php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #46567 Bad output with $_SESSION use
Submitted: 2008-11-13 16:13 UTC Modified: 2009-02-26 01:00 UTC
Votes:1
Avg. Score:4.0 ± 0.0
Reproduced:1 of 1 (100.0%)
Same Version:1 (100.0%)
Same OS:1 (100.0%)
From: lito at eordes dot com Assigned:
Status: No Feedback Package: Output Control
PHP Version: 5.2.6 OS: GNU/Linux Ubuntu
Private report: No CVE-ID: None
View Add Comment Developer Edit
Anyone can comment on a bug. Have a simpler test case? Does it work for you on a different platform? Let us know!
Just going to say 'Me too!'? Don't clutter the database with that please — but make sure to vote on the bug!
Your email address:
MUST BE VALID
Solve the problem:
36 - 9 = ?
Subscribe to this entry?

 
 [2008-11-13 16:13 UTC] lito at eordes dot com
Description:
------------
I can't use php with certain conditions "stream" and control video playing.

I have 2 php's index.php and stream.php

index.php init the session var id and store the video name crypted with md5 function

video.php recover the session and compare with the v parameter.

If I use $_SESSION and header/exit to check the data, send some bad headers and the video don't load.

If I use only header/exit or $_SESSION at once, I can play the video.

Reproduce code:
---------------
------------------------------------------------------------------
index.php
------------------------------------------------------------------

<?php
session_start();

$_SESSION['id'] = md5('video');

session_write_close();
?>

<object classid="clsid:22D6F312-B0F6-11D0-94AB-0080C74C7E95" width="406" height="406">
	<param name="Filename" value="stream.php?v=video">
	<param name="AutoStart" value="true">
	<param name="ShowControls" value="true">
	<param name="BufferingTime" value="5">
	<param name="ShowStatusBar" value="true">
	<param name="AutoSize" value="true">
	<param name="InvokeURLs" value="false">

	<embed src="stream.php?v=video"
		type="application/x-mplayer2"
		autostart="1"
		enabled="1"
		showstatusbar="1"
		showdisplay="1"
		showcontrols="1"
		pluginspage="http://www.microsoft.com/Windows/MediaPlayer/"
		width="406"
		height="406">
	</embed>
</object>

------------------------------------------------------------------
stream.php
------------------------------------------------------------------

<?php
session_start();

if (($_SESSION['id'] != md5($_GET['v'])) || !is_file($_GET['v'].'.wmv')) {
	header('Location: /');
	exit;
}

header('Content-Type: video/x-ms-wmv');
header('Content-Length: '.filesize($_GET['v'].'.wmv'));

readfile($_GET['v'].'.wmv');
?>

Expected result:
----------------
If all checks are fine the scritp must play the video.

Actual result:
--------------
If I use ($_SESSION['id'] == md5($_GET['v'])) and header/exit result, will never play correctly but all conditions are correct!! (The session id value == md5() and the file exists, never login to the if condition.

for example, in this example, the 1 number it's printed, but without the echo 1 the videos isn't player:

<?php
session_start();

if (($_SESSION['id'] != md5($_GET['v'])) || !is_file($_GET['v'].'.wmv')) {
	header('Location: /');
	exit;
}

echo 1;

header('Content-Type: video/x-ms-wmv');
header('Content-Length: '.filesize($_GET['v'].'.wmv'));

readfile($_GET['v'].'.wmv');
?>

With this example it works:

<?php
session_start();

if (!is_file($_GET['v'].'.wmv')) {
	header('Location: /');
	exit;
}

header('Content-Type: video/x-ms-wmv');
header('Content-Length: '.filesize($_GET['v'].'.wmv'));

readfile($_GET['v'].'.wmv');
?>

And with this example also works:

<?php
session_start();

if ($_SESSION['id'] != md5($_GET['v'])) {
	//header('Location: /');
	//exit;
}

header('Content-Type: video/x-ms-wmv');
header('Content-Length: '.filesize($_GET['v'].'.wmv'));

readfile($_GET['v'].'.wmv');
?>

But this example don't print the 1 and don't play the video:

<?php
session_start();

if ($_SESSION['id'] != md5($_GET['v'])) {
	echo 1;
	exit;
}

header('Content-Type: video/x-ms-wmv');
header('Content-Length: '.filesize($_GET['v'].'.wmv'));

readfile($_GET['v'].'.wmv');
?>

I don't understand why if I use $_SESSION and header/exit/die together the script don't work (but no erros).

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2008-11-13 17:38 UTC] lito at eordes dot com
I have uploaded this examples, pleass add simplifica.es at url start (SPAM control problems):

Source: /stream/?id=0&source=1

This don't but it will should work: /stream/?id=0

Sources: /stream/stream0.php?v=video&source=1

This print 1 at stream start: /stream/?id=1

Source: /stream/stream1.php?v=video&source=1

This works but doesn't check session var: /stream/?id=2

Source: /stream/stream2.php?v=video&source=1

This works but doesn't stop if the ckeck fail: /stream/?id=3

Source: /stream/stream3.php?v=video&source=1

This doesn't work but it will should work: /stream/?id=4

Source: /stream/stream4.php?v=video&source=1

Which one can you see correctly?

Thanks.
 [2009-02-18 21:27 UTC] jani@php.net
Please try using this CVS snapshot:

  http://snaps.php.net/php5.2-latest.tar.gz
 
For Windows:

  http://windows.php.net/snapshots/


 [2009-02-26 01:00 UTC] php-bugs at lists dot php dot net
No feedback was provided for this bug for over a week, so it is
being suspended automatically. If you are able to provide the
information that was originally requested, please do so and change
the status of the bug back to "Open".
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Fri Apr 19 18:01:28 2024 UTC