php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #20776 Login only possible from page where login is required.
Submitted: 2002-12-02 18:38 UTC Modified: 2002-12-09 07:47 UTC
From: judd at ob-wan dot com Assigned:
Status: Closed Package: Session related
PHP Version: 4.2.3 OS: Win2K Server
Private report: No CVE-ID: None
 [2002-12-02 18:38 UTC] judd at ob-wan dot com
The login script I am using ( part of a tutorial by Ying Zhang, see http://zope1.devshed.com/zope.devshed.com/Server_Side/PHP/Commerce ) is only working when entered from a page requiring login. If login is voluntary by clicking on a "login" link, then login does not occur.

The only difference is the execution of the following code from the MyMarket.php library:

function is_logged_in() {
/* this function will return true if the user has logged in.  a user is logged
 * in if the $SESSION["user"] is set (by the login.php page) and also if the
 * remote IP address matches what we saved in the session ($SESSION["ip"])
 * from login.php -- this is not a robust or secure check by any means, but it
 * will do for now */

	global $SESSION, $REMOTE_ADDR;
	return isset($SESSION)
		&& isset($SESSION["user"])
		&& isset($SESSION["ip"])
		&& $SESSION["ip"] == $REMOTE_ADDR;
}

function require_login() {
/* this function checks to see if the user is logged in.  if not, it will show
 * the login screen before allowing the user to continue */

	global $CFG, $SESSION;
	if (! is_logged_in()) {
		$SESSION["wantsurl"] = qualified_me();
		redirect("$CFG->wwwroot/login.php");
	}
}

This code was developed in and is known to have worked in PHP4 beta. Note that the tutorial requires register_globals=On also, in case you decide to test it.

qualified_me() returns the name of the current script without the querystring portion. As delivered it didn't work, I'm using a stripped $_SERVER['SCRIPT_NAME'].

wantsurl is used later by the following code:

		/* if wantsurl is set, that means we came from a page that required
		 * log in, so let's go back there.  otherwise go back to the main page */

		$goto = empty($SESSION["wantsurl"]) ? $CFG->wwwroot . "/index.php" : $SESSION["wantsurl"];
		header("Location: $goto");
		die;

The error only occurs if $CFG->wwwroot/index.php is called. Hope this is enough information to nail the sucker.

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2002-12-02 18:44 UTC] sniper@php.net
Sorry, but your problem does not imply a bug in PHP itself.  For a
list of more appropriate places to ask for help using PHP, please
visit http://www.php.net/support.php as this bug system is not the
appropriate forum for asking support questions. 

Thank you for your interest in PHP.
 [2002-12-02 19:23 UTC] judd at ob-wan dot com
I would have thought that code with two results depending on the how the return path is acquired would definitely imply a bug, or am I missing something obvious here? I have a ton of programming experience (including proprietary systems similar to but more complex than PHP) but I'm very new at PHP itself so you may be right.
 [2002-12-02 21:17 UTC] judd at ob-wan dot com
At top of login page:

session_start();
session_register("SESSION");

if (! isset($SESSION)) { echo("Dead session!!<br>"); }

From a direct <a href> style link I get "Dead session!!" at the top of the page. From a redirect via require_login() (see below) it works.

Sure looks like a bug to me.
 [2002-12-03 02:34 UTC] sniper@php.net
Please provide a short but complete example script which can be used to reproduce this. Also note that PHP 4.3.0-dev (the latest stable CVS snapshot) has some fixes regarding session issues so you should try it out too, from:

 http://snaps.php.net/

 [2002-12-03 07:31 UTC] judd at ob-wan dot com
I've already reported a crashing bug against 4.3.0RC2 so I won't be trying any CVS snapshots just yet. See what I can do about a sample script, but it may be a couple days since I'm working in about 6 hrs.
 [2002-12-03 12:00 UTC] judd at ob-wan dot com
OK, I've sent a cutdown of the program, hope that helps.
 [2002-12-04 01:49 UTC] sniper@php.net
I did mean _SHORT_ example script, one that is max 10-20 lines long..not some 10-20 files!

