From cacf7546b9493b5ae6dffbe4fc21d4e6fbf3f8df Mon Sep 17 00:00:00 2001 From: meirzamoodle Date: Thu, 17 Oct 2024 17:40:04 +0700 Subject: [PATCH] MDL-61316 core: Removed 5x multiplier from guest session expiration --- lib/classes/session/handler.php | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/lib/classes/session/handler.php b/lib/classes/session/handler.php index 1736bd0c47f..8a033a7a18e 100644 --- a/lib/classes/session/handler.php +++ b/lib/classes/session/handler.php @@ -255,16 +255,17 @@ abstract class handler { \core_php_time_limit::raise(); if ($max_lifetime === 0) { - $max_lifetime = $CFG->sessiontimeout; + $max_lifetime = (int) $CFG->sessiontimeout; } try { - // Delete expired sessions for guest user account, give them larger timeout, there is no security risk here. - $purgebefore = di::get(clock::class)->time() - ($max_lifetime * 5); + // Calculate the timestamp before which sessions are considered expired. + $purgebefore = di::get(clock::class)->time() - $max_lifetime; + + // Delete expired sessions for guest user account. $this->destroy_expired_user_sessions($purgebefore, $CFG->siteguest); // Delete expired sessions for userid = 0 (not logged in), better kill them asap to release memory. - $purgebefore = di::get(clock::class)->time() - $max_lifetime; $this->destroy_expired_user_sessions($purgebefore, 0); // Clean up expired sessions for real users only.