From a09fb9792f54c70019ae8cb455295dcfdb5b7518 Mon Sep 17 00:00:00 2001
From: Franzz <francois@lutran.fr>
Date: Mon, 10 Aug 2026 23:55:48 +0200
Subject: [PATCH] Close session earlier if not required

---
 lib/Controller.php | 25 +++++++++++++++++++------
 1 file changed, 19 insertions(+), 6 deletions(-)

diff --git a/lib/Controller.php b/lib/Controller.php
index b0293e8..059259f 100644
--- a/lib/Controller.php
+++ b/lib/Controller.php
@@ -22,6 +22,10 @@ class Controller extends PhpObject
 		'admin_create',
 		'admin_delete'
 	);
+	const SESSION_WRITING_ACTIONS = array(
+		'login',
+		'logout'
+	);
 
 	private Spot $oSpot;
 	private array $asReq;
@@ -67,17 +71,21 @@ class Controller extends PhpObject
 
 		//Create Spot Instance
 		$this->oSpot = new Spot($sProcessPage, $this->asReq['t']);
-		$this->oSpot->setProjectId($this->asReq['id_project']);
 
-		//Validate CSRF & dispatch
-		if(!$this->validateMutationRequest($sAction)) $sResult = Spot::getJsonResult(false, Spot::UNAUTHORIZED);
-		elseif($sAction == '') $sResult = $this->oSpot->getAppMainPage($this->getCsrfToken());
-		else $sResult = $this->dispatch($sAction);
+		//Validate CSRF, then release the session lock before long-running work.
+		$bValidMutationRequest = $this->validateMutationRequest($sAction);
+		if(!$bValidMutationRequest || !in_array($sAction, self::SESSION_WRITING_ACTIONS, true)) $this->closeSession();
+
+		if(!$bValidMutationRequest) $sResult = Spot::getJsonResult(false, Spot::UNAUTHORIZED);
+		else {
+			$this->oSpot->setProjectId($this->asReq['id_project']);
+			$sResult = ($sAction == '')?$this->oSpot->getAppMainPage($this->getCsrfToken()):$this->dispatch($sAction);
+		}
 
 		//Clean errors
 		$sDebug = ob_get_clean();
 		if($sDebug != '') $this->oSpot->addUncaughtError($sDebug);
-		if(session_status() === PHP_SESSION_ACTIVE) session_write_close();
+		$this->closeSession();
 
 		return $sResult;
 	}
@@ -124,6 +132,11 @@ class Controller extends PhpObject
 		return PHP_SAPI === 'cli' || ($sServerToken !== '' && is_string($sClientToken) && hash_equals($sServerToken, $sClientToken));
 	}
 
+	private function closeSession(): void
+	{
+		if(session_status() === PHP_SESSION_ACTIVE) session_write_close();
+	}
+
 	private function dispatch(string $sAction): string
 	{
 		return match($sAction) {