 [2002-12-04 01:51 UTC] sniper@php.net
And DO NOT REPLY TO THIS EMAIL!! And especially: DO NOT email me! 

You can put such long examples somewhere in the net and add an URL here so that other people see it too..

 [2002-12-04 04:52 UTC] judd at ob-wan dot com
Sniper,

I have spent hours cutting out 90% of this program, removing libraries called, writing a script to autoinstall the tiny test database, written installation instructions and supplied two different versions of the main page - one which works, one which does not - and cut the whole thing down to six actual php files. Not twenty or even ten. And I finished doing that at 5:00am today, as you know.

Some problems can't be reduced to 12 lines of code. In this case, the login has to come from two different pages and go to another one, that makes at least three files. The fourth is a library, which you can safely ignore. The fifth is a logout script, without which you can only test it once. The sixth is a file included globally in each of the others to cut down verbosity.

If this is too complex, perhaps you expect me to actually fix your bugs for you. Sorry, I charge AU$100 an hour for that nowadays, having already paid my dues on a number of large GPL projects.

Keep the bug, I don't mind.
 [2002-12-04 05:12 UTC] derick@php.net
hmm... maybe Sniper should start charging for support then; he would make a very decent living out out it with all the time he spends on verifying bugs and trying to help people with bugs. 
 [2002-12-04 20:40 UTC] judd at ob-wan dot com
"If a man isn't a socialist at 20, he has no heart; if he is
still a socialist at 40, he has no mind."

Rob
 [2002-12-07 01:24 UTC] iliaa@php.net
Not enough information was provided for us to be able
to handle this bug. Please re-read the instructions at
http://bugs.php.net/how-to-report.php

If you can provide more information, feel free to add it
to this bug and change the status back to "Open".

Thank you for your interest in PHP.


Please use $_SESSION autoglobals rather then register_session to assing values to the session & if the problem persists please include a SMALL script in your reply.
 [2002-12-08 22:34 UTC] judd at ob-wan dot com
Iliaa,

My reply of 2 Dec 9:17pm contains a small script which demonstrates this fault. Don't know what else you want here. If you run this, you'll see "Dead session!!". Thus either session_register() or isset() is misbehaving compared to versions prior 4.2.3

<?

session_start();
session_register("SESSION");

if (! isset($SESSION)) { echo("Dead session!!<br>"); }

?>
 [2002-12-08 22:43 UTC] sniper@php.net
Please try using this CVS snapshot:

  http://snaps.php.net/php4-latest.tar.gz
 
For Windows:
 
  http://snaps.php.net/win32/php4-win32-latest.zip


 [2002-12-09 02:20 UTC] judd at ob-wan dot com
Hi Sniper,

I'll wait until an RC3 eventuates, rather than trying to build this right now.

In addition to this morning's message, I have now discovered that part of my frustration was that there were TWO bugs in PHP-4.2.3 in the same piece of login script code!

1. session_register() is apparently quirky, as stated earlier.
2. The one I just discovered is that header() is apparently also broken. I had already mentioned a different behaviour depending on the way the URL is included (see original message in this report) but have just isolated that header() is evidently not doing enough to ensure the browser knows it has been redirected.

This will have unreliable results:
header("Location: $CFG->wwwroot/index.php");

This will not:
redirect("$CFG->wwwroot/index.php");

function redirect($url, $message="", $delay=0) {
/* redirects to a new URL using meta tags */
	echo "<meta http-equiv='Refresh' content='$delay; url=$url'>";
	if (!empty($message)) echo "<div style='font-family: Arial, Sans-serif; font-size: 12pt;' align=center>$message</div>";
	die;
}

Ignoring the fancy formatting if you can, it looks like header() isn't flushing the browser.

Hope this helps.
 [2002-12-09 07:47 UTC] sniper@php.net
All mentioned problems have been addressed in CVS. 
Closed.

 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Wed Sep 18 22:01:26 2024 UTC