Login problemos

[Sniffer-Dog]

Hi

I just wondered if anyone can spot anything wrong with the following?
I have now added the session_start() ; as the first command in the code
to all the pages needing it.

When I click on a webpage that is restricted, it takes me to the login
page fine. When I login though instead of taking me to the page I
clicked previous to that, it always takes me to the index file, and
when I try to then click on the page I wanted to go to, it takes me
back to the login page. I think something must be wrong with my
coding, unless of course there is still a session related problem?

Thanks for any help on this one.

John





<?php
// *** Validate request to login to this site.
session_start() ;
?>

<?php require_once('C onnections/conn_newland.ph p'); ?>

<?php
$logarIthmIcal = $_SERVER['PHP_SELF'];
if (isset($accessc heck)) {
$GLOBALS['PrevUrl'] = $accesscheck;
session_registe r('PrevUrl');
}

if (isset($_POST['username'])) {
$loginUsername= $_POST['username'];
$password=$_POS T['pwd'];
$MM_fldUserAuth orization = "userGroup" ;
$MM_redirectLog inSuccess = "index.php" ;
$MM_redirectLog inFailed = "login_failed.p hp";
$MM_redirecttoR eferrer = true;
mysql_select_db ($database_conn _newland, $conn_newland);

$LoginRS__query =sprintf("SELEC T username, pwd, userGroup FROM
tbl_users WHERE username='%s' AND pwd='%s'",
get_magic_quote s_gpc() ? $loginUsername :
addslashes($log inUsername), get_magic_quote s_gpc() ? $password :
addslashes($pas sword));

$LoginRS = mysql_query($Lo ginRS__query, $conn_newland) or
die(mysql_error ());
$loginFoundUser = mysql_num_rows( $LoginRS);
if ($loginFoundUse r) {

$loginStrGroup = mysql_result($L oginRS,0,'userG roup');

//declare two session variables and assign them
$GLOBALS['MM_Username'] = $loginUsername;
$GLOBALS['MM_UserGroup'] = $loginStrGroup;

//register the session variables
session_registe r("MM_Username" );
session_registe r("MM_UserGroup ");

if (isset($_SESSIO N['PrevUrl']) && true) {
$MM_redirectLog inSuccess = $_SESSION['PrevUrl'];
}
header("Locatio n: " . $MM_redirectLog inSuccess );
}
else {
header("Locatio n: ". $MM_redirectLog inFailed );
}
}
?>

[Geoff Berrow]

Re: Login problemos

I noticed that Message-ID: <m4etg0pqfruov3 lg6dejt4lo46bp9 oh0cl@4ax.com>
from Sniffer-Dog contained the following:
[color=blue]
> //declare two session variables and assign them
> $GLOBALS['MM_Username'] = $loginUsername;
> $GLOBALS['MM_UserGroup'] = $loginStrGroup;
>
> //register the session variables
> session_registe r("MM_Username" );
> session_registe r("MM_UserGroup ");[/color]

I thought use of session_registe r() was not recommended BICBW

You can just do
$_SESSION['MM_Username'] = $loginUsername;
$_SESSION['MM_UserGroup'] = $loginStrGroup;

since $_SESSION is a superglobal array.[color=blue]
>[/color]
--
Geoff Berrow (put thecat out to email)
It's only Usenet, no one dies.
My opinions, not the committee's, mine.
Simple RFDs http://www.ckdog.co.uk/rfdmaker/

[Sniffer-Dog]

Re: Login problemos

On Tue, 03 Aug 2004 08:27:17 +0100, A strange species called Geoff
Berrow <blthecat@ckdog .co.uk> wrote:
[color=blue]
>I noticed that Message-ID: <m4etg0pqfruov3 lg6dejt4lo46bp9 oh0cl@4ax.com>
>from Sniffer-Dog contained the following:
>[color=green]
>> //declare two session variables and assign them
>> $GLOBALS['MM_Username'] = $loginUsername;
>> $GLOBALS['MM_UserGroup'] = $loginStrGroup;
>>
>> //register the session variables
>> session_registe r("MM_Username" );
>> session_registe r("MM_UserGroup ");[/color]
>
>I thought use of session_registe r() was not recommended BICBW
>
>You can just do
>$_SESSION['MM_Username'] = $loginUsername;
>$_SESSION['MM_UserGroup'] = $loginStrGroup;
>
>since $_SESSION is a superglobal array.[color=green]
>>[/color][/color]

I've been told you need session_start() ; on the top line of every
page?

It makes no difference though if I comment it all out, the results are
exactly the same. Login takes you to index not the page you wanted to
goto before you logged in, and even if you click that page after it
takes you back to login :(

There must be something else wrong with the code or my settings?

