Bug #59614
closed
The property newSessionID is used in a wrong context in AbstractUserAuthentication
100%
Description
The fix for #57751 was to force the cookie to be set again although it was
deleted in the same request again (when an anonymous session was already present), but setting the internal property
->newSessionID to true (later in the request in ->setSessionCookie() it is checked whether a cookie needs to be set).
The fix introduced for #58713 tackled the issue that the cookie is unexpectedly deleted
when an anonymous session is present and a login attempt failed.
By fixing #58713 the issue in #57751 is also fixed, so we do not need to abuse the
->newSessionID to force the cookie to be set and can rely on this property only to be set
when actually a new session ID is generated.
Updated by Gerrit Code Review almost 10 years ago
- Status changed from New to Under Review
Patch set 5 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/30753
Updated by Helmut Hummel almost 10 years ago
- Status changed from Under Review to Resolved
- % Done changed from 0 to 100
Applied in changeset df11f015ffc7f6f8fe70bc2b14ef260032c8b61e.
Updated by