Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix "logged out of admin" bug #48

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

fredden
Copy link

@fredden fredden commented Jun 18, 2020

In Plugin\PhpEnvironment\ResponsePlugin we use Model\PageInfo. In Model\PageInfo we use Magento\Framework\View\LayoutInterface.
Creating a Layout object which has a plugin (eg Plugin\View\LayoutPlugin) will pull in instances of UrlInterface and ResolverInterface through dependency injection. Both of these classes have preferences in the "adminhtml" area to classes that instanciate an admin session object. When this happens, a new admin session will be created if one does not already exist.

As the path to static resources does not match the path to the adminhtml frontend route, no cookie identifying the current/previous admin session is sent by the user agent. So, when the admin session object is initialised, no existing session is found; a new session is therefore created and sent to the user agent as part of this request. This replaces the existing admin session for the user, seemingly logging them out.

All of this logic only kicks in when a standard request object is used, such as when an exception is thrown. When the static resource application finds the file it is seeking, this follows a different code path than the exception handling referenced above.

To reproduce/test, please observe the headers sent on a request to /static/version1234567890/adminhtml/Magento/backend/en_GB/missing/file.js with this module enabled. In version 1.2.14 this will send an 'admin' cookie. With the suggested patch here, this is no longer the case (ie, now matches core Magento behaviour).

This has been tested on Magento v2.3.5-p1 only.

@frekvent-szabolcs
Copy link

I encountered an issue in version 2.4.6. When I enabled Devtools in the configuration and used the store switcher on the product edit page, it caused me to get logged out of the admin. However, when I disabled MSP Devtools, everything worked as intended. To resolve this problem, I copied the pull request to a new custom module, and that successfully fixed the issue.

@jellesiderius
Copy link

Any chance this can be released soon?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants