From 1aa8a8714380dbf8e8d925061a203f2f380dcfdc Mon Sep 17 00:00:00 2001
From: Rich Lott / Artful Robot <code.commits@artfulrobot.uk>
Date: Wed, 29 Nov 2023 12:51:32 +0000
Subject: [PATCH] dev/core#4425 standalone: fix lcMessages not sticking; lazy
 sessions

---
 CRM/Core/BAO/ConfigSetting.php  |  8 ++++----
 CRM/Utils/System/Standalone.php | 20 ++++++++++----------
 2 files changed, 14 insertions(+), 14 deletions(-)

diff --git a/CRM/Core/BAO/ConfigSetting.php b/CRM/Core/BAO/ConfigSetting.php
index 7d7b01fbab..f26cc34c4a 100644
--- a/CRM/Core/BAO/ConfigSetting.php
+++ b/CRM/Core/BAO/ConfigSetting.php
@@ -207,14 +207,14 @@ class CRM_Core_BAO_ConfigSetting {
 
     }
     else {
-
       // CRM-11993 - Use default when it's a single-language install.
       $chosenLocale = $defaultLocale;
-
     }
 
-    if (!$session->isEmpty()) {
-      // Always assign the chosen locale to the session.
+    if ($chosenLocale && ($requestLocale ?? NULL) === $chosenLocale) {
+      // If the locale is passed in via lcMessages key on GET or POST data,
+      // and it's valid against our configured locales, we require the session
+      // to store this, even if that means starting an anonymous session.
       $session->set('lcMessages', $chosenLocale);
     }
 
diff --git a/CRM/Utils/System/Standalone.php b/CRM/Utils/System/Standalone.php
index 1a5c7902e7..96868c32fb 100644
--- a/CRM/Utils/System/Standalone.php
+++ b/CRM/Utils/System/Standalone.php
@@ -35,19 +35,19 @@ class CRM_Utils_System_Standalone extends CRM_Utils_System_Base {
     return !class_exists(\Civi\Standalone\Security::class);
   }
 
-  /**
-   * Start a new session.
-   */
-  public function sessionStart() {
-    parent::sessionStart();
-    if ($this->missingStandaloneExtension()) {
-      // Provide a fake contact and user ID, otherwise we don't get a menu.
-      $session = CRM_Core_Session::singleton();
-      $session->set('userID', 1);
-      $session->set('ufID', 1);
+  public function initialize() {
+    parent::initialize();
+    // Initialize the session if it looks like there might be one.
+    // Case 1: user sends no session cookie: do NOT start the session. May be anon access that does not require session data. Good for caching.
+    // Case 2: user sends a session cookie: start the session, so we can access data like lcMessages for localization (which occurs early in the boot process).
+    // Case 3: user sends a session cookie but it's invalid: start the session, it will be empty and a new cookie will be sent.
+    if (isset($_COOKIE['PHPSESSID'])) {
+      // Note: passing $isRead = FALSE in the arguments will cause the session to be started.
+      CRM_Core_Session::singleton()->initialize(FALSE);
     }
   }
 
+
   /**
    * @inheritdoc
    */
-- 
2.25.1