Random Session Logouts

[s0undt3ch]

With latest stable, 0.3.1, I randomly get logged out.

This patch made it work again:

--- /usr/share/roundcube/program/include/session.inc.bak        2009-12-08 01:30:53.000000000 +0000
+++ /usr/share/roundcube/program/include/session.inc    2009-12-08 01:35:13.000000000 +0000
@@ -75,6 +75,11 @@
     foreach ((array)$GLOBALS['rcube_session_unsets'] as $k)
       unset($a_oldvars[$k]);

+    if ( !is_array($a_oldvars) ) {
+        write_log('errors', '\$a_oldvars is no longer an array! Recreating array. It was previously:' . $a_oldvars);
+        $a_oldvars = array();
+    }
+
     $DB->query(
       "UPDATE " . get_table_name('session') . "
        SET    vars=?, changed= " . $now . "

[alec]

Works for me. What PHP and DB versions are you using?

[s0undt3ch]

PHP 5.2.11-2ubuntu1 with Suhosin-Patch 0.9.7 (cli) (built: Nov 30 2009 20:32:41) with Postgres.

[rolek]

I'm experiencing the same problems. I've applied the patch to see if that fixes it for me as well.
We're using PHP 5.2.11, with mysql.

I've noticed that these PHP warnings coincide with the session loss:

PHP Warning: Cannot modify header information - headers already sent in roundcube/program/include/rcmail.php on line 1066
and
PHP Warning: Cannot modify header information - headers already sent in roundcube/program/include/rcube_json_output.php on line 220

I tried to set the log level to E_ALL, but that gives so many notices I'm not going to look at them, sorry.

[rolek]

Replying to rolek:

I'm experiencing the same problems. I've applied the patch to see if that fixes it for me as

Sadly, it doesn't. It might be a different problem of course.

[trisk]

Also experiencing a similar problem with PHP 5.2.11 and SQLite 2. This happened twice in a row (re)composing the same message when the autosave kicked in. I will test the patch.

[beni]

Same Problem here, the patch fixes that for me. I get the error message introduced by the patch in my log file. I will not get logged out anymore.

I got the problem when trying to send an mail with an attachment.

[alec]

@s0undt3ch: Are you using suhosin's session encryption? You must disable it.

[s0undt3ch]

Replying to alec:

@s0undt3ch: Are you using suhosin's session encryption? You must disable it.

Well, not on purpose, ie, only if it's the default on an ubuntu system.

How can I find out?

[trisk]

The patch has no effect on the random logouts here, and never prints a warning.

[s0undt3ch]

Replying to alec:

@s0undt3ch: Are you using suhosin's session encryption? You must disable it.

I just noticed, I do have suhosin's session built into my distro's php, how can I disable it?

[lafcadio]

This bug really sucks. In 0.2.1 I often don't see new mails so reverting to that version is no option.

Applying the above patch needed me to take a look into the sources: Außen hui, innen prozedural... (sorry, this is impossible to translate to english).

[lafcadio]

Replying to lafcadio:

This bug really sucks. In 0.2.1 I often don't see new mails so reverting to that version is no option.

I reverted now to 0.2.2 and switched off message caching. This works fine.

[alec]

Probably fixed in [929a508d].