from commit aee374c0aa5d89cadba50a2eff2891af4ee751c0)
(cherry picked from commit 784dbf9d5a5a8fc31a7d5b49bbcb41fe68578b7b)

[Mahara Bot (dev-mahara)]

Reviewed: https://reviews.mahara.org/5443
Committed: https://git.nzoss.org.nz/mahara/mahara/commit/ea1bdc16d53ac5c659a9df853fae8fa891102e51
Submitter: Robert Lyon (<email address hidden>)
Branch: 1.10_STABLE

commit ea1bdc16d53ac5c659a9df853fae8fa891102e51
Author: Aaron Wells <email address hidden>
Date: Wed Sep 30 17:15:49 2015 +1300

Remove unnecessary cached form from the session

Bug 1495200 & Bug 1496681

behatnotneeded: Well, we could test this, but it would
require a 60-second wait for the session to timeout (since
the least you can set the session timeout via the UI
is 1 minute)

Change-Id: Ia5c861c16b6c893ada9d5eb2111f0b6a9aee49ad
(cherry picked from commit aee374c0aa5d89cadba50a2eff2891af4ee751c0)
(cherry picked from commit 784dbf9d5a5a8fc31a7d5b49bbcb41fe68578b7b)