John

[Geoff Berrow]

Re: Login problemos

I noticed that Message-ID: <avlvg059dm4uq3 rl0gr3t8an1am0g r31ls@4ax.com>
from Sniffer-Dog contained the following:
[color=blue]
>
>I've been told you need session_start() ; on the top line of every
>page?[/color]

Yes.[color=blue]
>
>It makes no difference though if I comment it all out, the results are
>exactly the same. Login takes you to index not the page you wanted to
>goto before you logged in,[/color]

OK, let's break it down:

<?php
//this must be the top line

session_start() ;
?>

<?php require_once('C onnections/conn_newland.ph p'); ?>

<?php
$logarIthmIcal = $_SERVER['PHP_SELF'];
//sets $logarIthmIcal to the URL of this page. Goodness knows why...

if (isset($accessc heck))
//hang on - where has this variable come from?

{
$GLOBALS['PrevUrl'] = $accesscheck;
session_registe r('PrevUrl');
}
/*Well it looks like it should be the URL of the page you wanted to go
to. But how does it get into this script?
*/

if (isset($_POST['username'])) {
$loginUsername= $_POST['username'];
$password=$_POS T['pwd'];
$MM_fldUserAuth orization = "userGroup" ;
$MM_redirectLog inSuccess = "index.php" ;
$MM_redirectLog inFailed = "login_failed.p hp";
$MM_redirecttoR eferrer = true;
//initialise some variables

mysql_select_db ($database_conn _newland, $conn_newland);

$LoginRS__query =sprintf("SELEC T username, pwd, userGroup FROM
tbl_users WHERE username='%s' AND pwd='%s'",
get_magic_quote s_gpc() ? $loginUsername :
addslashes($log inUsername), get_magic_quote s_gpc() ? $password :
addslashes($pas sword));

$LoginRS = mysql_query($Lo ginRS__query, $conn_newland) or
die(mysql_error ());
//query database

$loginFoundUser = mysql_num_rows( $LoginRS);
/*set $loginFoundUser to true if we find a row with username and
password
*/

if ($loginFoundUse r) {

$loginStrGroup = mysql_result($L oginRS,0,'userG roup');
//get the contents of the usergroup for the user

//declare two session variables and assign them
$GLOBALS['MM_Username'] = $loginUsername;
$GLOBALS['MM_UserGroup'] = $loginStrGroup;

//register the session variables
session_registe r("MM_Username" );
session_registe r("MM_UserGroup ");

if (isset($_SESSIO N['PrevUrl']) && true)
/*not sure what that && true does but $_SESSION['PrevUrl'] was set to
$accesscheck earlier. Remember? The variable of unknown origin - the
page you wanted to go to?
*/
{
$MM_redirectLog inSuccess = $_SESSION['PrevUrl'];
}
header("Locatio n: " . $MM_redirectLog inSuccess );
/*So - if you are being sent to index.htm then clearly
$_SESSION['PrevUrl'] has not been set. This is where you need to look
for the problem. Good luck.

*/
}
else {
header("Locatio n: ". $MM_redirectLog inFailed );
}
}
?>
--
Geoff Berrow (put thecat out to email)
It's only Usenet, no one dies.
My opinions, not the committee's, mine.
Simple RFDs http://www.ckdog.co.uk/rfdmaker/

[Sniffer-Dog]

Re: Login problemos

On Tue, 03 Aug 2004 21:12:30 +0100, A strange species called Geoff
Berrow <blthecat@ckdog .co.uk> wrote:
[color=blue]
>I noticed that Message-ID: <avlvg059dm4uq3 rl0gr3t8an1am0g r31ls@4ax.com>
>from Sniffer-Dog contained the following:
>[color=green]
>>
>>I've been told you need session_start() ; on the top line of every
>>page?[/color]
>
>Yes.[color=green]
>>
>>It makes no difference though if I comment it all out, the results are
>>exactly the same. Login takes you to index not the page you wanted to
>>goto before you logged in,[/color]
>
>OK, let's break it down:
>
><?php
>//this must be the top line
>
>session_start( );
>?>
>
><?php require_once('C onnections/conn_newland.ph p'); ?>
>
><?php
>$logarIthmIc al = $_SERVER['PHP_SELF'];
>//sets $logarIthmIcal to the URL of this page. Goodness knows why...
>
>if (isset($accessc heck))
>//hang on - where has this variable come from?[/color]

