Fix redirection and fix "session" values into $_SESSION see #2035

main/inc/global.inc.php

@@ -56,7 +56,6 @@ if (!isset($GLOBALS['_configuration'])) {
 }
 
 // Include the main Chamilo platform library file.
-
 require_once $_configuration['root_sys'].'main/inc/lib/api.lib.php';
 $passwordEncryption = api_get_configuration_value('password_encryption');
 

main/inc/local.inc.php

@@ -184,6 +184,8 @@ if (empty($cidReset)) {
     if ($courseCodeFromSession != $cidReq) {
         $cidReset = true;
     }
+} else {
+    $cidReq = null;
 }
 
 $gidReset = isset($gidReset) ? $gidReset : '';
@@ -920,13 +922,29 @@ if (!isset($_SESSION['login_as'])) {
 
 $sessionIdFromGet = isset($_GET['id_session']) ? (int) $_GET['id_session'] : 0;
 // if a session id has been given in url, we store the session if course was set:
-if (!empty($sessionIdFromGet) && !empty($cidReq)) {
-    $sessionIdFromSession = api_get_session_id();
-    $checkFromDatabase = false;
-    // User change from session id
-    if ($sessionIdFromGet != $sessionIdFromSession) {
+$sessionIdFromSession = api_get_session_id();
+$checkFromDatabase = false;
+// User change from session id
+if (!empty($sessionIdFromGet) && $sessionIdFromGet != $sessionIdFromSession) {
+    $cidReset = true;
+    $checkFromDatabase = true;
+    Session::erase('session_name');
+    Session::erase('id_session');
+
+    // Deleting session from $_SESSION means also deleting $_SESSION['_course'] and group info
+    Session::erase('_real_cid');
+    Session::erase('_cid');
+    Session::erase('_course');
+    Session::erase('_gid');
+}
+
+if ($checkFromDatabase && !empty($sessionIdFromGet)) {
+    $sessionInfo = api_get_session_info($sessionIdFromGet);
+    if (!empty($sessionInfo)) {
+        Session::write('session_name', $sessionInfo['name']);
+        Session::write('id_session', $sessionInfo['id']);
+    } else {
         $cidReset = true;
-        $checkFromDatabase = true;
         Session::erase('session_name');
         Session::erase('id_session');
 
@@ -935,36 +953,8 @@ if (!empty($sessionIdFromGet) && !empty($cidReq)) {
         Session::erase('_cid');
         Session::erase('_course');
         Session::erase('_gid');
+        api_not_allowed(true);
     }
-
-    if ($checkFromDatabase) {
-        $sessionInfo = api_get_session_info($_GET['id_session']);
-        if (!empty($sessionInfo)) {
-            Session::write('session_name', $sessionInfo['name']);
-            Session::write('id_session', $sessionInfo['id']);
-        } else {
-            $cidReset = true;
-            Session::erase('session_name');
-            Session::erase('id_session');
-
-            // Deleting session from $_SESSION means also deleting $_SESSION['_course'] and group info
-            Session::erase('_real_cid');
-            Session::erase('_cid');
-            Session::erase('_course');
-            Session::erase('_gid');
-            api_not_allowed(true);
-        }
-    }
-} else {
-    $cidReset = true;
-    Session::erase('session_name');
-    Session::erase('id_session');
-
-    // Deleting session from $_SESSION means also deleting $_SESSION['_course'] and group info
-    Session::erase('_real_cid');
-    Session::erase('_cid');
-    Session::erase('_course');
-    Session::erase('_gid');
 }
 
 /*  COURSE INIT */
@@ -1009,6 +999,8 @@ if ($cidReset) {
         Session::erase('_cid');
         Session::erase('_real_cid');
         Session::erase('_course');
+        Session::erase('session_name');
+        Session::erase('id_session');
 
         if (!empty($_SESSION)) {
             foreach ($_SESSION as $key => $session_item) {
@@ -1544,7 +1536,6 @@ Event::eventCourseLoginUpdate(
 );
 Redirect::session_request_uri($logging_in, $user_id);
 
-
 if (!ChamiloApi::isAjaxRequest() && api_get_configuration_value('allow_mandatory_survey')) {
     SurveyManager::protectByMandatory();
 }