phplib-users

[phplib-users] Session url() method

[Lindsay H. <fmo...@fm...>]

I note that the session4.inc module in phplib defers to PHP4's native session 
management and URL rewriting in the url() method.  There's one shortcoming of 
this implementation.  As the PHP documentation states, if session.use_trans_sid 
is set,  "_relative_ URIs will be changed to contain the session id 
automatically." (emphasis mine)

Formerly if one were to set $sess->mode to "get", the url() method could be 
used to append the SID to both relative and absolute URIs.  This is no longer 
possible for absolute URIs, and I had to patch session4.inc with code from the 
older session.inc to restore this functionality.

This comes up very specifically in an e-commerce situation where it's necessary 
to link to a secure page on the same server to collect customer info.  For 
instance, a shopping catalog page may be at http://www.vendor.com/catalog.php, 
but the checkout page may be at https://secure.webhost.com/vendor/checkout.php.  
If a session cookie is set in the catalog page, the secure checkout page falls 
outside the cookie domain and so session continuity is lost.  The logical 
solution here is to put the session name and SID into the URL as GET data.

It's probably possible to use a call to setcookie() to work around this, but 
the behavior expected in previous versions of the url() session method is no 
longer supported.

-- 
Lindsay Haisley       | "Fighting against human |     PGP public key
FMP Computer Services |    creativity is like   |      available at
512-259-1190          |    trying to eradicate  | <http://pubkeys.fmp.com>
http://www.fmp.com    |        dandelions"      |
                      |      (Pamela Jones)     |

Re: [phplib-users] Session url() method

[Layne W. <la...@dr...>]

Lindsay Haisley wrote:
>Formerly if one were to set $sess->mode to "get", the url()
>method could be used to append the SID to both relative and
>absolute URIs.  This is no longer possible for absolute URIs,
>and I had to patch session4.inc with code from the older
>session.inc to restore this functionality.

If you would send the patch, I or one of the other core can look at
it and commit this change to CVS.

--=20

Layne Weathers

Re: [phplib-users] Session url() method

[Lindsay H. <fmo...@fm...>]

Thus spake Layne Weathers on Sat, Dec 16, 2006 at 02:39:21PM CST
> Lindsay Haisley wrote:
> >Formerly if one were to set $sess->mode to "get", the url()
> >method could be used to append the SID to both relative and
> >absolute URIs.  This is no longer possible for absolute URIs,
> >and I had to patch session4.inc with code from the older
> >session.inc to restore this functionality.
> 
> If you would send the patch, I or one of the other core can look at
> it and commit this change to CVS.

I'll take a look at it some more.  I hacked what I needed into session4.inc and 
it works for my purposes but I need to make sure any patch I send is solid.  
Basically, for a first approximation, I simply inserted a bit of code from 
session.inc.


--- /usr/share/phplib/session4.inc	2005-12-06 18:55:50.000000000 -0600
+++ session4.inc	2006-12-15 12:22:38.000000000 -0600
@@ -389,6 +389,15 @@
       $url .= ( strpos($url, "?") != false ?  "&" : "?" ) . urlencode($this->name) . "=" . $this->id;
     }
 
+    switch ($this->mode) {
+      case "get":
+        $url .= ( strpos($url, "?") != false ?  "&" : "?" ).
+                urlencode($this->name)."=".$this->id;
+      break;
+      default:
+        ;
+      break;
+    }
     // Encode naughty characters in the URL
     $url = str_replace(array("<", ">", " ", "\"", "'"), 
                        array("%3C", "%3E", "+", "%22", "%27"), $url);


There are issues in the application I'm using this in with the SID getting set 
twice (in duplicate) in the URL, so I have to find out if that's my cart 
implementation, or my patch, or what.  The duplication doesn't harm things 
functionally, but it's messy and I don't want to submit a patch that doesn't do 
the Right Thing, and cleanly :-)

-- 
Lindsay Haisley       | "Fighting against human |     PGP public key
FMP Computer Services |    creativity is like   |      available at
512-259-1190          |    trying to eradicate  | <http://pubkeys.fmp.com>
http://www.fmp.com    |        dandelions"      |
                      |      (Pamela Jones)     |