Problem/Motivation

An application I maintain has certain roles that should not be expired. I have set the "Seconds of inactivity before expiring" configuration to "0", which according to this text from the README should disable the user expire functionality on this role:

> Each role can be set to a different expiration time with 0 set for roles that will not be expired.

However, users with this role were then sent the warning email.

Steps to reproduce

  1. Enable user_expire module
  2. Ensure there are some accounts that have a last access timestamp greater than 1 day ago.
  3. Set authenticated role "Seconds of inactivity before expiring" configuration to "0"
  4. Set "Warning offset time in seconds" to a small value such as 60
  5. Set "Send account expiration warning emails" to true.
  6. Save configuration form
  7. Run cron until user_expire_cron() is called

Warning emails will be sent to any user that has hasn't accessed the site in 60 seconds. However, they will not be blocked.

Proposed resolution

The issue is on this line when calling user_expire_find_users_to_expire_by_role() it passes in a $seconds_since_login parameter which is the timeout MINUS the offset.

So in the case of authenticated timeout = 0, and offset = 60, the value passed to this function is -60. This then breaks the assumption in the first bit of that function

  if (empty($seconds_since_login)) {
    return NULL;
  }

The proposed fix is to add extra logic in user_expire_expire_by_role_warning() to explicitly skip a role if the timeout is set to 0, before it attempts to find accounts that would be affected.

Remaining tasks

N/A

User interface changes

N/A

API changes

N/A

Data model changes

N/A

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

Comments

nicksanta created an issue. See original summary.

nicksanta’s picture

Issue summary: View changes

kolin made their first commit to this issue’s fork.

kolin’s picture

Status: Active » Needs review

I filtered out all falsy values in user_expire_get_role_rules()

These aren't used anywhere so can be safely removed.

trackleft2 made their first commit to this issue’s fork.

trackleft2’s picture

Status: Needs review » Reviewed & tested by the community

Thank you both for this report and merge request, I like the simplicity of the array_filter approach.

I've gone ahead and added some PHPUnit tests to hopefully prevent this issue from coming back once it is fixed.

joegraduate’s picture

Version: 2.1.0 » 2.x-dev

  • joegraduate committed 4630cd1a on 2.x authored by kolin
    Issue #3503243 by kolin, trackleft2, nicksanta: Roles with "Seconds of...
joegraduate’s picture

Status: Reviewed & tested by the community » Fixed

Merged. Thanks all!

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.