Re: am i just a session tracking idiot?

I am my ISP. I'm running PHP 4.2.1 and Apache 1.3.24. session configurables in php.ini are as follows... mars:~/apache/htdocs/test.radom.org$ grep session /usr/local/lib/php.ini session.save_handler = files ; variable in order to use PHP's session functions. session.save_path = /foo session.use_cookies = 0 ; Name of the session (used as cookie name). session.name = PHPSESSID ; Initialize session on request startup. session.auto_start = 1 session.cookie_lifetime = 0 session.cookie_path = / session.cookie_domain = session.serialize_handler = php ; on every session initialization. session.gc_probability = 1 session.gc_maxlifetime = 1440 ; HTTP_REFERER has to contain this substring for the session to be session.referer_check = session.entropy_length = 0 ; Specified here to create the session id. session.entropy_file = ;session.entropy_length = 16 ;session.entropy_file = /dev/urandom session.cache_limiter = nocache session.cache_expire = 180 session.use_trans_sid = 1 Apache runs as "nobody" and the permissions on session.save_handler are "drwxrwxrwx 2 nobody 2048 Jun 6 16:31 foo/" I also have "register_globals = On" set in php.ini. This should be working! $@%%!@ dan * Shane Wright (me@shanewright.co.uk) wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > Hi > > On Thursday 06 June 2002 7:55 pm, dan radom wrote: > > the last bgcolor example was cut and pasted from oreilly's session tracking > > examples. it should work. > > IIRC, some things depend on your PHP version and ini file (register_globals, > track_vars and maybe others). its worth trying those definately. The manual > also says that $_SESSION is only available after 4.1.0 - if you're using an > older version try $HTTP_SESSION_VARS. > > > that file write error concerns me. i think > > something larger is going on here. > > Definately - if all else fails it could be worth upgrading PHP (if your ISP > won't let you, maybe they've seen the problem before?). > > Ah! What user is your web server running as? Try creating a new user, > running the web server as that user (group as well come to think of it), and > trying the permissions with that). I'm not sure why this should make a > difference but it rings bells for some reason (can't remember enough offhand > about UNIX users/permissions). > > Cheers > > - -- > Shane > www.shanewright.co.uk > Public Key: http://www.shanewright.co.uk/files/public_key.asc > > > * Chris Knipe (savage@savage.za.org) wrote: > > > Have you tried using $_SESSION['bgcolor'] = "bleh" > > > > > > It might work... who knows... > > > > > > ----- Original Message ----- > > > From: "dan radom" <dan@radom.org> > > > To: <php-general@lists.php.net> > > > Sent: Thursday, June 06, 2002 8:36 PM > > > Subject: Re: [PHP] am i just a session tracking idiot? > > > > > > > what's weird is that if i set session.save_handler = mm, i obviously > > > > don't > > > > > > get the file error, but it still won't work. > > > > > > > here's another example of what i've tried... > > > > > > > > mars:~/apache/htdocs/test.radom.org$ cat test.php > > > > <? > > > > // create a new session > > > > session_start(); > > > > > > > > // register a session-variable > > > > session_register("bgcolor"); > > > > > > > > // Assign a value to the session-variable > > > > $bgcolor = "#8080ff"; > > > > ?> > > > > <html> > > > > <head> > > > > <title>Session Example #1</title> > > > > </head> > > > > > > > > <body bgcolor="<?=$bgcolor?>" text="#000000" > > > > link="#000000" > > > > > > vlink="#000000" alink="#000000"> > > > > > > > Welcome to a session-enabled page! The background color on the next > > > > page > > > > > > will be set to a stylish blue.