Infinite redirect loop caused by logged out user in usr_session table

[Robert Lyon]

The USER object contains the id of the user that is logged in and it matches up to the usr_session table so we know which session is matched to what user.

When one is not logged in the USER object has id = 0

If for some reason we end up with usr = 0 in the usr_session table we end up in an infinite loop
because it tries to log out that dummy user but can't

It should never end up in the usr_session table.

So we need to do these things:
1) When saving data to usr_session table never save if user id = 0, instead throw warning
to avoid the problem

2) When reading usr_session data in auth_setup() function to ignore fetching info for usr = 0
to ignore bad data

behatnotneeded

[Mahara Bot (dev-mahara)]

Patch for "master" branch: https://reviews.mahara.org/8306

[Robert Lyon (robertl-9)]

This bug is critical to fix in one sense: that it makes the site unusable with redirect loop

But is non-critical in another sense: that is virtually impossible to replicate under normal circumstances.

So yes we need to fix asap to avoid the problem when one logs in and fills up dataroot at same time causing logged out user to be saved in usr_session table

[Mahara Bot (dev-mahara)]

Reviewed: https://reviews.mahara.org/8306
Committed: https://git.mahara.org/mahara/mahara/commit/e7191aad045a594e2c3bd83a496accce1a0e7ea3
Submitter: Cecilia Vela Gurovic (<email address hidden>)
Branch: master

commit e7191aad045a594e2c3bd83a496accce1a0e7ea3
Author: Robert Lyon <email address hidden>
Date: Fri Nov 24 08:45:37 2017 +1300

Bug 1734194: Infinite loop site crash if usr = 0 saved in usr_session

The USER object will have id = 0 when a user is logged out

It should never end up in the usr_session table. This patch stops that
from happening and also ignores usr = 0 insession table with setting
up auth as well.

behatnotneeded

Change-Id: I0ba7afe0d21ae822daf8895af943f41048ba82b7
Signed-off-by: Robert Lyon <email address hidden>

[Mahara Bot (dev-mahara)]

Patch for "17.10_STABLE" branch: https://reviews.mahara.org/8315

[Mahara Bot (dev-mahara)]

Patch for "17.04_STABLE" branch: https://reviews.mahara.org/8316

[Mahara Bot (dev-mahara)]

Patch for "16.10_STABLE" branch: https://reviews.mahara.org/8317

[Mahara Bot (dev-mahara)]

Reviewed: https://reviews.mahara.org/8315
Committed: https://git.mahara.org/mahara/mahara/commit/5b891a21ce76eadceffae60b35ab8d41351122f5
Submitter: Robert Lyon (<email address hidden>)
Branch: 17.10_STABLE

commit 5b891a21ce76eadceffae60b35ab8d41351122f5
Author: Robert Lyon <email address hidden>
Date: Fri Nov 24 08:45:37 2017 +1300

Bug 1734194: Infinite loop site crash if usr = 0 saved in usr_session

The USER object will have id = 0 when a user is logged out

It should never end up in the usr_session table. This patch stops that
from happening and also ignores usr = 0 insession table with setting
up auth as well.

behatnotneeded

Change-Id: I0ba7afe0d21ae822daf8895af943f41048ba82b7
Signed-off-by: Robert Lyon <email address hidden>
(cherry picked from commit e7191aad045a594e2c3bd83a496accce1a0e7ea3)

[Mahara Bot (dev-mahara)]

Reviewed: https://reviews.mahara.org/8316
Committed: https://git.mahara.org/mahara/mahara/commit/756332e941b80146728b4c8b183d9cca74053d99
Submitter: Robert Lyon (<email address hidden>)
Branch: 17.04_STABLE

commit 756332e941b80146728b4c8b183d9cca74053d99
Author: Robert Lyon <email address hidden>
Date: Fri Nov 24 08:45:37 2017 +1300

Bug 1734194: Infinite loop site crash if usr = 0 saved in usr_session

The USER object will have id = 0 when a user is logged out

It should never end up in the usr_session table. This patch stops that
from happening and also ignores usr = 0 insession table with setting
up auth as well.

behatnotneeded

Change-Id: I0ba7afe0d21ae822daf8895af943f41048ba82b7
Signed-off-by: Robert Lyon <email address hidden>
(cherry picked from commit e7191aad045a594e2c3bd83a496accce1a0e7ea3)

[Mahara Bot (dev-mahara)]

Reviewed: https://reviews.mahara.org/8317
Committed: https://git.mahara.org/mahara/mahara/commit/128c3e765c2e6161b2ca3b2e9904b3f1e2f6d9a3
Submitter: Robert Lyon (<email address hidden>)
Branch: 16.10_STABLE

commit 128c3e765c2e6161b2ca3b2e9904b3f1e2f6d9a3
Author: Robert Lyon <email address hidden>
Date: Fri Nov 24 08:45:37 2017 +1300

Bug 1734194: Infinite loop site crash if usr = 0 saved in usr_session

The USER object will have id = 0 when a user is logged out

It should never end up in the usr_session table. This patch stops that
from happening and also ignores usr = 0 insession table with setting
up auth as well.

behatnotneeded

Change-Id: I0ba7afe0d21ae822daf8895af943f41048ba82b7
Signed-off-by: Robert Lyon <email address hidden>
(cherry picked from commit e7191aad045a594e2c3bd83a496accce1a0e7ea3)