Ok, thanks for pointing this out. I still think this is wrong. In most
places we only want to know if the session cookie is available (and not
if the browser supports cookies at all), the login would be an exception.

Imagine the case where the session cookie expires, then your check would
cause an error. That might be an indication for setting the test cookie
to a similar length as the session cookie, btw. In fact we only need the
test cookie until the login! We might even delete it then again to avoid
problems with changed cookie browser settings in future...

How about adding a parameter to Redirect() that is only used by the
login and suppresses the SID adding to the URL? That would better
reflect the exceptionality of the login.

Regards, mg

Am 30.04.14 09:49, schrieb Moritz Lenz:
> In Kernel/Output/HTML/Layout.pm:
> 
>> @@ -541,7 +541,7 @@ sub Redirect {
>>      my $Output = $Cookies . $Self->Output( TemplateFile => 'Redirect', Data => \%Param );
>>  
>>      # add session id to redirect if no cookie is enabled
>> -    if ( !$Self->{SessionIDCookie} ) {
>> +    if ( !$Self->{SessionIDCookie}  && !$Self->{BrowserHasCookie} ) {
> 
> That one is absolutely needed, because Redirect is where the spurious
> Session ID in the URL is introduced.
> 
> —
> Reply to this email directly or view it on GitHub
> <https://github.com/OTRS/otrs/pull/124/files#r12131928>.
> 

-- 
Martin Gruner
Senior Developer R&D

OTRS AG
Bahnhofplatz 1a
94315 Straubing

T: +49 (0)6172 681988 0
F: +49 (0)9421 56818 18
I:  www.otrs.com/

Geschäftssitz: Bad Homburg, Amtsgericht: Bad Homburg, HRB 10751,
USt-Nr.: DE256610065
Aufsichtsratsvorsitzender: Burchard Steinbild, Vorstand: André
Mindermann (Vorsitzender), Christopher Kuhn, Sabine Riedel

Einfache Planung, bessere Übersicht - Mit OTRS 3.3 einfach besseres
Service Management - Jetzt downloaden und testen