Issue #3032742 by joachim, pivica: captcha_cron() removes captcha_sessions...

Issue #3032742 by joachim, pivica: captcha_cron() removes captcha_sessions that may still have open PHP sessions

captcha.module

@@ -111,10 +111,10 @@ function captcha_cron() {
   // Get request time.
   $request_time = \Drupal::time()->getRequestTime();
 
-  // Remove challenges older than 1 day.
+  // Remove challenges older than PHP's session.gc_maxlifetime value.
   $connection = Database::getConnection();
   $connection->delete('captcha_sessions')
-    ->condition('timestamp', $request_time - 60 * 60 * 24, '<')
+    ->condition('timestamp', $request_time - ini_get('session.gc_maxlifetime'), '<')
     ->execute();
 }
 

tests/src/Functional/CaptchaCronTest.php

@@ -37,6 +37,8 @@ class CaptchaCronTest extends BrowserTestBase {
   public function setUp() {
     parent::setUp();
 
+    ini_set('session.gc_maxlifetime', 60 * 60 * 24);
+
     // Get request time.
     $request_time = \Drupal::time()->getRequestTime();