(tomcat) branch 9.0.x updated: Fix back-port

This is an automated email from the ASF dual-hosted git repository.

markt-asf pushed a commit to branch 9.0.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git


The following commit(s) were added to refs/heads/9.0.x by this push:
     new e64c853953 Fix back-port
e64c853953 is described below

commit e64c853953d47fc95c2501065d71d99b793efd3e
Author: Mark Thomas <[email protected]>
AuthorDate: Mon Aug 24 14:19:48 2026 +0100

    Fix back-port
---
 .../catalina/session/LocalStrings.properties       |  1 +
 .../catalina/session/PersistentManagerBase.java    | 14 ++++++-------
 .../catalina/session/TestPersistentManager.java    |  6 ++++++
 webapps/docs/changelog.xml                         | 10 ++++++---
 webapps/docs/config/manager.xml                    | 24 +++++++++-------------
 5 files changed, 30 insertions(+), 25 deletions(-)

diff --git a/java/org/apache/catalina/session/LocalStrings.properties b/java/org/apache/catalina/session/LocalStrings.properties
index f4562c6970..66bd151c91 100644
--- a/java/org/apache/catalina/session/LocalStrings.properties
+++ b/java/org/apache/catalina/session/LocalStrings.properties
@@ -51,6 +51,7 @@ managerBase.sessionNotFound=The session [{0}] was not found
 managerBase.sessionTimeout=Invalid session timeout setting [{0}]
 managerBase.setContextNotNew=It is illegal to call setContext() to change the Context associated with a Manager if the Manager is not in the NEW state
 
+persistentManager.activityCheckRequired=The system property org.apache.catalina.session.StandardSession.ACTIVITY_CHECK must be set to true (either explicitly or via STRICT_SERVLET_COMPLIANCE) if the [{0}] attribute is configured.
 persistentManager.backupMaxIdle=Backing up session [{0}] to Store, idle for [{1}] seconds
 persistentManager.deserializeError=Error deserializing Session [{0}]
 persistentManager.isLoadedError=Error checking if session [{0}] is loaded in memory
diff --git a/java/org/apache/catalina/session/PersistentManagerBase.java b/java/org/apache/catalina/session/PersistentManagerBase.java
index 6fe6f44044..ed2aef3587 100644
--- a/java/org/apache/catalina/session/PersistentManagerBase.java
+++ b/java/org/apache/catalina/session/PersistentManagerBase.java
@@ -242,7 +242,9 @@ public abstract class PersistentManagerBase extends ManagerBase implements Store
      * @param max time in seconds to wait for possible swap out
      */
     public void setMaxIdleSwap(int max) {
-
+        if (max > -1 && !StandardSession.ACTIVITY_CHECK) {
+            throw new IllegalArgumentException(sm.getString("persistentManager.activityCheckRequired", "maxIdleSwap"));
+        }
         if (max == this.maxIdleSwap) {
             return;
         }
@@ -273,7 +275,9 @@ public abstract class PersistentManagerBase extends ManagerBase implements Store
      * @param min time in seconds before a possible swap out
      */
     public void setMinIdleSwap(int min) {
-
+        if (min > -1 && !StandardSession.ACTIVITY_CHECK) {
+            throw new IllegalArgumentException(sm.getString("persistentManager.activityCheckRequired", "minIdleSwap"));
+        }
         if (this.minIdleSwap == min) {
             return;
         }
@@ -360,12 +364,6 @@ public abstract class PersistentManagerBase extends ManagerBase implements Store
     }
 
 
-    @Override
-    public boolean getSessionActivityCheck() {
-        return super.getSessionActivityCheck() || minIdleSwap > -1 || maxIdleSwap > -1;
-    }
-
-
     // --------------------------------------------------------- Public Methods
 
