View Issue Detail

ID	Project	Category	Submitted / Last Updated
00855	UserSpice	ACP Code	2020-04-13 10:11:55 / 2021-03-01 02:38:50
Reported	Dan Hoover	Assigned To	Unassigned
Priority	normal	Reported	5.0.09
Status	closed	Resolution Version and Commit
Summary	Session killing bug on UserSpice 4.4 password reset
Description	<p>Guys ! Why do you try deleting sessions when there is no session, its just user trying to reset his password ? Version: 4.4 from github issue: undefined vars ($user->data()->id and $_SESSION['kUserSessionID']) Reproduce error: Try password reset in the login page->open link in email->reset pass success but you get undefined vars. Workaround: Comment us_helper.php (passwordResetKillSessions() function )-> Change lines: // if(is_null($uid)) $q = $db->query("UPDATE us_user_sessions SET UserSessionEnded=1,UserSessionEnded_Time=NOW() WHERE fkUserID = ? AND UserSessionEnded=0 AND kUserSessionID <> ?",[$user->data()->id,$_SESSION['kUserSessionID']]); // else $q = $db->query("UPDATE us_user_sessions SET UserSessionEnded=1,UserSessionEnded_Time=NOW() WHERE fkUserID = ? AND UserSessionEnded=0",[$uid]); to: if (!is_null($uid)) $q = $db->query("UPDATE us_user_sessions SET UserSessionEnded=1,UserSessionEnded_Time=NOW() WHERE fkUserID = ? AND UserSessionEnded=0", [$uid]); and Comment this line if (is_null($uid)) { // if ($count == 1) logger($user->data()->id, "User Tracker", "Killed 1 Session via Password Reset.");</p>

November 2021

Formatted <a href="https://pastebin.com/gkmecR2Z">https://pastebin.com/gkmecR2Z</a>
November 2021

Session Manager was pulled and no more reports of any issues.