-
Bug
-
Resolution: Fixed
-
Minor
-
4.3
Steps to reproduce:
- Set `$CFG->enable_read_only_sessions = true;` in config.php.
- Set `$CFG->debugsessionlock = 0.1;` in config.php. This will log a message for any session lock that is held for more than 100ms.
- Go to /admin/settings.php?section=manageantiviruses on your Moodle site. This page includes an AJAX request to the core_check_get_result_admintree external function, which has `readonlysession` set to true.
- Check the file that PHP error logs are written to. It will contain a message like " Debugging: Script /lib/ajax/service.php?sesskey=xxx&info=core_check_get_result_admintree locked the session for 0.458 seconds, it should close the session using \core\session\manager::write_close()". This is despite the fact that it never locked the session.
This is due to there being no check in core\session\manager::start_session() to check the $requireslock parameter before setting $PERF->sessionlock['gained'].