In-Portal Issue Tracker

Index: kernel/db/db_event_handler.php
===================================================================
--- kernel/db/db_event_handler.php	(revision 12883)
+++ kernel/db/db_event_handler.php	(working copy)
@@ -536,6 +536,7 @@
 					$redirect_template = $this->Application->isAdmin ? 'no_permission' : $this->Application->ConfigValue('NoPermissionTemplate');
 
 					$redirect_params = $this->Application->HttpQuery->getRedirectParams(true);
+					$redirect_params['no_amp'] = 1;
 					$next_template = $this->Application->HREF('', '', $redirect_params);
 
 					$redirect_params = Array (
Index: kernel/processors/main_processor.php
===================================================================
--- kernel/processors/main_processor.php	(revision 12883)
+++ kernel/processors/main_processor.php	(working copy)
@@ -768,16 +768,26 @@
 
 		if ((!$this->Application->LoggedIn() || !$group_access) && $condition) {
 			$redirect_params = $this->Application->HttpQuery->getRedirectParams(true);
+			$redirect_params['no_amp'] = 1;
 
 			if (array_key_exists('pass_category', $params)) {
 				$redirect_params['pass_category'] = $params['pass_category'];
 			}
 
+			if (array_key_exists('expired', $redirect_params)) {
+				$session_expired = $redirect_params['expired'];
+				unset($redirect_params['expired']);
+			}
+
 			$redirect_params = Array (
 				'm_cat_id' => 0,
 				'next_template' => urlencode('external:' . $this->Application->HREF($t, '', $redirect_params)),
 			);
 
+			if (isset($session_expired) && $session_expired) {
+				$redirect_params['expired'] = $session_expired;
+			}
+
 			if ( $this->Application->LoggedIn() && !$group_access) {
 				$this->Application->Redirect($params['no_group_perm_template'], $redirect_params);
 			}
Index: kernel/session/session.php
===================================================================
--- kernel/session/session.php	(revision 12883)
+++ kernel/session/session.php	(working copy)
@@ -171,7 +171,7 @@
 		$query = ' DELETE FROM '.$this->SessionDataTable.' WHERE '.$this->IDField.' = '.$this->Conn->qstr($session->SID);
 		$this->Conn->Query($query);
 
-		$this->OriginalData = Array();
+		$this->DirectVars = $this->ChangedDirectVars = $this->OriginalData = Array();
 	}
 
 	function UpdateSession(&$session, $timeout=0)
@@ -503,6 +503,12 @@
 	 */
 	var $OptionalData = Array ();
 
+	/**
+	 * Session expiration mark
+	 *
+	 * @var bool
+	 */
+	var $expired = false;
 
 	function Session($mode = smAUTO)
 	{
@@ -595,10 +601,9 @@
 			return ;
 		}
 
-		$expired_sids = $this->DeleteExpired();
-		$my_sid_expired = in_array($this->CachedSID, $expired_sids);
+		$this->DeleteExpired();
 
-		if ( ($expired_sids && $my_sid_expired) || ($this->CachedSID && !$this->_fromGet && !$this->SessionSet) ) {
+		if ($this->expired || ($this->CachedSID && !$this->_fromGet && !$this->SessionSet)) {
 			$this->RemoveSessionCookie();
 			// true was here to force new session creation, but I (kostja) used
 			// RemoveCookie a line above, to avoid redirect loop with expired sid
@@ -608,6 +613,7 @@
 
 			// case #1: I've OR other site visitor expired my session
 			// case #2: I have no session in database, but SID is present
+			$this->expired = false;
 			$expire_event = new kEvent('u:OnSessionExpire');
 			$this->Application->HandleEvent($expire_event);
 		}
@@ -689,6 +695,13 @@
 	 */
 	function SetCookie($name, $value, $expires = null)
 	{
+		if (isset($expires) && $expires < adodb_mktime()) {
+			unset($this->Application->HttpQuery->Cookie[$name]);
+		}
+		else {
+			$this->Application->HttpQuery->Cookie[$name] = $value;
+		}
+
 		setcookie($name, $value, $expires, $this->CookiePath, $this->CookieDomain, $this->CookieSecure);
 	}
 
@@ -718,8 +731,13 @@
 
 			// If session has expired
 			if ($this->Expiration < adodb_mktime()) {
+				// when expired session is loaded, then SID is
+				// not assigned, but used in Destroy method
+				$this->SID = $sid;
 				$this->Destroy();
 
+				$this->expired = true;
+
 				// when Destory methods calls SetSession inside and new session get created
 				return $this->SessionSet;
 			}
@@ -729,6 +747,10 @@
 		}
 		else {
 			// fake or deleted due to expiration SID
+			if (!$this->_fromGet) {
+				$this->expired = true;
+			}
+
 			return false;
 		}
 	}
Index: units/helpers/permissions_helper.php
===================================================================
--- units/helpers/permissions_helper.php	(revision 12883)
+++ units/helpers/permissions_helper.php	(working copy)
@@ -266,6 +266,7 @@
 			if (!$perm_status) {
 				$t = $this->Application->GetVar('t');
 				$redirect_params = $this->Application->HttpQuery->getRedirectParams(true);
+				$redirect_params['no_amp'] = 1;
 				$next_template = $this->Application->HREF($t, '', $redirect_params);
 
 				$event->SetRedirectParam('m_cat_id', 0); // category means nothing on admin login screen