DeveloperWil

Hi @codexpert

I have just run a code diff on 2.1.1 and 2.1.2 and the only difference I can see is that you are setting the remember parameter for wp cookies to true.

This is not addressing the larger issue of the PHP sessions that you create in the /includes/Schedule/Schedule.php __construct() method.

Nowhere in the code do you use session_destroy() to delete these php sessions which are running in each Apache child thread.

Here is my amended code which seems to help the issue – notice I check to see if there are any scheduled URLs still to run and if not I destroy the created PHP session.

<?php
/**
 * All trigger facing functions
 */

namespace codexpert\Share_Logins;

/**
 * if accessed directly, exit.
 */
if ( ! defined( 'ABSPATH' ) ) {
    exit;
}

/**
 * @package Plugin
 * @subpackage Schedule
 * @author Nazmul Ahsan <n.mukto@gmail.com>
 */
class Schedule extends Hooks {

    /**
     * Constructor function
     */
    public function __construct( $plugin ) {
        $this->name     = $plugin['Name'];
        $this->ncrypt   = ncrypt();
        if ( session_status() == PHP_SESSION_NONE ) {
            session_start();
        }
    }

    public function run() {
        $_scheduled_urls = cx_get_scheduled_urls();
        if( is_array( $_scheduled_urls ) && count( $_scheduled_urls ) > 0 ) :

		foreach ( $_scheduled_urls as $url ) {
			echo "<script src='{$url}'></script>";

            if( defined( 'CXSL_DEBUG' ) && CXSL_DEBUG ) {
                @parse_str( $url );
                cx_add_log( 'trigger', 'outgoing', $this->ncrypt->decrypt( $user_login ), cx_get_route_home( $url ) );
            }
		}

        cx_clean_scheduled_urls();
        endif;
        // ZPD 21/10/2019 - destroy session if scheduled URLs are empty
        if( empty( cx_get_scheduled_urls() ) ) {
            session_destroy();
        }
    }
}

Can you please pass this feedback to the developers and ask them to properly destroy PHP sessions that they are creating. It is causing a huge memory and php issue on my client’s server.

The issue is critical to the point where we are now being forced to consider alternaitve SSO plugins.

I’m happy to work with your devs in resolving this issue. You can find me at https://github.com/DeveloperWil

Regards,
Wil.

Yes, the issue has come back on my site again last week. Disabled plugin temporarily.

The homepage for https://wealthwithpurpose.com/ displays the JS error in Chrome for me

Thanks for your answer @paultgoodchild

Regards,
Wil.

Yes, detection of JS miners on a site I manage – alluding to possible malware

Thanks for the update @wfyann

Is there any documentation for what signature format to use and where to find them?

Thanks,
Wil.

Ok – possibly not a bug but a paid feature?

Is the post excerpt only available on the Pro version?

If so, perhaps reword Excerpt to Limit Post Content – very confusing.