<?xml version="1.0" encoding="utf-8"?>
<feed xmlns="http://www.w3.org/2005/Atom">
	<title type="html"><![CDATA[FrontAccounting forum — Cross-company session context issue with stale browser tabs]]></title>
	<link rel="self" href="https://frontaccounting.com/punbb/extern.php?action=feed&amp;tid=10740&amp;type=atom" />
	<updated>2026-09-26T22:29:45Z</updated>
	<generator>PunBB</generator>
	<id>https://frontaccounting.com/punbb/viewtopic.php?id=10740</id>
		<entry>
			<title type="html"><![CDATA[Cross-company session context issue with stale browser tabs]]></title>
			<link rel="alternate" href="https://frontaccounting.com/punbb/viewtopic.php?pid=43884#p43884" />
			<content type="html"><![CDATA[<p>I found a reproducible cross-company session/context problem in FrontAccounting 2.4.20 when browser tabs opened under different company contexts remain open.<br />Steps to reproduce<br />1. Open FrontAccounting in company A and open Banking and General Ledger → Journal Inquiry.<br />2. Company A uses - as the date separator, so the page contains dates such as 2025-01-01 and 2025-12-31.<br />3. Change the active FrontAccounting session to company B in another browser tab. Company B uses / as the date separator.<br />4. Return to the old Journal Inquiry tab which was generated while company A was active.<br />5. Press Search without reloading that page.<br />Actual result<br />The old page is still displayed as belonging to company A, but the request is processed using the preferences of the currently active company B session.<br />The following PHP warnings are produced:<br />Undefined array key 1 in /srv/frontaccounting/includes/date_functions.inc at line 398<br />Undefined array key 2 in /srv/frontaccounting/includes/date_functions.inc at line 398<br />A non-numeric value encountered in /srv/frontaccounting/includes/date_functions.inc at line 405</p><p>The call shown in the error output is, for example:<br />date2sql(&#039;2025-01-01&#039;)</p><p>date2sql() obtains the current separator using:<br />$sep = $SysPrefs-&gt;dateseps[user_date_sep()];</p><p>and for the YYYYMMDD date format eventually executes:<br />list($year, $month, $day) = explode($sep, $date_);</p><p>user_date_sep() in includes/current_user.inc gets the separator from the current session:<br />return isset($_SESSION[&quot;wa_current_user&quot;]-&gt;prefs-&gt;date_sep)<br />&nbsp; &nbsp; ? $_SESSION[&quot;wa_current_user&quot;]-&gt;prefs-&gt;date_sep()<br />&nbsp; &nbsp; : $SysPrefs-&gt;dflt_date_sep;</p><p>Therefore the stale company A page submits 2025-01-01, while the current session expects /. This effectively results in:<br />explode(&#039;/&#039;, &#039;2025-01-01&#039;)</p><p>which explains the warnings.<br />Expected result<br />A page generated in the context of company A should not silently be processed in the context of company B after the active session company has changed.<br />Ideally, each submitted form/request should contain enough information to verify that the company context in which the page was generated still matches the current session company. If it does not match, FrontAccounting should reject the request and ask the user to reload the page.<br />Why I think this is more important than the date parsing warning<br />The different date separators made the problem visible. If both companies had identical date settings, this particular request might apparently succeed and there would be no obvious indication that a page generated under company A was being processed using company B&#039;s current session context.<br />I have reproduced the context mismatch with Journal Inquiry. I have not tested submitting an accounting transaction from such a stale tab because I do not want to risk modifying the wrong company&#039;s data. Therefore I cannot say that cross-company writes are possible, but I think this should be checked because it could represent a data-integrity issue.<br />Version: FrontAccounting 2.4.20<br />I can provide a screenshot showing the complete PHP warnings and the stale Journal Inquiry page if useful.</p>]]></content>
			<author>
				<name><![CDATA[peacecop kalmer:]]></name>
				<uri>https://frontaccounting.com/punbb/profile.php?id=44591</uri>
			</author>
			<updated>2026-09-26T22:29:45Z</updated>
			<id>https://frontaccounting.com/punbb/viewtopic.php?pid=43884#p43884</id>
		</entry>
</feed>
