From 0757441874231f31ed1e39925c63e629ed2d7fa1 Mon Sep 17 00:00:00 2001
From: Mark Johnson <mark.johnson@catalyst-eu.net>
Date: Tue, 28 Nov 2023 16:20:45 +0000
Subject: [PATCH] MDL-80281 session: Don't report long session locks for
 readonly sessions

Previously, $CFG->sessionlockdebug was reporting long session locks for
all requests, even if they defined READ_ONLY_SESSION. This change
ensures that only sessions with locks are reported.
---
 lib/classes/session/manager.php | 26 +++++++++++++++-----------
 1 file changed, 15 insertions(+), 11 deletions(-)

diff --git a/lib/classes/session/manager.php b/lib/classes/session/manager.php
index e370597eb69..433273889c5 100644
--- a/lib/classes/session/manager.php
+++ b/lib/classes/session/manager.php
@@ -162,9 +162,11 @@ class manager {
                 throw new \core\session\exception(get_string('servererror'));
             }
 
-            // Grab the time when session lock starts.
-            $PERF->sessionlock['gained'] = microtime(true);
-            $PERF->sessionlock['wait'] = $PERF->sessionlock['gained'] - $PERF->sessionlock['start'];
+            if ($requireslock) {
+                // Grab the time when session lock starts.
+                $PERF->sessionlock['gained'] = microtime(true);
+                $PERF->sessionlock['wait'] = $PERF->sessionlock['gained'] - $PERF->sessionlock['start'];
+            }
             self::initialise_user_session($isnewsession);
             self::$sessionactive = true; // Set here, so the session can be cleared if the security check fails.
             self::check_security();
@@ -689,14 +691,17 @@ class manager {
         global $PERF, $ME, $CFG;
 
         if (self::$sessionactive) {
-            // Grab the time when session lock is released.
-            $PERF->sessionlock['released'] = microtime(true);
-            if (!empty($PERF->sessionlock['gained'])) {
-                $PERF->sessionlock['held'] = $PERF->sessionlock['released'] - $PERF->sessionlock['gained'];
+            $requireslock = self::$handler->requires_write_lock();
+            if ($requireslock) {
+                // Grab the time when session lock is released.
+                $PERF->sessionlock['released'] = microtime(true);
+                if (!empty($PERF->sessionlock['gained'])) {
+                    $PERF->sessionlock['held'] = $PERF->sessionlock['released'] - $PERF->sessionlock['gained'];
+                }
+                $PERF->sessionlock['url'] = me();
+                self::update_recent_session_locks($PERF->sessionlock);
+                self::sessionlock_debugging();
             }
-            $PERF->sessionlock['url'] = me();
-            self::update_recent_session_locks($PERF->sessionlock);
-            self::sessionlock_debugging();
 
             // If debugging, take a snapshot of session at close and compare on shutdown to detect any accidental mutations.
             if (debugging()) {
@@ -704,7 +709,6 @@ class manager {
                 \core_shutdown_manager::register_function('\core\session\manager::check_mutated_closed_session');
             }
 
-            $requireslock = self::$handler->requires_write_lock();
             if (!$requireslock || !self::$requireslockdebug) {
                 // Compare the array of the earlier session data with the array now, if
                 // there is a difference then a lock is required.