Bug 20 fixed.

diff --git a/Current Development Check List.md b/Current Development Check List.md
index 2ba24a3157c9663fc131740da0e4e3d9fb7c0ecb..b19835ac964494bd6e42a6eaf9ea39602d10f90a 100644 (file)
--- a/Current Development Check List.md
+++ b/Current Development Check List.md
@@ -7,19 +7,16 @@ This version is not compatible in data structure to prior versions. Data migrati
 
 ## LifeLog Development
 
-### v.1.8 This is v.1.8 SUN STABLE.
+### v.1.8 Encountered
 
-* Automated install module script **`./install_modules.sh `**
-* Has Secure Backup/Restore. Providing accurate full data restore and merging with existing for live databases.
-* New category selection, storing approuch.
-* Better and more efficient application configuration and setup.
-* Numerous fixes, and better exception handling.
+* &#10004 Autologin bypasses actual wanted login.
+  * This is bug 20.
 
 ### v.1.7 Encountered
 
 * ✔ Database backup tgz ball, upload and download button on config page.
   * You must have the password you logged in to unscramble the backup.
-   * Alias -> pass -> backup password. Information required.
+    * Alias -> pass -> backup password. Information required.
 * Application log needed in the background for System based logs.
 * New CNF Development.
   * ✔ Migration is currently hard to maintain and data export and import is wrongly reliant to CVS.
@@ -94,6 +91,10 @@ This version is not compatible in data structure to prior versions. Data migrati
 
 ## Bugs
 
+### v. 1.9 Encountered/Fixed
+
+* &#10004 Bug 20 - Autologin bypasses, wanted new alias login (on logoff).
+
 ### v. 1.8 Encountered/Fixed
 
 * ✔ Bug 19 - Same day datediff is displaying wrong report in time stack on the page.

diff --git a/htdocs/cgi-bin/login_ctr.cgi b/htdocs/cgi-bin/login_ctr.cgi
index ef02d337f633d60a7ac7aa6273bce69e943ec98b..3cf8703e71ea62039d222ab0bcd12823bc2609e8 100755 (executable)
--- a/htdocs/cgi-bin/login_ctr.cgi
+++ b/htdocs/cgi-bin/login_ctr.cgi
@@ -149,6 +149,11 @@ sub checkAutologinSet {
     }
     close $fh;
     if(@cre &&scalar(@cre)>1){##TODO we already connected here to the db, why do it again later?
+
+            if($alias && $passw && $alias ne $cre[0]){ # Is this an new alias login attempt?
+                return;                                # Note, we do assign entered password even passw as autologin is set. Not entering one bypasses this.
+            }                                          # If stricter access is required set it to zero in main.cnf, or disable in config.
+            $passw = $cre[1] if (!$passw);
             my $database = &Settings::logPath.'data_'.$cre[0].'_log.db';
             my $dsn= "DBI:SQLite:dbname=$database";
             my $db = DBI->connect($dsn, $cre[0], $cre[1], { RaiseError => 1 })
@@ -159,7 +164,7 @@ sub checkAutologinSet {
             my @set = $st->fetchrow_array();
             if(@set && $set[0]=="1"){
                     $alias = $cre[0];
-                    $passw = $cre[1];
+                    $passw = $passw; #same as entered, by the not knowing to leave it blank.
                     &Settings::removeOldSessions;
             }
             $db->disconnect();