I think this comes from the previous page?
[color=blue]
>{
> $GLOBALS['PrevUrl'] = $accesscheck;
> session_registe r('PrevUrl');
>}
>/*Well it looks like it should be the URL of the page you wanted to go
>to. But how does it get into this script?
>*/
>
>if (isset($_POST['username'])) {
> $loginUsername= $_POST['username'];
> $password=$_POS T['pwd'];
> $MM_fldUserAuth orization = "userGroup" ;
> $MM_redirectLog inSuccess = "index.php" ;
> $MM_redirectLog inFailed = "login_failed.p hp";
> $MM_redirecttoR eferrer = true;
>//initialise some variables
>
> mysql_select_db ($database_conn _newland, $conn_newland);
>
> $LoginRS__query =sprintf("SELEC T username, pwd, userGroup FROM
>tbl_users WHERE username='%s' AND pwd='%s'",
> get_magic_quote s_gpc() ? $loginUsername :
>addslashes($lo ginUsername), get_magic_quote s_gpc() ? $password :
>addslashes($pa ssword));
>
> $LoginRS = mysql_query($Lo ginRS__query, $conn_newland) or
>die(mysql_erro r());
>//query database
>
> $loginFoundUser = mysql_num_rows( $LoginRS);
>/*set $loginFoundUser to true if we find a row with username and
>password
>*/
>
> if ($loginFoundUse r) {
>
> $loginStrGroup = mysql_result($L oginRS,0,'userG roup');
> //get the contents of the usergroup for the user
>
> //declare two session variables and assign them
> $GLOBALS['MM_Username'] = $loginUsername;
> $GLOBALS['MM_UserGroup'] = $loginStrGroup;
>
> //register the session variables
> session_registe r("MM_Username" );
> session_registe r("MM_UserGroup ");
>
> if (isset($_SESSIO N['PrevUrl']) && true)
>/*not sure what that && true does but $_SESSION['PrevUrl'] was set to
>$accesscheck earlier. Remember? The variable of unknown origin - the
>page you wanted to go to?
>*/
>{
> $MM_redirectLog inSuccess = $_SESSION['PrevUrl'];
> }
> header("Locatio n: " . $MM_redirectLog inSuccess );
>/*So - if you are being sent to index.htm then clearly
>$_SESSION['PrevUrl'] has not been set. This is where you need to look
>for the problem. Good luck.
>
>*/[/color]

Geoff

If I try to access a restricted page it looks like it is trying to
pass the info to the login page via the URL but somehow not setting
it? Even if it is redirecting to the index there still may be a
problem. If I had logged in successfully surely it should then allow
me into the page I wanted to goto before, if I then click it after
going back to the index because I am logged in? Maybe their is a
problem with the login itself?

This is the info in the URL after I try access profiles.php a
restricted page which takes me to login.php

http://localhost/newland/login.php?accesscheck=%2Fnewland%2Fprofiles.php

Below is the php code from the profiles.php page:



<?php
// *** Validate request to login to this site.
//session_start() ;
?>


<?php
// Report all PHP errors (bitwise 63 may be used in PHP 3)
error_reporting (E_ALL);
?>


<?php require_once('C onnections/conn_newland.ph p'); ?>

<?php
$MM_authorizedU sers = "visitor,admin" ;
$MM_donotChecka ccess = "false";

// *** Restrict Access To Page: Grant or deny access to this page
function isAuthorized($s trUsers, $strGroups, $UserName, $UserGroup) {
// For security, start by assuming the visitor is NOT authorized.
$isValid = False;

// When a visitor has logged into this site, the Session variable
MM_Username set equal to their username.
// Therefore, we know that a user is NOT logged in if that Session
variable is blank.
if (!empty($UserNa me)) {
// Besides being logged in, you may restrict access to only
certain users based on an ID established when they login.
// Parse the strings into arrays.
$arrUsers = Explode(",", $strUsers);
$arrGroups = Explode(",", $strGroups);
if (in_array($User Name, $arrUsers)) {
$isValid = true;
}
// Or, you may restrict access to only certain users based on
their username.
if (in_array($User Group, $arrGroups)) {
$isValid = true;
}
if (($strUsers == "") && false) {
$isValid = true;
}
}
return $isValid;
}

$MM_restrictGoT o = "login.php" ;
if (!((isset($_SES SION['MM_Username'])) &&
(isAuthorized(" ",$MM_authorize dUsers, $_SESSION['MM_Username'],
$_SESSION['MM_UserGroup'])))) {
$MM_qsChar = "?";
$MM_referrer = $_SERVER['PHP_SELF'];
if (strpos($MM_res trictGoTo, "?")) $MM_qsChar = "&";
if (isset($QUERY_S TRING) && strlen($QUERY_S TRING) > 0)
$MM_referrer .= "?" . $QUERY_STRING;
$MM_restrictGoT o = $MM_restrictGoT o. $MM_qsChar . "accesschec k=" .
urlencode($MM_r eferrer);
header("Locatio n: ". $MM_restrictGoT o);
exit;
}
?>
<?php
mysql_select_db ($database_conn _newland, $conn_newland);
$query_rs_tourN ames = "SELECT countryID, countryName FROM tbl_country
ORDER BY countryName ASC";
$rs_tourNames = mysql_query($qu ery_rs_tourName s, $conn_newland) or
die(mysql_error ());
$row_rs_tourNam es = mysql_fetch_ass oc($rs_tourName s);
$totalRows_rs_t ourNames = mysql_num_rows( $rs_tourNames);
?>


Maybe you can spot what any error might be?

John