note 72102 deleted from function.header by nlopess
| From: | nlopess@php.net | Date: | Tue, 02 Jan 2007 23:21:17 +0000 |
| Subject: | note 72102 deleted from function.header by nlopess | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-121209@lists.php.net to get a copy of this message | ||
Note Submitter: Buckwheat469 at hotmail dot com
----
The header function does not always reset the $_SERVER['HTTP_REFERER'] variable in Windows
installations (PHP version 5.1.4).
<?php header('Location: index.php'); //this doesn't reset the HTTP_REFERER
variable!!!! ?>
From the above code, any page beyond index.php should have the HTTP_REFERER set to index.php. This
is used in login scripts that check for session variables, then redirect from a page like index.php
to a login page, then from the login page back to the referring page.
Below is an example of the problem process, a solution follows.
The $_SERVER['HTTP_REFERER'] is 'update_website.php'.
<?php //logout.php
session_start();
if(isset($_SESSION['lag']) && isset($_SESSION['password'])){
unset($_SESSION['lag']);
unset($_SESSION['password']);
unset($_SESSION['authenticatedUser']);
// kill session variables
$_SESSION = array(); // reset session array
session_destroy(); // destroy session.
header('Location: index.php'); //this doesn't reset the HTTP_REFERER variable!!!!
// redirect them to anywhere you like.
}else{
header('Location: index.php');
}
exit;
?>
<?php //index.php
session_start();
if(!isset($_SESSION['athenticatedUser']) ||
!isset($_SESSION['lag']) ||
!isset($_SESSION['password'])){
header("Location: login.php");
}
?>
Login.php contains the login form.
<input type="hidden" name="referrer" value="
<?php echo
(isset($_SERVER['HTTP_REFERER'])?$_SERVER['HTTP_REFERER']:'-');
?>">
<?php //login.php
if($_POST['referrer'] !=
($_SERVER['HTTPS'] == 'on'?'https':'http').
"://".$_SERVER['HTTP_HOST'].$_SERVER['PHP_SELF']
&& $_POST['referrer'] != "-"){
header("Location: ".$_POST['referrer']);
$error = false;
}
?>
The login.php page will forward the user back to update_website.php, not index.php which was
expected.
The fix is to use Javascript within the logout.php page.
<?php //logout.php
if(isset($_SESSION['lag']) && isset($_SESSION['password'])){
unset($_SESSION['lag']);
unset($_SESSION['password']);
unset($_SESSION['authenticatedUser']);
// kill session variables
$_SESSION = array(); // reset session array
session_destroy(); // destroy session.
echo '<script>
window.location.href="index.php";
</script>';
//header('Location: index.php'); //this doesn't reset the HTTP_REFERER variable!!!!
// redirect them to anywhere you like.
}