Fixed #22938 -- Allowed clearsessions to remove file-based sessions.

django/contrib/sessions/backends/file.py

@@ -71,6 +71,15 @@ class SessionStore(SessionBase):
             modification = datetime.datetime.fromtimestamp(modification)
         return modification
 
+    def _expiry_date(self, session_data):
+        """
+        Return the expiry time of the file storing the session's content.
+        """
+        expiry = session_data.get('_session_expiry')
+        if not expiry:
+            expiry = self._last_modification() + datetime.timedelta(seconds=settings.SESSION_COOKIE_AGE)
+        return expiry
+
     def load(self):
         session_data = {}
         try:
@@ -89,9 +98,7 @@ class SessionStore(SessionBase):
                     self.create()
 
                 # Remove expired sessions.
-                expiry_age = self.get_expiry_age(
-                    modification=self._last_modification(),
-                    expiry=session_data.get('_session_expiry'))
+                expiry_age = self.get_expiry_age(expiry=self._expiry_date(session_data))
                 if expiry_age < 0:
                     session_data = {}
                     self.delete()

docs/releases/1.10.txt

@@ -79,7 +79,8 @@ Minor features
 :mod:`django.contrib.sessions`
 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 
-* ...
+* The :djadmin:`clearsessions` management command now removes file-based
+  sessions.
 
 :mod:`django.contrib.sitemaps`
 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

tests/sessions_tests/tests.py

@@ -521,7 +521,10 @@ class FileSessionTests(SessionTestsMixin, unittest.TestCase):
         self.assertRaises(InvalidSessionKey,
                           self.backend()._key_to_file, "a/b/c")
 
-    @override_settings(SESSION_ENGINE="django.contrib.sessions.backends.file")
+    @override_settings(
+        SESSION_ENGINE="django.contrib.sessions.backends.file",
+        SESSION_COOKIE_AGE=0,
+    )
     def test_clearsessions_command(self):
         """
         Test clearsessions command for clearing expired sessions.
@@ -546,10 +549,17 @@ class FileSessionTests(SessionTestsMixin, unittest.TestCase):
         other_session.set_expiry(-3600)
         other_session.save()
 
-        # Two sessions are in the filesystem before clearsessions...
-        self.assertEqual(2, count_sessions())
+        # One object in the present without an expiry (should be deleted since
+        # its modification time + SESSION_COOKIE_AGE will be in the past when
+        # clearsessions runs).
+        other_session2 = self.backend()
+        other_session2['foo'] = 'bar'
+        other_session2.save()
+
+        # Three sessions are in the filesystem before clearsessions...
+        self.assertEqual(3, count_sessions())
         management.call_command('clearsessions')
-        # ... and one is deleted.
+        # ... and two are deleted.
         self.assertEqual(1, count_sessions())