Skip to content

Commit 5eaf08e

Browse files
thiaramusthiaramus
committed
Merge branch 'MC-38309' of https://github.com/magento-mpi/magento2ce into TANGO-PR-10-21-2020-24
2 parents da6478c + b09239f commit 5eaf08e

File tree

5 files changed

+143
-21
lines changed

5 files changed

+143
-21
lines changed

‎app/code/Magento/Customer/Api/SessionCleanerInterface.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@
1313
interface SessionCleanerInterface
1414
{
1515
/**
16-
* Destroy all active customer sessions related to given customer id, including current session.
16+
* Destroy all active customer sessions related to given customer except current session.
1717
*
1818
* @param int $customerId
1919
* @return void

‎app/code/Magento/Customer/Controller/Account/EditPost.php

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,8 @@
3333
use Magento\Framework\Phrase;
3434

3535
/**
36-
* Class EditPost
36+
* Customer edit account information controller
37+
*
3738
* @SuppressWarnings(PHPMD.CouplingBetweenObjects)
3839
*/
3940
class EditPost extends AbstractAccount implements CsrfAwareActionInterface, HttpPostActionInterface
@@ -185,6 +186,7 @@ public function validateForCsrf(RequestInterface $request): ?bool
185186
* Change customer email or password action
186187
*
187188
* @return \Magento\Framework\Controller\Result\Redirect
189+
* @SuppressWarnings(PHPMD.CyclomaticComplexity)
188190
*/
189191
public function execute()
190192
{
@@ -217,6 +219,12 @@ public function execute()
217219
);
218220
$this->dispatchSuccessEvent($customerCandidateDataObject);
219221
$this->messageManager->addSuccessMessage(__('You saved the account information.'));
222+
// logout from current session if password changed.
223+
if ($isPasswordChanged) {
224+
$this->session->logout();
225+
$this->session->start();
226+
return $resultRedirect->setPath('customer/account/login');
227+
}
220228
return $resultRedirect->setPath('customer/account');
221229
} catch (InvalidEmailOrPasswordException $e) {
222230
$this->messageManager->addErrorMessage($this->escaper->escapeHtml($e->getMessage()));

‎app/code/Magento/Customer/Controller/Account/ResetPasswordPost.php

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -14,9 +14,7 @@
1414
use Magento\Customer\Model\Customer\CredentialsValidator;
1515

1616
/**
17-
* Class ResetPasswordPost
18-
*
19-
* @package Magento\Customer\Controller\Account
17+
* Customer reset password controller
2018
*/
2119
class ResetPasswordPost extends \Magento\Customer\Controller\AbstractAccount implements HttpPostActionInterface
2220
{
@@ -91,6 +89,11 @@ public function execute()
9189
$resetPasswordToken,
9290
$password
9391
);
92+
// logout from current session if password changed.
93+
if ($this->session->isLoggedIn()) {
94+
$this->session->logout();
95+
$this->session->start();
96+
}
9497
$this->session->unsRpToken();
9598
$this->messageManager->addSuccessMessage(__('You updated your password.'));
9699
$resultRedirect->setPath('*/*/login');

‎app/code/Magento/Customer/Model/Session/SessionCleaner.php

Lines changed: 2 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -71,13 +71,6 @@ public function __construct(
7171
*/
7272
public function clearFor(int $customerId): void
7373
{
74-
if ($this->sessionManager->isSessionExists()) {
75-
//delete old session and move data to the new session
76-
//use this instead of $this->sessionManager->regenerateId because last one doesn't delete old session
77-
// phpcs:ignore Magento2.Functions.DiscouragedFunction
78-
session_regenerate_id(true);
79-
}
80-
8174
$sessionLifetime = $this->scopeConfig->getValue(
8275
Config::XML_PATH_COOKIE_LIFETIME,
8376
ScopeInterface::SCOPE_STORE
@@ -89,6 +82,8 @@ public function clearFor(int $customerId): void
8982
$visitorCollection = $this->visitorCollectionFactory->create();
9083
$visitorCollection->addFieldToFilter('customer_id', $customerId);
9184
$visitorCollection->addFieldToFilter('last_visit_at', ['from' => $activeSessionsTime]);
85+
$visitorCollection->addFieldToFilter('session_id', ['neq' => $this->sessionManager->getSessionId()]);
86+
9287
/** @var \Magento\Customer\Model\Visitor $visitor */
9388
foreach ($visitorCollection->getItems() as $visitor) {
9489
$sessionId = $visitor->getSessionId();

‎dev/tests/integration/testsuite/Magento/Customer/Model/AccountManagementTest.php

Lines changed: 125 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@
1414
use Magento\Framework\Exception\State\ExpiredException;
1515
use Magento\Framework\Reflection\DataObjectProcessor;
1616
use Magento\Framework\Session\SessionManagerInterface;
17+
use Magento\Framework\Stdlib\DateTime;
1718
use Magento\Framework\Url as UrlBuilder;
1819
use Magento\Store\Model\StoreManagerInterface;
1920
use Magento\TestFramework\Helper\Bootstrap;
@@ -113,6 +114,10 @@ protected function tearDown(): void
113114
$customerRegistry->remove(1);
114115
$addressRegistry->remove(1);
115116
$addressRegistry->remove(2);
117+
/** @var \Magento\Customer\Model\ResourceModel\Visitor $resourceModel */
118+
$resourceModel = $this->objectManager->get(\Magento\Customer\Model\ResourceModel\Visitor::class);
119+
$resourceModel->getConnection()->delete($resourceModel->getMainTable());
120+
parent::tearDown();
116121
}
117122

118123
/**
@@ -158,19 +163,52 @@ public function testChangePassword()
158163
{
159164
/** @var SessionManagerInterface $session */
160165
$session = $this->objectManager->get(SessionManagerInterface::class);
161-
$oldSessionId = $session->getSessionId();
162-
$session->setTestData('test');
166+
$time = time();
167+
168+
$session->start();
169+
$guessSessionId = $session->getSessionId();
170+
$this->createVisitorSession($guessSessionId);
171+
$session->setTestData('guest_session_data');
172+
173+
// open new session
174+
$activeSessionId = uniqid("active-$time-");
175+
$this->startNewSession($activeSessionId);
176+
$this->createVisitorSession($activeSessionId, 1);
177+
$session->setTestData('customer_session_data_1');
178+
179+
// open new session
180+
$currentSessionId = uniqid("current-$time-");
181+
$this->startNewSession($currentSessionId);
182+
$this->createVisitorSession($currentSessionId, 1);
183+
$session->setTestData('customer_session_data_current');
184+
185+
// change password
163186
$this->accountManagement->changePassword('[email protected]', 'password', 'new_Password123');
164-
165-
$this->assertTrue(
166-
$oldSessionId !== $session->getSessionId(),
167-
'Customer session id wasn\'t regenerated after change password'
187+
$this->assertEquals(
188+
$currentSessionId,
189+
$session->getSessionId(),
190+
'Current session was renewed'
168191
);
169192

170-
$session->destroy();
171-
$session->setSessionId($oldSessionId);
193+
// open customer active session
194+
$this->startNewSession($activeSessionId);
195+
$this->assertNull($session->getTestData(), 'Customer active session data wasn\'t cleaned up');
196+
197+
// open customer current session
198+
$this->startNewSession($currentSessionId);
199+
$this->assertEquals(
200+
'customer_session_data_current',
201+
$session->getTestData(),
202+
'Customer current session data was cleaned up'
203+
);
172204

173-
$this->assertNull($session->getTestData(), 'Customer session data wasn\'t cleaned');
205+
// open guess session
206+
$this->startNewSession($guessSessionId);
207+
$this->assertEquals(
208+
'guest_session_data',
209+
$session->getTestData(),
210+
'Guest session data was cleaned up'
211+
);
174212

175213
$this->accountManagement->authenticate('[email protected]', 'new_Password123');
176214
}
@@ -392,11 +430,58 @@ public function testValidateResetPasswordLinkTokenAmbiguous()
392430
*/
393431
public function testResetPassword()
394432
{
433+
/** @var SessionManagerInterface $session */
434+
$session = $this->objectManager->get(SessionManagerInterface::class);
435+
$time = time();
436+
437+
$session->start();
438+
$guessSessionId = $session->getSessionId();
439+
$this->createVisitorSession($guessSessionId);
440+
$session->setTestData('guest_session_data');
441+
442+
// open new session
443+
$activeSessionId = uniqid("active-$time-");
444+
$this->startNewSession($activeSessionId);
445+
$this->createVisitorSession($activeSessionId, 1);
446+
$session->setTestData('customer_session_data_1');
447+
448+
// open new session
449+
$currentSessionId = uniqid("current-$time-");
450+
$this->startNewSession($currentSessionId);
451+
$this->createVisitorSession($currentSessionId, 1);
452+
$session->setTestData('customer_session_data_current');
453+
395454
$resetToken = 'lsdj579slkj5987slkj595lkj';
396455
$password = 'new_Password123';
397456

398457
$this->setResetPasswordData($resetToken, 'Y-m-d H:i:s');
399458
$this->assertTrue($this->accountManagement->resetPassword('[email protected]', $resetToken, $password));
459+
460+
$this->assertEquals(
461+
$currentSessionId,
462+
$session->getSessionId(),
463+
'Current session was renewed'
464+
);
465+
466+
// open customer active session
467+
$this->startNewSession($activeSessionId);
468+
$this->assertNull($session->getTestData(), 'Customer active session data wasn\'t cleaned up');
469+
470+
// open customer current session
471+
$this->startNewSession($currentSessionId);
472+
$this->assertEquals(
473+
'customer_session_data_current',
474+
$session->getTestData(),
475+
'Customer current session data was cleaned up'
476+
);
477+
478+
// open guess session
479+
$this->startNewSession($guessSessionId);
480+
$this->assertEquals(
481+
'guest_session_data',
482+
$session->getTestData(),
483+
'Guest session data was cleaned up'
484+
);
400485
}
401486

402487
/**
@@ -727,4 +812,35 @@ protected function setResetPasswordData(
727812
$customerModel->setRpTokenCreatedAt(date($date));
728813
$customerModel->save();
729814
}
815+
816+
/**
817+
* @param string $sessionId
818+
*/
819+
private function startNewSession(string $sessionId): void
820+
{
821+
/** @var SessionManagerInterface $session */
822+
$session = $this->objectManager->get(SessionManagerInterface::class);
823+
// close session and cleanup session variable
824+
$session->writeClose();
825+
$session->clearStorage();
826+
// open new session
827+
$session->setSessionId($sessionId);
828+
$session->start();
829+
}
830+
831+
/**
832+
* @param string $sessionId
833+
* @param int|null $customerId
834+
* @return Visitor
835+
*/
836+
private function createVisitorSession(string $sessionId, ?int $customerId = null): Visitor
837+
{
838+
/** @var Visitor $visitor */
839+
$visitor = Bootstrap::getObjectManager()->create(Visitor::class);
840+
$visitor->setCustomerId($customerId);
841+
$visitor->setSessionId($sessionId);
842+
$visitor->setLastVisitAt((new \DateTime())->format(DateTime::DATETIME_PHP_FORMAT));
843+
$visitor->save();
844+
return $visitor;
845+
}
730846
}

0 commit comments

Comments
 (0)