fix(sessions): logout properly when user requests logout on password change

Signed-off-by: Akhil Narang <me@akhilnarang.dev>
This commit is contained in:
Akhil Narang 2024-08-27 17:58:20 +05:30
parent dcd14d07dc
commit 5570aa71be
No known key found for this signature in database
GPG key ID: 9DCC61E211BF645F

View file

@ -49,24 +49,26 @@ def clear_sessions(user=None, keep_current=False, force=False):
delete_session(sid, reason=reason)
def get_sessions_to_clear(user=None, keep_current=False):
def get_sessions_to_clear(user=None, keep_current=False, force=False):
"""Return sessions of the current user. Called at login / logout.
:param user: user name (default: current user)
:param keep_current: keep current session (default: false)
:param force: ignore simultaneous sessions count, log the user out of all except current (default: false)
"""
if not user:
user = frappe.session.user
offset = 0
if user == frappe.session.user:
if not force and user == frappe.session.user:
simultaneous_sessions = frappe.db.get_value("User", user, "simultaneous_sessions") or 1
offset = simultaneous_sessions
session = frappe.qb.DocType("Sessions")
session_id = frappe.qb.from_(session).where(session.user == user)
if keep_current:
offset = max(0, offset - 1)
if not force:
offset = max(0, offset - 1)
session_id = session_id.where(session.sid != frappe.session.sid)
query = (
@ -80,7 +82,7 @@ def delete_session(sid=None, user=None, reason="Session Expired"):
from frappe.core.doctype.activity_log.feed import logout_feed
if frappe.flags.read_only:
# This isn't manually initated logout, most likely user's cookies were expired in such case
# This isn't manually initiated logout, most likely user's cookies were expired in such case
# we should just ignore it till database is back up again.
return