SESSION Cookie set to anonymous users makes pages not cacheable by Boost or Varnish

Sessions are for textsize_check() and can be removed.

Thanks! Fixed.

Sorry for reopening this - I'm having the same problem with 7.12 and Varnish won't run. How would I stop the module from setting a cookie for anonymous users? Thanks much!

Do you use the current 7.x-1.x-dev version?

Thank you, Christian - I am now.

textsize and has_js cookie is being set (has_js wasn't set before) and the module also now fails to work - it just seems to reload the page without changing text size. (Edit: clicking on "increase" makes the text tiny, actually; other buttons will reset, but text size doesn't change.)

Varnish fails (although I'm not certain it's this module.)

With the failure of the .dev to work, I probably tried it at some point and then "rolled back" to 1.0, which I've just done again now. Thank you for your response!

Hi,

I'd love to have this functionality. drupal_page_is_cacheable() is returning FALSE because of this on all pages. I'd prefer not to use dev if at all possible: could you point me to a commit/issue/patch?

Thanks in advance,

Set:
- "Scripting languages " to "PHP + JavaScript + Optimized for performance." and
- "Display message after changing text size"

Thanks for the quick reply! That should work with 7.x-1.0?

As you can see the "version" of this issue is "7.x-1.x-dev".

Sorry, I wasn't clear in the original message. I'm hoping you can point me to a commit/patch that will give me the functionality without installing dev. Thanks.

This is an issue for D6 too. setcookie is being unconditionally called in hook_block().

Attached is a patch for D6 that makes the setting of the cooke lazy - it only gets set when an attempt to change the textsize is made.

Latest dev version fixes the caching issues.

However, with PHP+Javascript+Optimized setting, when the javascript runs it doesn't re-set the body class after reading the cookie. I think it relies on PHP to set it before the page load, but doesn't take into account that there might be a static html cache of the page.

Here's steps to reproduce: (Make sure you are browsing as Anonymous and have Boost or other caching which generates static html files for Anonymous users)
1. Clear your static HTML cache. Go to a page and reset textsize to default, then set text size to 120% or whatever value that will make you notice the difference. When you change textsize on this page, the cookie will be set.
2. Now go to a non-cached page. This time the cookie is read so notice the textsize is 120%, and body class is set to textsize-120. Now check if the cache of this page is generated.
3. Go to a different page, and reset the textsize back to default. The cookie should be changed now.
4. Go back to the page at step 2 and notice the textsize is still 120% due to it being cached with body class textsize-120

There's a simple fix I've managed to whip up:

in jquery.textsize.js file find (line 8 in dev version):

if ($.cookie("textsize")) {
  var tsCurrent = $.cookie("textsize");
}

Replace with:

if ($.cookie("textsize")) {
  var tsCurrent = $.cookie("textsize");
    
  // Remove cached body textsize class and add one
  // from the cookie
  textsize_remove_bc();
  $(textsizeElement + textsizeElementClass).addClass("textsize-"+tsCurrent);
}

Patch updated against Drupal 7. Also updated so that the cookie gets deleted once the size is back to normal.

Updated patch also adds a setting to control wether or not the session should be used to store textsize status for anonymous users.

Marked #1800512: Incompatible with Pressflow as a duplicate.

Missed a bit so sessions were still being set.

updating title so that more people can find this thread

According to one of the maintainers of the Boost module, this could be a security issue so I am switching this as a bug until proven wrong.
Here's the explanation I got :

Boost maintainers « can only work within the scope of Drupal's login mechanism and if someone wants to add a module to do something custom, then they should use a differing cookie so that anonymous users are not assigned a login id, otherwise basically boost cannot work and also it does somewhat break the strict Drupal separation between anonymous and authenticated users which may also be a security issue with assigned roles.

I would submit a bug report to the module authors, pointing the above out. » by Philip_Clarke

Original discussion can be found here : http://drupal.org/node/1807818

In the mean time, patch #19 worked great for me! Thanks a lot mrfelton.

Updated patch also switches to using hook_page_build to add the js, and drupal_add_library to add the jquery.cookie library, and sets every_page = TRUE for the js and css so that they can be aggregated better. I would have made these changes in a separate patch, but it would have to depend on this one so didn't seem worth it.

I update the patch. I added a condition on the delete cookie. If you set a cookie with other path the cookie continue with the same value when you change to other path. For delete do you need use the root path

Upon applying the patch from #24 to dev version, I get the following:

patching file textsize.module
patch unexpectedly ends in middle of line
Hunk #3 FAILED at 344.
1 out of 3 hunks FAILED -- saving rejects to file textsize.module.rej

Site then throws the following error:

Fatal error: Call to undefined function _textsize_set_session() in /home/icrmedia/public_html/[site]/sites/all/modules/textsize/textsize.module on line 109

Reversing the patch for now but will check back - thanks for diving into this!

@bcobin the function _textsize_set_session() have to be defined first.

Patch 25 (and 24) give me an javascript display error "NaN" on "Current Text Size"

Problem found: "textsize_set(tsCurrent);" on line 11 in the jquery.textsize.js file.

For the current dev version. Now it should be fixed.
Test it on the Demo Page.

Code is now in 7.x-1.1-rc1 release.