User Authentication PHP

Chrisnor wrote:
> Session data is stored in a folder phpsessiondata which is in the root
> directory of the hard drive /phpsessiondata. The folder has read/write
> permissions for everyone and the apache user group 'www' is the owner of the
> session files. Writing the files seems to work ok but not retrieving and
> reading! Should I configure something in httpd.conf? This is an apple mac
> system using enthropy php 5, which has the standard php.ini .

The Mac package from entropy.ch doesn't set a value for
session.save_path, so session files are stored by default in /var/tmp.
According to php.ini, the file storage module creates session files
using permissions of 600 by default. I've confirmed this by looking at
the session files on my Mac in Terminal. They have just read and write
permission (-rw-------), are owned by www, and the group is wheel.

Presumably you have your own reasons for wanting to change the default
location for session files, but it sounds as though you are making
things less secure by creating a folder with such an obvious name and
global read/write permissions.

I use a Mac mainly for testing purposes for my books, so don't have the
in-depth knowledge that a regular Mac/PHP user might have. However, I'm
pretty sure that changing httpd.conf would do nothing to solve your
situation. You may be better off reverting to the default location for
session files, and confirming that your pages work as expected. Then try
again with your custom setup. If it still doesn't work, asking questions
in the forum at entropy.ch may get a more knowledgeable response.

--
David Powers
Author, "Foundation PHP for Dreamweaver 8" (friends of ED)
Author, "Foundation PHP 5 for Flash" (friends of ED)
http://foundationphp.com/

The browser has cookies enabled, the server is set up with the default settings plus the ssl module. As the session is being created by the login page and the MM_username variabe inserted and then the code directs you to theprotected page as the login is valid. The problem seems to be when the protected page tries to retrieve the session variable. The protected page is creating a new session probably because it can't read from the original session created at login.

Session data is stored in a folder phpsessiondata which is in the root directory of the hard drive /phpsessiondata. The folder has read/write permissions for everyone and the apache user group 'www' is the owner of the session files. Writing the files seems to work ok but not retrieving and reading! Should I configure something in httpd.conf? This is an apple mac system using enthropy php 5, which has the standard php.ini .

Many thanks for your time and trouble

Chrisnor wrote:
> I bet you used to be in the diplomatic office didn't you Dave?

No. More than 30 years as a radio and TV journalist. So I try to choose
words carefully.

> the rest is as generated by DW. It
> hasn't been altered at all, blank sessions means that when you open the session
> file on the server it contains zilch, nada, nothing.

If the session files contain nothing, that usually means there has been
a call to $_SESSION = array();. Another possibility is that you don't
have cookies enabled in your browser. Unless you set up the server in a
special way, sessions require cookies to work.

--
David Powers
Author, "Foundation PHP for Dreamweaver 8" (friends of ED)
Author, "Foundation PHP 5 for Flash" (friends of ED)
http://foundationphp.com/

I bet you used to be in the diplomatic office didn't you Dave? I have included the code in the original post and with the exception of exit() and echo statements, which I explained previously, the rest is as generated by DW. It hasn't been altered at all, blank sessions means that when you open the session file on the server it contains zilch, nada, nothing. One session contains the MM_username variable with the correct value (again you can use the scroll bar to view this in a previous post). I know the code should work but it doesn't thats why I posted the problem.

Thanks tomincz I will alter the code to follow yours and see what happens, thanks for reading the post, you have been very helpful.

tomincz wrote:
> Chris check globals are set to on in the php.ini file.

NO!!! NO!!! NO!!!

Turning on register_globals is a serious security risk. It's so serious,
the option to turn them on is being removed from PHP 6. Even if you rely
on them now, your scripts will break in the next major version of PHP.

--
David Powers
Author, "Foundation PHP for Dreamweaver 8" (friends of ED)
Author, "Foundation PHP 5 for Flash" (friends of ED)
http://foundationphp.com/

Chrisnor wrote:
> Hi, I have used the Dreamweaver User Authentication to create a login page and
> protected page. The code works fine and authenticates the user and directs them
> to the protected page but this promptly boots them out as not authenticated.

This is why:

> Protected Page
> <?php
> if (!isset($_SESSION)) {
> session_start();
> }
> exit () <----- This terminates the script

I've not checked the rest of the script, but unless you remove the
exit(), the script will never run.

--
David Powers
Author, "Foundation PHP for Dreamweaver 8" (friends of ED)
Author, "Foundation PHP 5 for Flash" (friends of ED)
http://foundationphp.com/

Chris check globals are set to on in the php.ini file.

other than that i am using php mysql with DW8 with the latest patches and having no problems with the login behaviours. Only time i saw something kind of like this was a redirect to a .html not php page.

other than that try removing the behaviour and re entering it, sometimes i have had some issues with the code generation not being 100% good, that or i simply forgot to make sure that the text fields were given the correct name. (now i simply match all my text fields with the same name as the record field names like user_name user_passwrd etc...)

hope this helps a bit...