From 8bb06c04ba9f094ba72d6a906d5df921da64647d Mon Sep 17 00:00:00 2001
From: Go MAEDA <maeda@farend.jp>
Date: Sat, 22 Jan 2022 04:04:05 +0000
Subject: [PATCH] Update session token only once per minute (#29041).
MIME-Version: 1.0
Content-Type: text/plain; charset=utf8
Content-Transfer-Encoding: 8bit

Patch by Pavel Rosický.


git-svn-id: http://svn.redmine.org/redmine/trunk@21376 e93f8b46-1217-0410-a6f0-8f06a7374b81
---
 app/models/user.rb                          |  9 ++++++++-
 test/functional/sessions_controller_test.rb | 13 +++++++++++++
 2 files changed, 21 insertions(+), 1 deletion(-)

diff --git a/app/models/user.rb b/app/models/user.rb
index 25530541e..8c190374f 100644
--- a/app/models/user.rb
+++ b/app/models/user.rb
@@ -469,7 +469,14 @@ class User < Principal
     if Setting.session_timeout?
       scope = scope.where("updated_on > ?", Setting.session_timeout.to_i.minutes.ago)
     end
-    scope.update_all(:updated_on => Time.now) == 1
+    last_updated = scope.maximum(:updated_on)
+    if last_updated.nil?
+      false
+    elsif last_updated <= 1.minute.ago
+      scope.update_all(:updated_on => Time.now) == 1
+    else
+      true
+    end
   end
 
   # Return an array of project ids for which the user has explicitly turned mail notifications on
diff --git a/test/functional/sessions_controller_test.rb b/test/functional/sessions_controller_test.rb
index bc9d1d99a..8640c1ee4 100644
--- a/test/functional/sessions_controller_test.rb
+++ b/test/functional/sessions_controller_test.rb
@@ -45,6 +45,19 @@ class SessionsControllerTest < Redmine::ControllerTest
     assert token.updated_on > created
   end
 
+  def test_session_token_should_be_updated_only_once_per_minute
+    token = Token.create!(:user_id => 2, :action => 'session', :created_on => 1.second.ago, :updated_on => 1.second.ago)
+    updated = token.reload.updated_on
+
+    get :index, :session => {
+      :user_id => 2,
+      :tk => token.value
+    }
+    assert_response :success
+    token.reload
+    assert_equal updated.to_i, token.updated_on.to_i
+  end
+
   def test_user_session_should_not_be_reset_if_lifetime_and_timeout_disabled
     created = 2.years.ago
     token = Token.create!(:user_id => 2, :action => 'session', :created_on => created, :updated_on => created)
-- 
2.39.5