sess_destroy_uid() implementation only deletes latest session

+1

The attached patch fixes this by looking up the memcache session by first retrieving the user object from memcache. It then uses this object to destroy the session. Please test.

Whoops -- the previous patch had a typo. This one should work. Please test.

There was a code path where the session id wasn't saved in the user object, causing the sess_destroy_uid() to fail. The attached patch is updated to fix this. It works in all my testing.

Committed.

Link to the commit for reference:
http://drupal.org/cvs?commit=237454

Only one user session (probably latest) gets deleted.

 function sess_destroy_uid($uid) {
+  $user = dmemcache_get($uid, 'users');
+  if (is_object($user) && isset($user->sid)) {
+    dmemcache_delete($user->sid, 'session');
+  }
+  dmemcache_delete($uid, 'users');
 }

This could be fixed by storing an array of session IDs in the user object.

This is related to #791888: sess_destroy_sid() does not remove the session cookie from the user's browser.

This still needs to be fixed for situations where a user has multiple browsers, each with a different session.

Patch for anyone else who still uses Drupal 5.

Modified to prevent accumulation of dead sessions in the user object.

#12 looks reasonable, I applied it on production site

function filter_user($op, &$edit, &$account, $category = NULL) {
  if ($op == 'update') {
    // Invalidate cached user object.
    cache_clear_all($account->uid, 'users');
  }
}

function sess_destroy_uid($uid) {
  $user = dmemcache_get($uid, 'users');
  if (is_object($user) && !empty($user->sids)) {
    foreach ($user->sids as $sid) {
      dmemcache_delete($sid, 'session');
    }
  }
  dmemcache_delete($uid, 'users');
}

As far as I can see if someone updates user's status or password then function filter_user() in memcache-session.inc is called before sess_destroy_uid(). See the user_save() in user.module:

function user_save($account, $array = array(), $category = 'account') {
    // ...

    user_module_invoke('update', $array, $account, $category);

    // ...

    // Delete a blocked user's sessions to kick them if they are online.
    if (isset($array['status']) && $array['status'] == 0) {
      sess_destroy_uid($account->uid);
    }

    // If the password changed, delete all open sessions and recreate
    // the current one.
    if (!empty($array['pass'])) {
      sess_destroy_uid($account->uid);
      if ($account->uid == $GLOBALS['user']->uid) {
        drupal_session_regenerate();
      }
    }
    // ...
}

Therefore when function dmemcache_get($uid, 'users') is called in sess_destroy_uid() it can't get $user object ($user == false). Therefore dmemcache_delete($sid, 'session') is not called at all and all session information stay in the session bin.

If I comment out line cache_clear_all($account->uid, 'users') in filter_user() then patch works as expected.

I changed $op in filter_user() from 'update' to 'after_update'. It solves the problem. Here is the new patch.