Support D7.98 Session ID hashing

Created on 22 June 2023, over 1 year ago
Updated 23 June 2023, over 1 year ago

Problem/Motivation

Not sure if anyone is actively using this module, but there was a major change in Drupal 7.98 that impacts APDQC. As released on June 7, 2023, all session IDs are now hashed in the database by default. See these links for more information:

https://www.drupal.org/node/3364841 β†’
https://www.drupal.org/node/2164025 β†’

If a site was upgraded to D7.98 while APDQC is enabled and $conf['do_not_hash_session_ids'] = TRUE; was not set in settings.php, the site would no longer support user sessions. The situation could be resolved by adding do_not_hash_session_ids to settings.php, but all site users would need to log in again after the D7.98 update has been run.

Steps to reproduce

This can be reproduced by upgrading a site with APDQC to use Drupal 7.98, and using default settings.

Proposed resolution

To match the core patch, it is necessary to make updates to the following functions to incorporate the new drupal_session_id function:

_drupal_session_read
_drupal_session_write
drupal_session_regenerate
drupal_session_destroy

Changes also need to be made to README to notify users of the new settings conf option, and in the module tests.

Remaining tasks

Please review the attached patch and provide feedback. Thanks.

πŸ› Bug report
Status

Needs review

Version

1.0

Component

Code

Created by

πŸ‡ΊπŸ‡ΈUnited States ron_s

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

Production build 0.71.5 2024