[TYPO3-dev] Problem with RSAAuth extension

[Zachary Davis]

Helmut,

I don't want to get stuck in an argument about the correct place to make 
the fix and then not get this problem fixed. So, I will go ahead and 
push a patch to gerrit that modifies RSAauth to check for the session ID 
(rather than checking if $_SESSION is an array). This will mean that 
RSAauth will start the session and overwrite the time tracking value 
that was set by index_ts.php when a BE user is logged in. Can you live 
with this as a fix (and, I hope, give it your +1 if the patch is 
acceptable)? Surely this is a better solution than leaving the default 
frontend login broken in 4.6, given that many clients/users will indeed 
login on the front-end while also logged into the backend.

Zach


Helmut Hummel wrote:
> Hi,
>
> On 20.10.11 15:31, Zachary Davis wrote:
>>>
>>> So we accept this breaking change and the preformance problems instead
>>> of fixing the session check properly in rsaauth? [1]
>>
>> Even if we check properly in rsaauth, we still have a problem. The real
>> problem isn't rsaauth.
>
> The problem that you cannot login into the backend with rsaauth enabled
> is the *wrong* check in rsaauth. Fixing the check, allows to log in again.
>
>> The real problem is that index_ts.php writes data
>> to $_SESSION without having called session_start. If session_start gets
>> called later, that data (which, as I mentioned, may not even matter)
>> gets lost.
>
> The real problem is, that index_ts.php writes to $_SESSION for selecting
> a dummy timetrack object over a real one. This dummy object has been
> introduced for performance reasons.
>
> So we accept a major performance impact to save some bits after it? This
> sounds very wrong to me.
>
>
> Kind regards,
> Helmut
>