Hey Mark. Code is explained below.
I'm using cookies for the sessions. The reason for this is that I work in an institution where everybody's computers are set up the same, so I know for a fact that everyone has cookies turned on (at least everyone who will be administering the applications I'm building)
This is the php code for the login page. The page submits to itself, so if the $method var isn't set (or isn't set properly), it just outputs the login form. Otherwise it does the login:
<?php
if (isset($method)) {
if ($method == "login") {
include_once("../authentication/auth.inc.php");
$auth = new Auth;
if ($auth->doLogin($username,$password,"mysql") == true) {
session_start();
session_register("sess_allow");
$sess_allow = "true";
session_register("sess_user_id");
$sess_user_id = $auth->usr_info['user_id'];
session_register("sess_user");
$sess_user = $auth->usr_info['username'];
session_register("sess_email");
$sess_email = $auth->usr_info['email'];
session_register("sess_user_type");
$sess_user_type = $auth->usr_info['type'];
session_register("sess_clearance");
$sess_clearance = $auth->usr_info['clearance'];
header("Location:select_app.php");
}
} else {
die("Illegal call");
}
} else {
?>
So you can see here, I simply invoke a new case of the auth class, then access the doLogin() method, passing along the appropriate info from the login form, and if doLogin() returns true, then I register the appropriate session variables, setting the values to the result set returned within the doLogin() method.
Here's the code for the doLogin() method:
function doLogin($username,$password,$db_def) // validate user login
{
if (!isset($db_def)) { // if $db_def not set, load default database definition file
include_once("../authentication/db_def.php");
} else {
define("db_type",$db_def);
}
#error_reporting(E_ALL); // error catching
#include_once("../adodb/adodb-errorhandler.inc.php"); // error catching
include_once("../adodb/adodb.inc.php"); // load code common to ADOdb
$ADODB_FETCH_MODE = ADODB_FETCH_ASSOC; // set ADOdb fetch mode
define ("username",trim($_username)); // define user username
define ("password",trim($_password)); // define user password
define ("webapps_user","webapps_login"); // define username to query user info tables
define ("webapps_pass","getuserinfo"); // define password to query user info tables
$conn = &ADONewConnection(db_type); // create adodb connection class and database type
$conn->PConnect('localhost',webapps_user,webapps_pass,'communic'); // create persistent connection
define ("sql","select u.user_id, u.username, u.email, u.clearance, ut.type from users u, user_types ut where u.username = '".username."' and u.password = '".password."' and u.clearance = ut.clearance"); // create query
$rs = &$conn->Execute(sql); // execute query to validate user info
if ($rs->RecordCount() == 1) { // check number of results
$this->usr_info = $rs->fields;
return true;
} else {
$this->usr_err_msg .= "<li>Invalid username/password combination.</li><br>";
$this->checkUserErrors();
}
$rs->Close(); // close recordset
$conn->Close(); // close connection
}
Now, the thing is the problem (as far as I can see at least) does not lie with the doLogin() method, but with the checkSession() method, the code for which is below:
function checkSession()
{
if (!session_is_registered($sess_user)) {
die("Your session has expired, or you have logged out. <a href=\"/webapps/index.html\" target=\"_top\">Please click here to login</a>.");
}
}
This is a very abbreviated version of the checkSession() method, as once I have it working I'll be checking a number of session vars, not just $sess_user.
So what's happening is when I call the checkSession() method before the doAuth() method (another method which checks that the user has proper authorization to access a specific application) it doesn't recognize the session var as being registered, even though it is, since if I remove the checkSession() method everything works.
Here's the code for the doAuth method:
function doAuth($app_id,$clr_req,$cur_usr,$cur_usr_clr)
{
if (!isset($db_def)) { // if $db_def not set, load default database definition file
include_once("../../authentication/db_def.php");
} else {
define("db_type",$db_def);
}
include_once("../../adodb/adodb.inc.php"); // load code common to ADOdb
$ADODB_FETCH_MODE = ADODB_FETCH_ASSOC; // set ADOdb fetch mode
define ("webapps_user","webapps_login"); // define username to query user info tables
define ("webapps_pass","getuserinfo"); // define password to query user info tables
$conn = &ADONewConnection(db_type); // create adodb connection class and database type
$conn->PConnect('localhost',webapps_user,webapps_pass,'communic'); // create persistent connection
define ("usr_info","select user_id, clearance from users where user_id = ".$_cur_usr." and clearance = ".$_cur_usr_clr); //
define ("app_info","select app_users from user_apps where app_id = ".$_app_id." and status = 1");
$usr_rs = &$conn->Execute(usr_info); // execute query to verify user info
$app_rs = &$conn->Execute(app_info); // execute query to get application users
if ($app_rs->RecordCount() != 1) {
die("You are attempting to access an application which is not yet available to the public.<br><br>If you feel this message is an error, ".strtolower($this->notifyadmin));
}
if ($usr_rs->RecordCount() == 1 && strstr($app_rs->fields['app_users'],$usr_rs->fields['user_id'])) {
return true;
} else {
die("You do not have authorization to access this application.<br><br>If you feel this message is an error, ".strtolower($this->notifyadmin));
}
$rs->Close(); // close recordset
$conn->Close(); // close connection
}
I hope this makes sense. Thanks very much for taking a look at this.
Pablo.
