php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #46567 Bad output with $_SESSION use
Submitted: 2008-11-13 16:13 UTC Modified: 2009-02-26 01:00 UTC
Votes:1
Avg. Score:4.0 ± 0.0
Reproduced:1 of 1 (100.0%)
Same Version:1 (100.0%)
Same OS:1 (100.0%)
From: lito at eordes dot com Assigned:
Status: No Feedback Package: Output Control
PHP Version: 5.2.6 OS: GNU/Linux Ubuntu
Private report: No CVE-ID: None
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: lito at eordes dot com
New email:
PHP Version: OS:

 

 [2008-11-13 16:13 UTC] lito at eordes dot com
Description:
------------
I can't use php with certain conditions "stream" and control video playing.

I have 2 php's index.php and stream.php

index.php init the session var id and store the video name crypted with md5 function

video.php recover the session and compare with the v parameter.

If I use $_SESSION and header/exit to check the data, send some bad headers and the video don't load.

If I use only header/exit or $_SESSION at once, I can play the video.

Reproduce code:
---------------
------------------------------------------------------------------
index.php
------------------------------------------------------------------

<?php
session_start();

$_SESSION['id'] = md5('video');

session_write_close();
?>

<object classid="clsid:22D6F312-B0F6-11D0-94AB-0080C74C7E95" width="406" height="406">
	<param name="Filename" value="stream.php?v=video">
	<param name="AutoStart" value="true">
	<param name="ShowControls" value="true">
	<param name="BufferingTime" value="5">
	<param name="ShowStatusBar" value="true">
	<param name="AutoSize" value="true">
	<param name="InvokeURLs" value="false">

	<embed src="stream.php?v=video"
		type="application/x-mplayer2"
		autostart="1"
		enabled="1"
		showstatusbar="1"
		showdisplay="1"
		showcontrols="1"
		pluginspage="http://www.microsoft.com/Windows/MediaPlayer/"
		width="406"
		height="406">
	</embed>
</object>

------------------------------------------------------------------
stream.php
------------------------------------------------------------------

<?php
session_start();

if (($_SESSION['id'] != md5($_GET['v'])) || !is_file($_GET['v'].'.wmv')) {
	header('Location: /');
	exit;
}

header('Content-Type: video/x-ms-wmv');
header('Content-Length: '.filesize($_GET['v'].'.wmv'));

readfile($_GET['v'].'.wmv');
?>

Expected result:
----------------
If all checks are fine the scritp must play the video.

Actual result:
--------------
If I use ($_SESSION['id'] == md5($_GET['v'])) and header/exit result, will never play correctly but all conditions are correct!! (The session id value == md5() and the file exists, never login to the if condition.

for example, in this example, the 1 number it's printed, but without the echo 1 the videos isn't player:

<?php
session_start();

if (($_SESSION['id'] != md5($_GET['v'])) || !is_file($_GET['v'].'.wmv')) {
	header('Location: /');
	exit;
}

echo 1;

header('Content-Type: video/x-ms-wmv');
header('Content-Length: '.filesize($_GET['v'].'.wmv'));

readfile($_GET['v'].'.wmv');
?>

With this example it works:

<?php
session_start();

if (!is_file($_GET['v'].'.wmv')) {
	header('Location: /');
	exit;
}

header('Content-Type: video/x-ms-wmv');
header('Content-Length: '.filesize($_GET['v'].'.wmv'));

readfile($_GET['v'].'.wmv');
?>

And with this example also works:

<?php
session_start();

if ($_SESSION['id'] != md5($_GET['v'])) {
	//header('Location: /');
	//exit;
}

header('Content-Type: video/x-ms-wmv');
header('Content-Length: '.filesize($_GET['v'].'.wmv'));

readfile($_GET['v'].'.wmv');
?>

But this example don't print the 1 and don't play the video:

<?php
session_start();

if ($_SESSION['id'] != md5($_GET['v'])) {
	echo 1;
	exit;
}

header('Content-Type: video/x-ms-wmv');
header('Content-Length: '.filesize($_GET['v'].'.wmv'));

readfile($_GET['v'].'.wmv');
?>

I don't understand why if I use $_SESSION and header/exit/die together the script don't work (but no erros).

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2008-11-13 17:38 UTC] lito at eordes dot com
I have uploaded this examples, pleass add simplifica.es at url start (SPAM control problems):

Source: /stream/?id=0&source=1

This don't but it will should work: /stream/?id=0

Sources: /stream/stream0.php?v=video&source=1

This print 1 at stream start: /stream/?id=1

Source: /stream/stream1.php?v=video&source=1

This works but doesn't check session var: /stream/?id=2

Source: /stream/stream2.php?v=video&source=1

This works but doesn't stop if the ckeck fail: /stream/?id=3

Source: /stream/stream3.php?v=video&source=1

This doesn't work but it will should work: /stream/?id=4

Source: /stream/stream4.php?v=video&source=1

Which one can you see correctly?

Thanks.
 [2009-02-18 21:27 UTC] jani@php.net
Please try using this CVS snapshot:

  http://snaps.php.net/php5.2-latest.tar.gz
 
For Windows:

  http://windows.php.net/snapshots/


 [2009-02-26 01:00 UTC] php-bugs at lists dot php dot net
No feedback was provided for this bug for over a week, so it is
being suspended automatically. If you are able to provide the
information that was originally requested, please do so and change
the status of the bug back to "Open".
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Sat Dec 21 15:01:29 2024 UTC