-
Notifications
You must be signed in to change notification settings - Fork 9.4k
Closed
Labels
Area: SecurityComponent: SecurityIssue: ready for confirmationPriority: P1Once P0 defects have been fixed, a defect having this priority is the next candidate for fixing.Once P0 defects have been fixed, a defect having this priority is the next candidate for fixing.Progress: doneReported on 2.4.3-p1Indicates original Magento version for the Issue report.Indicates original Magento version for the Issue report.Severity: S1Affects critical data or functionality and forces users to employ a workaround.Affects critical data or functionality and forces users to employ a workaround.
Description
Description
When the admin session storage is empty, a PHP Fatal TypeError occurs:
PHP Fatal error: Uncaught TypeError: strtotime() expects parameter 1 to be string, null given in .../vendor/magento/module-security/Model/AdminSessionInfo.php:136
Stack trace:
#0 .../vendor/magento/module-security/Model/AdminSessionInfo.php(136): strtotime(NULL)
#1 .../vendor/magento/module-security/Model/AdminSessionInfo.php(119): Magento\Security\Model\AdminSessionInfo->isSessionExpired()
#2 .../vendor/magento/module-security/Model/AdminSessionInfo.php(108): Magento\Security\Model\AdminSessionInfo->checkActivity()
#3 .../vendor/magento/module-security/Model/Plugin/AuthSession.php(63): Magento\Security\Model\AdminSessionInfo->isLoggedInStatus()
#4 .../vendor/magento in .../vendor/magento/module-security/Model/AdminSessionInfo.php on line 136
Please note that line numbers might be different in the current version, the problem however still exists.
Since
Introduced with MC-34197:
67fae82
Specific:
$sessionUser = $this->getUser(); |
Suggested Fix
Return true
if the session is blank:
https://github.com/magento/magento2/blob/2.4-develop/app/code/Magento/Security/Model/AdminSessionInfo.php#L130
public function isSessionExpired()
{
$lifetime = $this->securityConfig->getAdminSessionLifetime();
$currentTime = $this->dateTime->gmtTimestamp();
$lastUpdatedTime = $this->getUpdatedAt();
if (empty($lastUpdatedTime)) {
return true;
}
if (!is_numeric($lastUpdatedTime)) {
$lastUpdatedTime = strtotime($lastUpdatedTime);
}
return $lastUpdatedTime <= ($currentTime - $lifetime) ? true : false;
}
rofokken, JelleGe, OliverCouch, YachYaroslav, sminmlc and 5 more
Metadata
Metadata
Assignees
Labels
Area: SecurityComponent: SecurityIssue: ready for confirmationPriority: P1Once P0 defects have been fixed, a defect having this priority is the next candidate for fixing.Once P0 defects have been fixed, a defect having this priority is the next candidate for fixing.Progress: doneReported on 2.4.3-p1Indicates original Magento version for the Issue report.Indicates original Magento version for the Issue report.Severity: S1Affects critical data or functionality and forces users to employ a workaround.Affects critical data or functionality and forces users to employ a workaround.
Type
Projects
Status
Done