search

Sterc / FormIt

A dynamic form processing Snippet for MODX Revolution
https://docs.modx.com/current/en/extras/formit
33 stars 58 forks source link

FormIt plugin with `anonymous_sessions` inactive, causes manager login to fail #235

Open blibio opened 4 years ago

blibio commented 4 years ago

Bug report

Summary

With anonymous_sessions deactivated, and having FormIt installed, the manager login is no longer possible.

Steps to reproduce

Deactivate anonymous_sessions, clear cache, logout of manager.

Observed behavior

Login is no longer possible.

Expected behavior

Login is should be possible.

Versions

FormIt 4.2.5-pl MODX 2.7.3-pl

After some debugging, I found that the call to $this->modx->hasPermission in the FormIt constructor (\Sterc\FormIt::__construct), ultimately causes \modX::$_sessionState to end up as modX::SESSION_STATE_EXTERNAL. Which in turn causes \modX::startSession to never call session_start().

The following error is logged:

(ERROR @ ****/core/model/modx/moduser.class.php : 367) PHP warning: session_regenerate_id(): Cannot regenerate session id - session is not active

The problem is solved if I:

martinf55 commented 4 years ago

Another solution: anonymous_sessions=0 should be set in the Context Settings for 'web' rather than in system settings. So it applies only for the front-end, while allowing the 'mgr' context login page to start the session and set the cookie required for login, regardless of which plugin events are firing.