Session table

[paynter]

Hi all:

What does the session table do in the PKP Harvester database, and what does the Session Management class do?

I have read about this in the technical reference, but it doesn't answer my questions:

1. Does session information only get recorded for users who log in to the website, or for all users?

2. Can I turn it off? Our policy is to not maintain session information if we can at all help it.)

3. Why are people turning up at the site and getting errors like the one below?

Thanks,
Gordon


Error observed after logging in to our demo website (Solaris/Oracle environment):

Code: Select all

DB Error: ORA-12899: value too large for column
"DB_PKP"."SESSIONS"."IP_ADDRESS" (actual: 21, maximum: 15) Stack Trace:
File: /opt/u01/local/pkp/classes/session/SessionDAO.inc.php line 80
Function: sessiondao->update("INSERT INTO sessions (session_id,
ip_address, user_agent, c...", Array(8))

File: /opt/u01/local/pkp/classes/session/SessionManager.inc.php line 79
Function: sessiondao->insertsession(Object(session))

File: /opt/u01/local/pkp/classes/session/SessionManager.inc.php line 106
Function: sessionmanager->sessionmanager(Object(sessiondao))

File: /opt/u01/local/pkp/index.php line 39
Function: sessionmanager::getmanager()

File: /opt/u01/local/pkp/index.php line 58
Function: handlerequest()

[asmecher]

Hi Gordon,

I'm not sure what's causing that Oracle error message; it may be multiple IP addresses in the remote IP server variable, in which case, you can filter out all but the first using the patch at http://pkp.sfu.ca/cvs/cvsweb.cgi/harvester2/classes/core/Request.inc.php.diff?r1=1.18;r2=1.19. Otherwise, you'll need to turn on query logging in Oracle to determine what the problem query is.

The sessions table is a persistent implementation of PHP's session management; where PHP uses in-memory session storage, the Harvester uses a database table so that session data can be maintained across server restarts and potentially even distributed across multiple web servers. Not much of this is used by the Harvester itself, but it's part of the underlying platform that the PKP suite uses. It's possible to disable it by modifying the code, but I don't think it's worth the bother, as it's not recording anything more sensitive than an IP address, and it's only temporarily stored while the session is active anyway.

Regards,
Alec Smecher
Public Knowledge Project Team