<p> > > > > > > > <a href = "test2.php">Go to another session-enabled > > > > page</a>. > > > > </body> > > > > </html> > > > > > > > > and > > > > > > > > mars:~/apache/htdocs/test.radom.org$ cat test2.php > > > > <? > > > > // Resume session created in Listing 1-2 > > > > session_start(); > > > > ?> > > > > <html> > > > > <head> > > > > <title>Session Example #1</title> > > > > </head> > > > > > > > > <body bgcolor="<?=$bgcolor?>" text="#000000" > > > > link="#808040" > > > > > > vlink="#606060" alink="#808000"> > > > > > > > <? > > > > // Retrieve SID from cookie. > > > > print "Your SID is $PHPSESSID <br>"; > > > > > > > > // Display the value of the $bgcolor variable. > > > > print "The persistent background color is: $bgcolor."; > > > > ?> > > > > > > > > > > > > argggh! > > > > > > > > * dan radom (dan@radom.org) wrote: > > > > > I've just tried that. /foo is owned by nobody and is mode 777. > > > > > there's > > > > > > 135M available on that partition. > > > > > > > > * Shane Wright (me@shanewright.co.uk) wrote: > > > > > > -----BEGIN PGP SIGNED MESSAGE----- > > > > > > Hash: SHA1 > > > > > > > > > > > > Hi > > > > > > > > > > > > This may sound silly - but is there enough free disk space on > > > > > > whatever partition /tmp is mounted on? > > > > > > > > > > > > Alternatively, as a workaround, you could create a new directory > > > > > > and > > > > > > give the > > > > > > > > > web server user permission to write to it and tell PHP to save > > > > > > sessions > > > > > > > > > there. (this is actually better from a security standpoint as > > > > > > well; > > > > > > less > > > > > > > > > chance of session hijacking). > > > > > > > > > > > > Cheers > > > > > > > > > > > > - -- > > > > > > Shane > > > > > > www.shanewright.co.uk > > > > > > Public Key: > > > > > > http://www.shanewright.co.uk/files/public_key.asc > > > > > > > > > > > > On Thursday 06 June 2002 6:31 pm, dan radom wrote: > > > > > > > I can't seem to get session tracking to work to save my > > > > > > > life. > > > > > > > The > > > > > > end > > > > > > > > > > result I'm after is to store the value of the single column > > > > > > > returned > > > > > > from > > > > > > > > > > this query .. SELECT user_id from users WHERE user_name = > > > > > > '$user_name' AND > > > > > > > > > > user_password = '$user_password' .. for use throughout > > > > > > > the site. > > > > > > The > > > > > > > > > > current error I'm getting is "Warning: Failed to write > > > > > > > session > > > > > > > data (files). Please verify that the current setting of > > > > > > > session.save_path > > > > > > is > > > > > > > > > > correct (/tmp) in Unknown on line 0" which is very strange, > > > > > > > as > > > > > > > session.save_path is set to /tmp, and tmp is "drwxrwxrwt > > > > > > > 2 > > > > > > > root root". The code is listed below. Any suggestions are > > > > > > > greatly > > > > > > appreciated. > > > > > > > > > > dan > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > <? > > > > > > > > > > > > > > // if ($user_name) { > > > > > > > // class 'new uid' { var $row->user_id; }; > > > > > > > // start_session(); > > > > > > > // $abqSession = new abqnl; > > > > > > > // $abqSession->user_id = $uid; > > > > > > > // session_register("abqSession"); > > > > > > > // } > > > > > > > > > > > > > > if ($user_name) { > > > > > > > session_id($_GET['user_id']); > > > > > > > session_start(); > > > > > > > $foo="$row->user_id"; > > > > > > > $_SESSION["uid"] = $foo; > > > > > > > echo "$foo"; > > > > > > > } > > > > > > > > > > > > > > > > > > > > > include > > > > > > > '/storage/apache/htdocs/test.radom.org/.siteconf.php'; > > > > > > > > > > > > > > echo "<br><br>"; > > > > > > > > > > > > > > if (!