[TYPO3-dev] Problem with RSAAuth extension

[Zach Davis]

We ran into a problem with the RSA Auth extension today, and spent a 
little bit of time debugging it. I'd like to get some feedback on a fix 
before submitting a patch to Gerrit.

Problem: with a fresh installation of the 4.6RC1 introduction package, 
it isn't possible to login to the front-end while logged into the backend.

This seems to happen because if there is backend login cookie, then the 
typo3/sysext/cms/index_ts.php file sets $_SESSION['TYPO3-TT-start'] 
early in its execution (around line133). It does this, however, without 
calling session_start() first, so the $_SESSION superglobal is never 
properly initialized.

When the RSA authentication service instantiates the 
tx_rsauth_split_storage, there is a simple check in the constructor to 
see if $_SESSION is an array and only calls session_start if $_SESSION 
is not set or not an array. Because it's always set to an array in 
index.php_ts when there is a BE cookie, the session is never properly 
initialized.

It seems to me that the easiest way to fix this would be to call 
session_start() in index.php_ts before setting anything in $_SESSION, 
and I'm happy to submit a patch to this effect.

As it stands, it seems to me that without this patch, front-end logins 
won't work while there's a back-end session if RSAAuth is enabled, which 
I believe it is by default in 4.7, right? Has anyone else seen similar 
behavior?

Zach