     /**
diff --git a/test/org/apache/catalina/session/TestPersistentManager.java b/test/org/apache/catalina/session/TestPersistentManager.java
index dc5cdec308..5689f3c01e 100644
--- a/test/org/apache/catalina/session/TestPersistentManager.java
+++ b/test/org/apache/catalina/session/TestPersistentManager.java
@@ -25,6 +25,7 @@ import javax.servlet.http.HttpSessionEvent;
 import javax.servlet.http.HttpSessionListener;
 
 import org.junit.Assert;
+import org.junit.Before;
 import org.junit.Test;
 
 import org.apache.catalina.Context;
@@ -42,6 +43,11 @@ import org.easymock.IAnswer;
 
 public class TestPersistentManager {
 
+    @Before
+    public void setup() {
+        System.setProperty("org.apache.catalina.session.StandardSession.ACTIVITY_CHECK", "true");
+    }
+
     @Test
     public void testMinIdleSwap() throws Exception {
         PersistentManager manager = new PersistentManager();
diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml
index 1a842e802b..6783b6d70b 100644
--- a/webapps/docs/changelog.xml
+++ b/webapps/docs/changelog.xml
@@ -151,9 +151,13 @@
       <fix>
         Ensure that <code>PersistentManager</code> implementations that extend
         <code>PersistentManagerBase</code> do not swap out sessions that are
-        associated with a request that is currently being processed. This
-        includes not swapping out a session unless the session was created when
-        activity tracking was enabled. (markt)
+        associated with a request that is currently being processed. As a
+        result, it is now a requirement that the system property
+        <code>org.apache.catalina.session.StandardSession.ACTIVITY_CHECK</code>
+        is set to <code>true</code> (either explicitly or via
+        <code>STRICT_SERVLET_COMPLIANCE</code>) if either
+        <code>minIdleSwap</code> or <code>maxIdleSwap</code> are configured.
+        (markt)
       </fix>
     </changelog>
   </subsection>
diff --git a/webapps/docs/config/manager.xml b/webapps/docs/config/manager.xml
index 8ef33cc943..8699c877e3 100644
--- a/webapps/docs/config/manager.xml
+++ b/webapps/docs/config/manager.xml
@@ -266,13 +266,11 @@
         feature is enabled, the time interval specified here should be equal to
         or longer than the value specified for <code>maxIdleBackup</code>. By
         default, this feature is disabled.</p>
-        <p>If this feature is enabled, the <code>sessionActivityCheck</code>
-        attribute is forced to be true to ensure that currently active sessions
-        are not swapped out.</p>
-        <p>If this feature is enabled at runtime, e.g. via JMX, and session
-        activity was not being tracked prior to the feature being enabled, only
-        sessions created after the feature is enabled will be eligible for swap
-        out.</p>
+        <p>If this feature is enabled, the system property
+        <code>org.apache.catalina.session.StandardSession.ACTIVITY_CHECK</code>
+        must be set to <code>true</code> either explicitly or via
+        <code>STRICT_SERVLET_COMPLIANCE</code> else the configuration will be
+        rejected.</p>
       </attribute>
 
       <attribute name="minIdleSwap" required="false">
@@ -282,13 +280,11 @@
         swapped out to keep the active session count down. If specified, this
         value should be less than that specified by <code>maxIdleSwap</code>.
         By default, this value is set to <code>-1</code>.</p>
-        <p>If this feature is enabled, the <code>sessionActivityCheck</code>
-        attribute is forced to be true to ensure that currently active sessions
-        are not swapped out.</p>
-        <p>If this feature is enabled at runtime, e.g. via JMX, and session
-        activity was not being tracked prior to the feature being enabled, only
-        sessions created after the feature is enabled will be eligible for swap
-        out.</p>
+        <p>If this feature is enabled, the system property
+        <code>org.apache.catalina.session.StandardSession.ACTIVITY_CHECK</code>
+        must be set to <code>true</code> either explicitly or via
+        <code>STRICT_SERVLET_COMPLIANCE</code> else the configuration will be
+        rejected.</p>
       </attribute>
 
       <attribute name="persistAuthentication" required="false">