- fix: expired and unremoved session breaks the work

src/includes/class.sessionhandler.php

@@ -42,8 +42,12 @@ class MTTSessionHandler implements SessionHandlerInterface
         // read session data if not expired
         $time = time();
         $expire = $time;
-        $r = $this->db->sq("SELECT data,last_access FROM {$this->db->prefix}sessions WHERE id = ? AND expires >= $expire", [$id]);
+        $r = $this->db->sq("SELECT data,last_access,expires FROM {$this->db->prefix}sessions WHERE id = ?", [$id]);
         if ( is_null($r) ) return '';
+        if ( (int)$r[2] < $time) {
+            // maybe regenerate id?
+            $r[0] = '';
+        }
 
         // update last access time and set expires in 14 days
         // refresh once in a second

src/init.php

@@ -194,6 +194,13 @@ function setup_and_start_session()
     ini_set('session.use_cookies', true);
     ini_set('session.use_only_cookies', true);
 
+    /*
+        After any request we may have 14 days of inactivity (i.e. not requesting session data),
+        then we have to re-login (look at MTTSessionHandler).
+        Activity without re-login lasts for max 60 days, the cookie lifetime, then cookie dies
+        and we have to re-login having new session id.
+    */
+
     $lifetime = 5184000; # 60 days session cookie lifetime
     $path = url_dir(Config::get('url')=='' ? getRequestUri() : Config::getUrl('url'));
     $samesite = 'lax';