MOD Name: Remove Duplicate Sessions
Author: nurhendra
MOD Description: To remove duplicate/old sessions from the same user
MOD Version: 1.0.0
Download File: remove_dupe_sessions_1.0.0.mod
mods overview page: View
File Size: 2248 Bytes
Security Score: 0
[2.0.13] Remove Duplicate Sessions
-
Extensions Robot
- Extensions Robot
- Posts: 28022
- Joined: Sat Aug 16, 2003 7:36 am
[2.0.13] Remove Duplicate Sessions
Last edited by Extensions Robot on Mon Apr 30, 2007 12:29 am, edited 1 time in total.
(this is a non-active account manager for the phpBB Extension Customisations Team)
The story was..
A friend was using my PC to browse a phpbb forum. He didn't log out, but just continue doing something else.
Later, I kicked him out from my PC, so he have to use his notebook, which includes browsing the forum, etc.
After checking my emails, doing some google, etc, I went to that same forum and I see that my PC is already logged in as my friend. I see that if I was fast enough to enter the forum before the cookie/session expired, then I might be able to reuse someone else session.
So, I just want to make sure that it will not happen to me in my forum.
Modified the session login, so that when I logging in from a computer, my old, not-logged-out-yet sessions, will be automatically removed. This way, if I forgotten to log out from a PC, I can just log in somewhere else to force logging out my old sessions.
The downside is, you can't log in more than once from anywhere, including multiple browsers within one PC.
Of course, this forced log out will not work if the 'Automatic Log on' feature was used. If this feature is in use in multiple sessions (=multiple browsers or computers), then what will happen is all sessions will remove each other session data from the database, forcing to have only one line of session data for that user. While this will not disturb the browsing activity, it will be one SQL query heavier for each page viewed.
... end of story. (to be continued?)
A friend was using my PC to browse a phpbb forum. He didn't log out, but just continue doing something else.
Later, I kicked him out from my PC, so he have to use his notebook, which includes browsing the forum, etc.
After checking my emails, doing some google, etc, I went to that same forum and I see that my PC is already logged in as my friend. I see that if I was fast enough to enter the forum before the cookie/session expired, then I might be able to reuse someone else session.
So, I just want to make sure that it will not happen to me in my forum.
Modified the session login, so that when I logging in from a computer, my old, not-logged-out-yet sessions, will be automatically removed. This way, if I forgotten to log out from a PC, I can just log in somewhere else to force logging out my old sessions.
The downside is, you can't log in more than once from anywhere, including multiple browsers within one PC.
Of course, this forced log out will not work if the 'Automatic Log on' feature was used. If this feature is in use in multiple sessions (=multiple browsers or computers), then what will happen is all sessions will remove each other session data from the database, forcing to have only one line of session data for that user. While this will not disturb the browsing activity, it will be one SQL query heavier for each page viewed.
... end of story. (to be continued?)
-
Shanana
- Registered User
- Posts: 368
- Joined: Sat Aug 28, 2004 4:03 am
- Location: USA [from London, England]
Ok, I have a question about this before I do anything:
I have a section on my site that is for members only & I'm using PHPBB's sessions. I've been having a problem where users are able to click Back & still be logged in.
Will this mod make it so that they are taken to the index page I have created [not PHPBB's index]?
I have a section on my site that is for members only & I'm using PHPBB's sessions. I've been having a problem where users are able to click Back & still be logged in.
Will this mod make it so that they are taken to the index page I have created [not PHPBB's index]?
I apologize for not replying sooner. I thought I was watching the thread, but no notification coming. 
Anyway...
Shanana:
This mod will remove old/duplicate session from the user, only if that user is logging in. This mod is not for doing session expire or session log-out, because phpBB is already doing that.
Probably your user is using their browser's cache to click back etc, but if they are logged out (their session removed) then they can't do anything else. To avoid this, maybe you can put a 'pragma no cache' thingy on your page so that users will not be able to see their old cache for your page.
