{"action":"created","issue":{"url":"https://api.github.com/repos/joomla/joomla-cms/issues/19585","repository_url":"https://api.github.com/repos/joomla/joomla-cms","labels_url":"https://api.github.com/repos/joomla/joomla-cms/issues/19585/labels{/name}","comments_url":"https://api.github.com/repos/joomla/joomla-cms/issues/19585/comments","events_url":"https://api.github.com/repos/joomla/joomla-cms/issues/19585/events","html_url":"https://github.com/joomla/joomla-cms/issues/19585","id":294852098,"number":19585,"title":"Session don't close since 3.8.4 update","user":{"login":"aegaudin","id":33878704,"avatar_url":"https://avatars3.githubusercontent.com/u/33878704?v=4","gravatar_id":"","url":"https://api.github.com/users/aegaudin","html_url":"https://github.com/aegaudin","followers_url":"https://api.github.com/users/aegaudin/followers","following_url":"https://api.github.com/users/aegaudin/following{/other_user}","gists_url":"https://api.github.com/users/aegaudin/gists{/gist_id}","starred_url":"https://api.github.com/users/aegaudin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/aegaudin/subscriptions","organizations_url":"https://api.github.com/users/aegaudin/orgs","repos_url":"https://api.github.com/users/aegaudin/repos","events_url":"https://api.github.com/users/aegaudin/events{/privacy}","received_events_url":"https://api.github.com/users/aegaudin/received_events","type":"User","site_admin":false},"labels":[{"id":138443932,"url":"https://api.github.com/repos/joomla/joomla-cms/labels/No%20Code%20Attached%20Yet","name":"No Code Attached Yet","color":"ededed","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":32,"created_at":"2018-02-06T17:46:36Z","updated_at":"2018-02-14T15:42:55Z","closed_at":null,"author_association":"NONE","body":"Since 3.8.4 update, Joomla sessions don't close : dozen of connected users are wrongly shown on frontend Community Builder Online module, and also shown backend admin panel in the last 5 connected users module.\r\n\r\n- Up-to-date (3.8.4 -> 3.8.5) joomla with up-to-date Community Builder working fine\r\n- sessions time set to 15 minutes - I tried to change it to a shorter time but it doesn't disconnect users even when their last activity is registred two days ago or more\r\n- remember me plugin set to off (unpublished) since years"},"comment":{"url":"https://api.github.com/repos/joomla/joomla-cms/issues/comments/365646971","html_url":"https://github.com/joomla/joomla-cms/issues/19585#issuecomment-365646971","issue_url":"https://api.github.com/repos/joomla/joomla-cms/issues/19585","id":365646971,"user":{"login":"stAn47","id":3664914,"avatar_url":"https://avatars3.githubusercontent.com/u/3664914?v=4","gravatar_id":"","url":"https://api.github.com/users/stAn47","html_url":"https://github.com/stAn47","followers_url":"https://api.github.com/users/stAn47/followers","following_url":"https://api.github.com/users/stAn47/following{/other_user}","gists_url":"https://api.github.com/users/stAn47/gists{/gist_id}","starred_url":"https://api.github.com/users/stAn47/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/stAn47/subscriptions","organizations_url":"https://api.github.com/users/stAn47/orgs","repos_url":"https://api.github.com/users/stAn47/repos","events_url":"https://api.github.com/users/stAn47/events{/privacy}","received_events_url":"https://api.github.com/users/stAn47/received_events","type":"User","site_admin":false},"created_at":"2018-02-14T15:42:55Z","updated_at":"2018-02-14T15:42:55Z","author_association":"NONE","body":"hello, this is another very important change which was hardly documented before the patch release.\r\n\r\nwe take care of all PHP file sessions by using custom CRON jobs and we do not expect Joomla do to anything about it since in Joomla, this is called \"none\" and it's not called xcache/apc/file or else... It is just \"none\" which means that session storage + medium encryption + SHM or directory access + any garbage or session cleaning is hanled by server administrators and not by the application. \r\n\r\nSince joomla implements \"custom\" (user) session handler called \"database\" everybody would expect that it takes care of the session storage + encryption + serialization/deserialization + cleaning by itself. \r\n\r\nthere are PHP variables for \"cookie path\" and \"cookie domain\" and nobody expects them to be set by the server, but rather by the application itself (Joomla)\r\n\r\nso what is the proper config (joomla or server) now for enviroments where \"gcprobability\" is set to zero (i.e. custom cleaning) and there are sites both using file and database session that share the same php.ini ? (i.e. 2 sites per inside a customer enviroment)\r\n\r\nSession GC CLI is not really a solution since most hostings do not provide a secured CLI access to PHP and for an hosting company it would mean to locate all Joomla installations and execute such CLI file. \r\n\r\nGC in the database could be also done: \r\n- by executing php after closing connection to webserver (for example by using fastcgi_finish_request for FPM, FastCGI, etc... together with ignore_user_abort)\r\n- by using multiple connections to the database with http://php.net/manual/en/mysqli.poll.php\r\n- same as before (Joomla should take care of the session cleaing upon a probability ratio not from php.ini)\r\n\r\n"}}
{"actor":{"display_login":"stAn47"}}