This is an automated email from the ASF dual-hosted git repository. rmaucher pushed a commit to branch 10.1.x in repository https://gitbox.apache.org/repos/asf/tomcat.git
commit 67b582899113b07bfe5f01b3ebc72704ca962bb5 Author: opencode <[email protected]> AuthorDate: Wed Oct 7 11:55:04 2026 +0200 Treat unknown session times as invalidated in the Manager SessionUtils DummyProxySession, which the HTML Manager uses to represent sessions held on other cluster nodes, returns zero from its time getters. The time methods in SessionUtils turned those zeros into values of about the current epoch time, which the UsedTime, InactiveTime and TTL sort comparators used as ordering keys. Return the -1 sentinel, documented for invalidated sessions, when the creation time is not positive, so proxy sessions sort consistently with unknown values instead of ±epoch magnitudes, and so their zero max inactive interval is not mistaken for the never-times-out case. --- .../apache/catalina/manager/util/SessionUtils.java | 19 ++++++++++++++++--- 1 file changed, 16 insertions(+), 3 deletions(-) diff --git a/java/org/apache/catalina/manager/util/SessionUtils.java b/java/org/apache/catalina/manager/util/SessionUtils.java index 855477b8d9..5fa21e8d28 100644 --- a/java/org/apache/catalina/manager/util/SessionUtils.java +++ b/java/org/apache/catalina/manager/util/SessionUtils.java @@ -238,10 +238,14 @@ public class SessionUtils { * * @param in_session The session * @return the time in milliseconds between session creation and the last access, or -1 if the session is - * invalidated + * invalidated or its times are unknown (proxy sessions of a cluster member) */ public static long getUsedTimeForSession(Session in_session) { try { + if (in_session.getCreationTime() <= 0) { + // Unknown times, e.g. a proxy session of a cluster member + return -1; + } return in_session.getThisAccessedTime() - in_session.getCreationTime(); } catch (IllegalStateException ise) { // ignore: invalidated session @@ -254,10 +258,14 @@ public class SessionUtils { * * @param in_session The session * @return the remaining TTL in milliseconds, {@link Long#MAX_VALUE} if the session never times out, or -1 if the - * session is invalidated + * session is invalidated or its times are unknown (proxy sessions of a cluster member) */ public static long getTTLForSession(Session in_session) { try { + if (in_session.getCreationTime() <= 0) { + // Unknown times, e.g. a proxy session of a cluster member + return -1; + } int maxInactiveInterval = in_session.getMaxInactiveInterval(); if (maxInactiveInterval <= 0) { // A non-positive interval means the session never times out @@ -275,10 +283,15 @@ public class SessionUtils { * Returns the time in milliseconds since the session was last accessed. * * @param in_session The session - * @return the inactive time in milliseconds, or -1 if the session is invalidated + * @return the inactive time in milliseconds, or -1 if the session is invalidated or its times are unknown (proxy + * sessions of a cluster member) */ public static long getInactiveTimeForSession(Session in_session) { try { + if (in_session.getCreationTime() <= 0) { + // Unknown times, e.g. a proxy session of a cluster member + return -1; + } return System.currentTimeMillis() - in_session.getThisAccessedTime(); } catch (IllegalStateException ise) { // ignore: invalidated session --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