As for setting the index page to non-default phpbb forum index, it should be already available in the mod database or in the forum.
PghIndys:
I tried to duplicate your error message but can't. I installed a fresh 2.0.17 (no mod) and applied this mod, and everything works as advertised.
Basically, my mod will remove all session for that user, when the user is trying to create a new session. Thus, all old sessions will be removed, then the original phpBB code will create the session.
The sql are doing as follow:
1. delete all session for this user [this is what my mod doing]
2. update the session for this user [this is phpbb original code]
3. if cannot update, then create new session [this is phpbb original code]
My mod is not changing anything else. It is a run-and-that's-it code, which means after the end of my mod it will not be seen again. As you can see, I am only using the $sql variable to do the query, which then will be overwritten by the next query.
Also, there is a more descriptive error message in place, if something is wrong with my mod: "Error in removing duplicate sessions".
So, my guess is maybe you haven't put my mod fully (something changed), or your problem was coming from someone else's mod.
You can try to remove my mod (it's not crucial, so it will not break phpbb) and see if the problem persist. If so, then double check if the mod entered is complete.
Thank's!
Anyway...
Shanana:
This mod will remove old/duplicate session from the user, only if that user is logging in. This mod is not for doing session expire or session log-out, because phpBB is already doing that.
Probably your user is using their browser's cache to click back etc, but if they are logged out (their session removed) then they can't do anything else. To avoid this, maybe you can put a 'pragma no cache' thingy on your page so that users will not be able to see their old cache for your page.
As for setting the index page to non-default phpbb forum index, it should be already available in the mod database or in the forum.
PghIndys:
I tried to duplicate your error message but can't. I installed a fresh 2.0.17 (no mod) and applied this mod, and everything works as advertised.
Basically, my mod will remove all session for that user, when the user is trying to create a new session. Thus, all old sessions will be removed, then the original phpBB code will create the session.
The sql are doing as follow:
1. delete all session for this user [this is what my mod doing]
2. update the session for this user [this is phpbb original code]
3. if cannot update, then create new session [this is phpbb original code]
My mod is not changing anything else. It is a run-and-that's-it code, which means after the end of my mod it will not be seen again. As you can see, I am only using the $sql variable to do the query, which then will be overwritten by the next query.
Also, there is a more descriptive error message in place, if something is wrong with my mod: "Error in removing duplicate sessions".
So, my guess is maybe you haven't put my mod fully (something changed), or your problem was coming from someone else's mod.
You can try to remove my mod (it's not crucial, so it will not break phpbb) and see if the problem persist. If so, then double check if the mod entered is complete.
Thank's!
I believe it has something to do with the pcp mod.
do you have any provisions for that mod? or is there a way to allow it to see 2 sessions during registration, it seems like that is what pcp does.
thanks
** I got it to work, I just added the user email activation, that way it wasnt logging on and trying to submit info on the same session id. works great thanks **
do you have any provisions for that mod? or is there a way to allow it to see 2 sessions during registration, it seems like that is what pcp does.
thanks
** I got it to work, I just added the user email activation, that way it wasnt logging on and trying to submit info on the same session id. works great
thanks **
Last edited by PghIndys on Fri Aug 19, 2005 10:07 pm, edited 1 time in total.
-
badboy4ever
- Registered User
- Posts: 177
- Joined: Sat Jun 11, 2005 2:38 pm
- Location: UK
-
diabolic.bg
- Registered User
- Posts: 447
- Joined: Mon Dec 11, 2006 3:41 pm
- Location: Bulgaria, Sofia
- Contact:
-
Hannibal_King
- Registered User
- Posts: 436
- Joined: Mon Apr 03, 2006 6:24 am
- Location: SLOVAKIA
- Contact:
-
diabolic.bg
- Registered User
- Posts: 447
- Joined: Mon Dec 11, 2006 3:41 pm
- Location: Bulgaria, Sofia
- Contact:
