From 9d2ac941b77a7d35c3f71e92ecef6fc2ab8ab86d Mon Sep 17 00:00:00 2001
From: Laurent Destailleur <eldy@destailleur.fr>
Date: Wed, 25 Mar 2026 23:36:43 +0100
Subject: [PATCH] Restore feature to manage timeout (when garbage is done at
 page access)

---
 htdocs/admin/security_other.php        | 2 +-
 htdocs/core/lib/phpsessionindb.lib.php | 2 +-
 htdocs/core/lib/security2.lib.php      | 4 +---
 htdocs/main.inc.php                    | 2 +-
 4 files changed, 4 insertions(+), 6 deletions(-)

diff --git a/htdocs/admin/security_other.php b/htdocs/admin/security_other.php
index 64f8913c789..23da832b188 100644
--- a/htdocs/admin/security_other.php
+++ b/htdocs/admin/security_other.php
@@ -80,7 +80,7 @@ if (preg_match('/set_([a-z0-9_\-]+)/i', $action, $reg)) {
 		$res1 = dolibarr_set_const($db, "MAIN_APPLICATION_TITLE", GETPOST("MAIN_APPLICATION_TITLE", 'alphanohtml'), 'chaine', 0, '', $conf->entity);
 	}
 	if (GETPOSTISSET('MAIN_SESSION_TIMEOUT')) {
-		$res2 = dolibarr_set_const($db, "MAIN_SESSION_TIMEOUT", GETPOST("MAIN_SESSION_TIMEOUT", 'alphanohtml'), 'chaine', 0, '', $conf->entity);
+		$res2 = dolibarr_set_const($db, "MAIN_SESSION_TIMEOUT", max(120, min(3600 * 24, GETPOSTINT("MAIN_SESSION_TIMEOUT"))), 'chaine', 0, '', $conf->entity);	// Between 120 and 86400
 	}
 	if (GETPOSTISSET('MAIN_SECURITY_MAX_IMG_IN_HTML_CONTENT')) {
 		$res3 = dolibarr_set_const($db, "MAIN_SECURITY_MAX_IMG_IN_HTML_CONTENT", GETPOST("MAIN_SECURITY_MAX_IMG_IN_HTML_CONTENT", 'alphanohtml'), 'int', 0, '', $conf->entity);
diff --git a/htdocs/core/lib/phpsessionindb.lib.php b/htdocs/core/lib/phpsessionindb.lib.php
index be685b8310b..9cc5a9e52fa 100644
--- a/htdocs/core/lib/phpsessionindb.lib.php
+++ b/htdocs/core/lib/phpsessionindb.lib.php
@@ -133,7 +133,7 @@ function dolSessionWrite($sess_id, $val)
 		if (empty($sessionidfound)) {
 			if ((int) ini_get('session.gc_probability') == 0) {
 				// dolSessionGC will be never called
-				$max_lifetime = max(getDolGlobalInt('MAIN_SESSION_TIMEOUT'), (int) ini_get('session.gc_maxlifetime'));
+				$max_lifetime = min(3600 * 24, max(getDolGlobalInt('MAIN_SESSION_TIMEOUT'), (int) ini_get('session.gc_maxlifetime')));
 				$delete_query = "DELETE FROM ".MAIN_DB_PREFIX."session";
 				$delete_query .= " WHERE last_accessed < '".$dbsession->idate($time_stamp - $max_lifetime)."'";
 				$dbsession->query($delete_query);
diff --git a/htdocs/core/lib/security2.lib.php b/htdocs/core/lib/security2.lib.php
index 1963a22a18e..babf179c3ef 100644
--- a/htdocs/core/lib/security2.lib.php
+++ b/htdocs/core/lib/security2.lib.php
@@ -202,9 +202,7 @@ if (!function_exists('dol_loginfunction')) {
 		$sessiontimeout = 'DOLSESSTIMEOUT_'.$prefix;
 
 		if (getDolGlobalString('MAIN_SESSION_TIMEOUT')) {
-			if (session_status() != PHP_SESSION_ACTIVE) {
-				dolSetCookie($sessiontimeout, getDolGlobalString('MAIN_SESSION_TIMEOUT'), 0);
-			}
+			dolSetCookie($sessiontimeout, getDolGlobalString('MAIN_SESSION_TIMEOUT'), 0);
 		}
 
 		if (GETPOST('urlfrom', 'alpha')) {
diff --git a/htdocs/main.inc.php b/htdocs/main.inc.php
index 203b93b7cdc..436d9e0b352 100644
--- a/htdocs/main.inc.php
+++ b/htdocs/main.inc.php
@@ -113,7 +113,7 @@ $prefix = dol_getprefix('');
 $sessionname = 'DOLSESSID_'.$prefix;
 $sessiontimeout = 'DOLSESSTIMEOUT_'.$prefix;
 if (!empty($_COOKIE[$sessiontimeout])) {
-	ini_set('session.gc_maxlifetime', $_COOKIE[$sessiontimeout]);
+	ini_set('session.gc_maxlifetime', max(120, min(3600 * 24, (int) $_COOKIE[$sessiontimeout])));	// Between 120 and 86400
 }
 
 // This create lock, released by session_write_close() or end of page.