search

CCALI / CALI-Author-Viewer-5

This is the repo for CALI Author's jQuery based lesson viewer
1 stars 1 forks source link

We never close $_SESSION so it can seriously mess with scores if multiple viewer instances are open and a viewer window gets refreshed #139

Closed emasters closed 3 years ago

emasters commented 3 years ago

With each Lesson run a $_SESSION arrays get created by PHP. That data gets read into the Viewer and is used to save scores (at least). The $_SESSION array stays in the PHP session for some time until it is replaced by the next run of a Lesson.

Data stored in $_SESSION is array(4) { ["runid"]=> string(8) "11812358" ["resume"]=> int(1) ["runtype"]=> string(10) "LessonLink" ["runnid"]=> string(3) "561" }

For example if a student opens 3 Lessons in tabs A, B, and C then starts working all 3. Scores are saved as expected using 3 different runids. The active $_SESSION array holds data used in tab C. Everything is fine until the student hits a rough spot in tab A and decides to refresh the browser window clicking through the warning. The refresh of the Viewer in tab A loads the $_SESSION array that was created for the Lesson run in tab C. Student carries on with the Lesson in tab A and the viewer performs a score save operation. At this point the summary and results data for the Lesson runs in tabs A and C is compromised and effectively lost because the Lesson in tab A thinks it's the Lesson in tab C and overwrites the data at the runid created for C.

We have long suspected that things could go very wrong if multiple tabs are open and now I know what that is. This needs a fix.

NB: I'm using 3 tabs for illustrative purposes. It could happen with any number of tabs greater than 1.

emasters commented 3 years ago

Since the Viewer only needs $_SESSION at start up, resetting $_SESSION to a blank array once Viewer is launched should eliminate the problem. @sgoshorn where's the best place to clear $_SESSION?

emasters commented 3 years ago

$_SESSION occurs in 3 files besides authorizestudent.php https://github.com/CCALI/CALI-Author-Viewer-5/search?q=%24_SESSION @sgoshorn what is the last one to be called? We can use unset ($_SESSION['runid']); at some point to unset the $_SESSION array once the Viewer has all of the data it needs.