Re[6]: [PEAR] session cross between users?

Sorry, forgot the last question in my last message. I was not seen the TreeMenu package in 'pear list' but it's in. Friday, November 19, 2004, 11:21:08 AM, vas escriure: LM> Hi again!, LM> Now I think that the problem is in the TreeMenuObject. We have a LM> tremenu object (in a frame) which loads every link in other frame. LM> When 2 users make click at the same time (aprox) the last user that receive LM> the page receive the page of the first. The first receive too his LM> page. Is the second user that have the problem. LM> Perhaps a bug of HTML_TreeMenu package? I have viewed the bug list and LM> not found any thing similar to this problem. LM> Another question. Why when I write 'pear list' the HTML_TreeMenu LM> Package is not listed? LM> Thanks again LM> Friday, November 19, 2004, 9:27:55 AM, vas escriure: LM>> Hi!, LM>> I'm using file based php sessions under php5. LM>> The thing surprised my is that we are talking about this problem LM>> 'quitely' and I think is a very serious problem that php would have LM>> resolved. Perhaps I don't understand the base of problem and my LM>> session handler code is bad but I think is a php session system LM>> responsability. LM>> Sorry about my poor english. LM>> Thanks. LM>> Thursday, November 18, 2004, 11:30:09 PM, vas escriure: JP>>> On Thu, 18 Nov 2004 23:09:25 +0100 (CET), leo@calidae.net JP>>> <leo@calidae.net> wrote: >>>> Well, I'm using Auth to validate users in my application. >>>> The solution that says Justin means that every time I have a cross session >>>> now forces a logout in the application? JP>>> It should be possible to not force a logout, but I couldn't find it JP>>> quickly. If you do some more research on creating a new session you JP>>> should be able to do it. You could also use PEAR's HTTP_Session. >>>> Is it , this is not the solution I >>>> need. I want that the user don't have a cross session and continue with >>>> his session. Another matter is that my php session timeout is too small. JP>>> So turn it up. It's a setting in the php.ini. >>>> I'm thinking change the Auth mechanism to a LiveUser autentication system. >>>> Do you reccomend it? My problems can disappear if I use LiveUser and not >>>> Auth? JP>>> No idea, sorry. If the problem is with the PHP session handler, JP>>> changing to a different system is unlikely to help. JP>>> Are you using the normal file-based PHP sessions or DB sessions? >>>> >>>> Thanks >>>> >>>> >>>> >>>> > On Thu, 18 Nov 2004 21:02:21 -0000, subs <subs@snackfood.org> wrote: >>>> >> >>>> >> >>>> >> > On Thu, 18 Nov 2004 14:04:32 -0500, Erik Heerlein >>>> >> > <erik@erikheerlein.com> wrote: >>>> >> > > That IP validation may be a problem if the user is on a AOL >>>> >> > account as >>>> >> > > an AOL users IP can change on the fly. >>>> >> > > >>>> >> > >>>> >> > Are you absolutely sure of that? Dial-up users' IPs can >>>> >> > change between dial-ups, but I doubt they're going to change >>>> >> > on-the-fly. If they did, the internet simply wouldn't work. >>>> >> > >>>> >> > Unless, of course, they're using some kind of round-robin >>>> >> > proxy system, but usually a user gets directed to one and >>>> >> > stays there for the entire session. >>>> >> > >>>> >> >>>> >> Some proxy clusters will often present a number of different addresses >>>> >> to a >>>> >> remote server during a session. Any authentication/authorization >>>> >> mechanism >>>> >> which relies on REMOTE_ADDR is generally a bad idea IMHO. >>>> >> You could add a user_id field to your sessions table and do the >>>> >> equivalent >>>> >> of "DELETE FROM sessions WHERE user_id = <user_id> AND >>>> >> session_id != >>>> >> <new_session_id>" after each successful login (assuming >>>> >> you're using a >>>> >> DB >>>> >> session store). Shouldn't be too hard to hook this in somewhere. >>>> >> >>>> > >>>> > Yeah, but the point is that the session is being hijacked. If this is >>>> > the case, it's almost certain that the user has the same session >>>> > cookie/id, so this wouldn't help. >>>> > >>>> > -- >>>> > Justin Patrin >>>> > >>>> > -- >>>> >>>> >>>> > PEAR General Mailing List (http://pear.php.net/) >>>> > To unsubscribe, visit: >>>> > http://www.php.net/unsub.php >>>> > >>>> > >>>> JP>>> -- JP>>> Justin Patrin LM>> -- LM>> Salutacions, LM>> Leo Márquez LM>> [ Enginyeria del software / Internet ] LM>> [ Calidae - www.calidae.com ] LM> -- LM> Salutacions, LM> Leo Márquez LM> [ Enginyeria del software / Internet ] LM> [ Calidae - www.calidae.com ] -- Salutacions, Leo Márquez [ Enginyeria del software / Internet ] [ Calidae - www.calidae.com ]