If the overlay is turned on, then even if you "uncheck" enforce while on an admin page, the page behind the overlay is stil triggering the timeout dialogue.

One possible solution (which is also a feature request of mine) is to refresh the timout timer on every mousemove, click, keypress or scroll. This is a drastic change from the current behavior and may or may not be desirable. If it IS desirable, the attached patch is a start. It resets the timer, but for some reason that I have yet to understand an ajax call is made on every refresh in order to change the timeout setting in the users' $_SESSION. However, the $_SESSION is only used for users without Javascript which means this ajax call is unnecessary. If there is a different reason for the ajax call in the refresh function, then the attached patch is not a god solution because it will cause gazillions of ajax calls every time a user moves his or her mouse.

Thoughts?

Comments

dandrews’s picture

dandrews commented

Working from memory here I believe the ajax call to set $_session is done to set the last access time to the current time. Again from memory, I believe that the code will check to see if the last access was further in the past then the timeout allows and will log the user out. This is done as a graceful fail safe to a user not having JS, however I believe if the variable is not set with that ajax call whether or not they have JS they will be logged out. I could be wrong but I will look into it.

As far as looking at the patch there doesn't seem to be one attached. :/

Having a mouse click, scroll or keypress reset the timer shouldn't be very difficult. It might be something that can be implemented in a version of autologout however I'm not ready to go and make that kind of drastic change just yet. It might be an idea for a currently unavailable (via main page) dev branch 7.x-5.x. The current direction of that being features from both 7.x-2 and 7.x-4. With a button in a block that displays the timer in the 7.x-2 braches, which resets the timeout and timer upon clicking. The only issue I see with doing a reset on mouse movement, click, scrolls, keypress, is it would need to constantly change the timer in the block and it would be almost pointless having the block there.

johnennew’s picture

johnennew commented
Status: Active » Fixed

I've checked and I believe this is now fixed by the latest round of updates to the 7.x-4.x branch. With enforce on admin pages unchecked, a refresh ajax is sent to the server every half of the timeout period which is more often than the ajax from the page behind. This will keep the login alive and not popup the logout.

Feel free to reopen if you think it isn't fixed!

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.

Anonymous’s picture

(not verified) commented
Issue summary: View changes

Updated issue summary.