$user_name) { > > > > > > > > > > > > > > echo "<center>"; > > > > > > > > > > > > > > echo "<table cellspacing=10>"; > > > > > > > echo "<tr>"; > > > > > > > > > > > > > > echo "<form method=post > > > > > > > action=\"login.php\">"; > > > > > > > > > > > > > > echo "<td align=left>"; > > > > > > > echo "user name"; > > > > > > > echo "</td>"; > > > > > > > > > > > > > > echo "<td align=left>"; > > > > > > > echo "<input size=12 > > > > > > > name=\"user_name\">"; > > > > > > > echo "</td>"; > > > > > > > > > > > > > > echo "</tr>"; > > > > > > > echo "<tr>"; > > > > > > > > > > > > > > echo "<td align=left>"; > > > > > > > echo "password"; > > > > > > > echo "</td>"; > > > > > > > > > > > > > > echo "<td align=left>"; > > > > > > > echo "<input type=\"password\" size=12 > > > > > > > name=\"user_password\">"; echo > > > > > > > "</td>"; > > > > > > > > > > > > > > echo "</tr>"; > > > > > > > echo "<tr>"; > > > > > > > > > > > > > > echo "<td>"; > > > > > > > echo "</td>"; > > > > > > > > > > > > > > echo "<td align=left>"; > > > > > > > echo "<center>"; > > > > > > > echo "<input type = \"submit\" > > > > > > > value=\"submit\">"; > > > > > > > echo "</center>"; > > > > > > > echo "</td>"; > > > > > > > > > > > > > > echo "</form>"; > > > > > > > > > > > > > > echo "</tr>"; > > > > > > > echo "</table>"; > > > > > > > > > > > > > > echo "</center>"; > > > > > > > > > > > > > > exit; > > > > > > > > > > > > > > } else > > > > > > > > > > > > > > $result = pg_exec ($database, "SELECT user_id from users > > > > > > > WHERE > > > > > > user_name > > > > > > > > > > = '$user_name' AND user_password = > > > > > > > '$user_password'"); > > > > > > > > > > > > > > if (!$result) { > > > > > > > echo "query died\n"; > > > > > > > exit; > > > > > > > } > > > > > > > > > > > > > > if (pg_num_rows($result) == 0) { > > > > > > > echo "<center>you have entered an invalid user name > > > > > > > and > > > > > > > password combination. please try again. new users may create an > > > > > > > account > > > > > > from the > > > > > > > > > > sign up link above.</center>"; exit; > > > > > > > } > > > > > > > > > > > > > > > > > > > > > for ($i = pg_num_rows($result) - 1; $i >= 0; $i--) { > > > > > > > if(!($row = pg_fetch_object($result))) > > > > > > > continue; > > > > > > > } > > > > > > > > > > > > > > echo "your user_id is "; > > > > > > > > > > > > > > pg_close($database); > > > > > > > > > > > > > > ?> > > > > > > > </body> > > > > > > > </html> > > > > > > > > > > > > - -- > > > > > > Shane > > > > > > www.shanewright.co.uk > > > > > > Public Key: > > > > > > http://www.shanewright.co.uk/files/public_key.asc > > > > > > -----BEGIN PGP SIGNATURE----- > > > > > > Version: GnuPG v1.0.6 (GNU/Linux) > > > > > > Comment: For info see > > > > > > http://www.gnupg.org > > > > > > > > > > > > iD8DBQE8/6S75DXg6dCMBrQRAjhVAKCcAb1x2/rWZFqtDBKQTCYb4OCmdACgmax8 > > > > > > eav61ozpEGIbHXzIYU7zt5A= > > > > > > =EIC2 > > > > > > -----END PGP SIGNATURE----- > > > > > > > > > > > > > > > > > > -- > > > > > > PHP General Mailing List (http://www.php.net/) > > > > > > To unsubscribe, visit: > > > > > > http://www.php.net/unsub.php > > > > > > > > > > -- > > > > > PHP General Mailing List (http://www.php.net/) > > > > > To unsubscribe, visit: > > > > > http://www.php.net/unsub.php > > > > > > > > -- > > > > PHP General Mailing List (http://www.php.net/) > > > > To unsubscribe, visit: > > > > http://www.php.net/unsub.php > > > > > > -- > > > PHP General Mailing List (http://www.php.net/) > > > To unsubscribe, visit: http://www.php.net/unsub.php > > - -- > Shane > www.shanewright.co.uk > Public Key: http://www.shanewright.co.uk/files/public_key.asc > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1.0.6 (GNU/Linux) > Comment: For info see http://www.gnupg.org > > iD8DBQE8/8fT5DXg6dCMBrQRAlR0AKCxNcdiDi/R0Pk1hLiCvrieAk0vIACcDvKN > jNHUiEY406RlD4OCNPsJdHw= > =mpeI > -----END PGP SIGNATURE-----