Remember Me module resets $_SESSION on every page load, breaking other modules

I've just found a variation on what I believe is the same root cause as this issue. My site, www.folkjam.org, maintains $_SESSION variables that keep track of where the user is currently looking for content (we use that to only display content within a radius around the user's location).

When a user logs into the site without the 'remember me' checkbox set, none of the session variables we set survive across page loads - they all get set to their default values.

I think the culprit is in remember_me_init(), where the logic flow causing this particular scenario is:

  // If we have user logged in, then we have session started.
  if ($user->uid) {
    // Get the cookie life time.
    $cookie_lifetime = ini_get('session.cookie_lifetime');
    if ($user->remember_me) {
      // If we have no cookie life time set already then set it.
      if (0 == $cookie_lifetime) {
        _remember_me_set_lifetime(2000000);
      }
    }
    else {
      // If we have cookie life time set already then unset it.
      if (0 != $cookie_lifetime) {
        _remember_me_set_lifetime(0);
      }
    }
  }

That call to _remember_me_set_lifetime(0) clears out anything set in $_SESSION by any other module. I'd be interested in understanding the intended logic flow from this as I'm certain it was done because of a specific case (or cases) that needed to be covered. Making my site work again was as easy as removing the _remember_me_set_lifetime(0) call and the if statement around it - but I want to know what else this might break and whether this is a complete solution before rolling you a patch.

Changing the title to reflect the broader issue - hope that's ok markdionne

Can you send me some of your modules that refuse to work with remember_me module?

2 markdionne:
Works for me in IE and Firefox on Drupal 5.1. Change gets lost only if I close and reopen browser.

What browsers you use?

Give me your phpinfo please.

@doq - My experiences are right in line with Mark's as far as 4.7 goes, where the problem happens all of the time. We are busy moving folkjam to D5 now and I don't have experience with remember_me for D5 yet.

You can get the behavior with any standard module that uses $_SESSION, such as enabling file uploads on a node type. As a test, modify your local copy of the remember_me module to stash a test value in $_SESSION, such as

$_SESSION['my_test_value'] = time();

and print it out as part of your page.tpl.php somewhere in the header so it is visible on each page. I've not done this particular test, but given the behavior that Mark and I have both seen, I suspect that this will reproduce the problem on Drupal 4.7.

Scott

Thanks Mark - the switch is under way now. I like that module's solution better than jacking with session lifetimes too.

As a module maintainer myself I know that at times life gets in the way of handling the issue queue - hopefully doq's schedule allows him/her to give remember me a little attention soon, or formally shut it down in favor of other modules.

Scott

Experiencing the same problem.
For me, it was causing this issue: http://drupal.org/node/155726

Agreed that the logic in this module could be better commented. No way to fix without understanding the reasoning behind it. Switching to persistent login module...

Kindly review and test this patch as a solution to this problem.

Duplicate issue: http://drupal.org/node/233046

Closing duplicate issue