[TYPO3-dev] Problem with RSAAuth extension

[Zach Davis]

I'm not sure how to proceed. We can't really have it both ways, where 
index_ts.php is setting $_SESSION without having started it first. And, 
if we don't get this fixed, front-end logins are going to have a 
significant bug out-of-the-box in 4.6.

We can do any one of the following to address this:

1. Start a session in index_ts.php if there's a back-end cookie present 
since TYPO3 is writing to $_SESSION anyway in that case. It's certainly 
not correct to write to $_SESSION without starting it anyway, right? The 
downside here is that people who have embedded applications that call 
session_start might have problems when a there's a backend user cookie 
in the user's browser.

2. Stop tracking this time tracking stuff in $_SESSION. I'm not even 
sure what the time tracking code in index_ts.php is used for, but I'm 
pretty sure this condition:

if (!$_SESSION['TYPO3-TT-start'] && 
$_COOKIE[t3lib_beUserAuth::getCookieName()])

..will always be true if there's a backend user logged in, since the 
session is never started.

3. Modify the RSAAuth extension so that instead of checking whether 
$_SESSION is an array, it calls session_id() to see if the session has 
been setup or not. However, if we leave index_ts.php unchanged, then 
this fix will mean that RSAAuth extension will overwrite the time 
tracking data that index_ts.php writes to $_SESSION.

I'd love to get feedback from others on which fix makes the most sense, 
especially people who worked on http://forge.typo3.org/issues/29274 
(Regression on session handling for security fix). Or, if anyone has 
insight on how the time tracking code is supposed to work, that might be 
helpful too.

Zach



Steffen Gebert wrote:
> Hi,
>
>> I really think an easy fix for the problem is to call session_start() in
>> index_ts.php.
>
> Please be aware of that:
> http://forge.typo3.org/issues/29274
>
> I don't know the exact details, so unsure, if you just want to
> reintroduce that problem.
>
> Kind regards
> Steffen
>