note 72102 added to function.header
| From: | Buckwheat469 at hotmail dot com | Date: | Tue, 02 Jan 2007 23:17:21 +0000 |
| Subject: | note 72102 added to function.header | ||
| Groups: | php.notes | ||
| Request: | Send a blank email to php-notes+get-121207@lists.php.net to get a copy of this message | ||
The header function does not always reset the $_SERVER['HTTP_REFERER'] variable in Windows
installations (PHP version 5.1.4).
<?php header('Location: index.php'); //this doesn't reset the HTTP_REFERER
variable!!!! ?>
From the above code, any page beyond index.php should have the HTTP_REFERER set to index.php. This
is used in login scripts that check for session variables, then redirect from a page like index.php
to a login page, then from the login page back to the referring page.
Below is an example of the problem process, a solution follows.
The $_SERVER['HTTP_REFERER'] is 'update_website.php'.
<?php //logout.php
session_start();
if(isset($_SESSION['lag']) && isset($_SESSION['password'])){
unset($_SESSION['lag']);
unset($_SESSION['password']);
unset($_SESSION['authenticatedUser']);
// kill session variables
$_SESSION = array(); // reset session array
session_destroy(); // destroy session.
header('Location: index.php'); //this doesn't reset the HTTP_REFERER variable!!!!
// redirect them to anywhere you like.
}else{
header('Location: index.php');
}
exit;
?>
<?php //index.php
session_start();
if(!isset($_SESSION['athenticatedUser']) ||
!isset($_SESSION['lag']) ||
!isset($_SESSION['password'])){
header("Location: login.php");
}
?>
Login.php contains the login form.
<input type="hidden" name="referrer" value="
<?php echo
(isset($_SERVER['HTTP_REFERER'])?$_SERVER['HTTP_REFERER']:'-');
?>">
<?php //login.php
if($_POST['referrer'] !=
($_SERVER['HTTPS'] == 'on'?'https':'http').
"://".$_SERVER['HTTP_HOST'].$_SERVER['PHP_SELF']
&& $_POST['referrer'] != "-"){
header("Location: ".$_POST['referrer']);
$error = false;
}
?>
The login.php page will forward the user back to update_website.php, not index.php which was
expected.
The fix is to use Javascript within the logout.php page.
<?php //logout.php
if(isset($_SESSION['lag']) && isset($_SESSION['password'])){
unset($_SESSION['lag']);
unset($_SESSION['password']);
unset($_SESSION['authenticatedUser']);
// kill session variables
$_SESSION = array(); // reset session array
session_destroy(); // destroy session.
echo '<script>
window.location.href="index.php";
</script>';
//header('Location: index.php'); //this doesn't reset the HTTP_REFERER variable!!!!
// redirect them to anywhere you like.
}
----
Server IP: 64.71.164.2
Probable Submitter: 70.90.177.114
----
Manual Page -- http://www.php.net/manual/en/function.header.php
Edit -- https://master.php.net/note/edit/72102
Del: integrated -- https://master.php.net/note/delete/72102/integrated
Del: useless -- https://master.php.net/note/delete/72102/useless
Del: bad code -- https://master.php.net/note/delete/72102/bad+code
Del: spam -- https://master.php.net/note/delete/72102/spam
Del: non-english -- https://master.php.net/note/delete/72102/non-english
Del: in docs -- https://master.php.net/note/delete/72102/in+docs
Del: other reasons-- https://master.php.net/note/delete/72102
Reject -- https://master.php.net/note/reject/72102
Search -- https://master.php.net/manage/user-notes.php