From 34f58ae20d9a85f2a1508a9a732874239491d456 Mon Sep 17 00:00:00 2001

From: Hank Ibell <hwibell@apache.org>

Date: Tue, 15 Jan 2019 19:54:41 +0000

Subject: [PATCH] mod_session: Always decode session attributes early.

Backport r1850947 from trunk

Submitted by: hwibell

Reviewed by: hwibell, covener, wrowe

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1851409 13f79535-47bb-0310-9956-ffa450edef68

---

diff --git a/modules/session/mod_session.c b/modules/session/mod_session.c

index d517020d995..64e6e4a8132 100644

--- a/modules/session/mod_session.c

+++ b/modules/session/mod_session.c

@@ -126,20 +126,23 @@ static apr_status_t ap_session_load(request_rec * r, session_rec ** z)

     /* found a session that hasn't expired? */

     now = apr_time_now();

+

     if (zz) {

-        if (zz->expiry && zz->expiry < now) {

+        /* load the session attibutes */

+        rv = ap_run_session_decode(r, zz);

+ 

+        /* having a session we cannot decode is just as good as having

+           none at all */

+       if (OK != rv) {

+            ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(01817)

+                    "error while decoding the session, "

+                    "session not loaded: %s", r->uri);

             zz = NULL;

         }

-        else {

-            /* having a session we cannot decode is just as good as having

-               none at all */

-            rv = ap_run_session_decode(r, zz);

-            if (OK != rv) {

-                ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(01817)

-                              "error while decoding the session, "

-                              "session not loaded: %s", r->uri);

-                zz = NULL;

-            }

+

+       /* invalidate session if session is expired */

+        if (zz && zz->expiry && zz->expiry < now) {

+            zz = NULL;

         }

     }