Openbravo Issue Tracking System - Openbravo ERP
View Issue Details
IDProjectCategoryView StatusDate SubmittedLast Update
0004020Openbravo ERPC. Securitypublic2008-06-17 16:322009-10-13 00:12
Reporterjordimas 
Assigned Toiciordia 
PrioritynormalSeverityminorReproducibilityhave not tried
StatusclosedResolutionno change required 
PlatformOS20OS VersionUbuntu 7.1
Product Versionpi 
Target VersionFixed in Version 
Merge Request Status
Review Assigned To
OBNetwork customer
Web browser
ModulesCore
Support ticket
Regression level
Regression date
Regression introduced in release
Regression introduced by commit
Triggers an Emergency PackNo
Summary0004020: AD_SESSION grows and logout.html does not exists
DescriptionHello,

I assume that the original idea behind AD_SESSION was to keep a list of the valid sessions. However, the entries are added but never removed.

The "close session" button references to an HTML called /security/Logout.html that seems do not exist.

Jordi,
Steps To Reproduce
Proposed Solution
Additional Information
TagsToBeReviewed
Relationships
Attached Files
Issue History
Date ModifiedUsernameFieldChange
2008-06-17 16:32jordimasNew Issue
2008-06-17 16:32jordimasAssigned To => cromero
2008-06-17 16:32jordimassf_bug_id0 => 1996177
2008-06-17 16:33jpabloaeIssue Monitored: jpabloae
2008-06-17 16:49jordimasIssue Monitored: jordimas
2008-06-18 14:58cromeroNote Added: 0007834
2008-06-23 18:30cromeroAssigned Tocromero => alostale
2008-06-23 18:30cromeroTypedefect => feature request
2008-06-23 20:22roklenardicNote Added: 0007966
2008-11-16 07:43pjuvaraAssigned Toalostale => pjuvara
2008-11-16 12:06pjuvaraTag Attached: ToBeReviewed
2009-05-22 19:36pjuvaraAssigned Topjuvara => iciordia
2009-10-13 00:11iciordiaStatusnew => closed
2009-10-13 00:11iciordiaNote Added: 0020945
2009-10-13 00:12iciordiaResolutionopen => no change required

Notes
(0007834)
cromero   
2008-06-18 14:58   
The security/Logout.html is just a mapping used in Tomcat to redirect to the class org.openbravo.erpCommon.security.Logout, so it does not mind if the Logout.html exists or not.

You can view this in the web.xml file in the WEB-INF folder in Tomcat/webbapps/yourcontext.
(0007966)
roklenardic   
2008-06-23 20:22   
The AD_SESSION was not designed to keep track of live sessions. That's something Tomcat does internally.

AD_SESSION is right now used to keep a log of people who logged in (and where they logged in from - the IP) and if they logged out (PROCESSED = Y).

Good feature for security purposes.
(0020945)
iciordia   
2009-10-13 00:11   
Currently this issue makes no sense