Nur dann Cookie setzen, wenn eine Session-ID vorhanden ist

[kivitendo-erp.git] / SL / Auth.pm

diff --git a/SL/Auth.pm b/SL/Auth.pm
index a11fbafb0d815472c8a3cfbcee3e75bcfca9f589..2bd2d09c083e82401e5628eb82c860a95d5cc2ff 100644 (file)
--- a/SL/Auth.pm
+++ b/SL/Auth.pm
@@ -489,7 +489,7 @@ sub restore_session {
   if (!$cookie || $cookie->{is_expired} || ($cookie->{ip_address} ne $ENV{REMOTE_ADDR})) {
     $self->destroy_session();
     $main::lxdebug->leave_sub();
-    return SESSION_EXPIRED;
+    return $cookie ? SESSION_EXPIRED : SESSION_NONE;
   }
 
   $query = qq|SELECT sess_key, sess_value FROM auth.session_content WHERE session_id = ?|;