loosing session

adavis

Okay, I know a bunch of people have posted about this, but I still can't figure out why I'm loosing session.

This the the process:
index.php: login page, asks for username and password
login.php: action of index.php, checks for valid user and if so, displayes the welcome page
welcome.php: displays the update options for the teacher who logged in according to switches set in the database

When the teacher makes a selection from the drop down list on the welcome page and hits the submit button, the session is lost. I have tried numerous ways, places, etc.. to call the session and set the session info to variables or not, and on and on... I was up until about 2am this morning trying to figure it out with no success. I've been working on it about an hour this morning and have come to the end of my rope. I can display what ever code you need to see. Just let me know, but there's a bunch of it.

BTW, This is a new thing since upgading to 4.3.3RC1.

Thanks,
Alisa

mrhappiness

you have session_start(); on top of every page?

you use cookie or url to submit the session-id?

adavis

The answer to the first question is yes. I don't know the answer to the second question. I can post what's in my info.php on sessions if that's where I would go to look for that info. Otherwise I don't know wher to look.

session
Session Support  enabled  

Registered save handlers  files user  

Directive                  Local Value  Master Value 
session.auto_start         Off          Off 
session.bug_compat_42      On           On 
session.bug_compat_warn    On           On 
session.cache_expire       180          180 
session.cache_limiter      nocache      nocache 
session.cookie_domain      no value     no value 
session.cookie_lifetime    0            0 
session.cookie_path        /            / 
session.cookie_secure      Off          Off 
session.entropy_file       no value     no value 
session.entropy_length     0            0 
session.gc_divisor         100          100 
session.gc_maxlifetime     1440         1440 
session.gc_probability     1            1 
session.name               PHPSESSID    PHPSESSID 
session.referer_check      no value     no value 
session.save_handler       files        files 
session.save_path          /tmp         /tmp 
session.serialize_handler  php          php 
session.use_cookies        On           On 
session.use_only_cookies   Off          Off 
session.use_trans_sid      Off          Off

Does this tell you anything?

mrhappiness

could it be possible that the teacher has configured his comp to not accept cookies?

"session.use_cookies On" means that php tries to store a session-cookie at the client's holding the session-id

normally if you don't accept cookies php writes the session-id as parameter to every rlative link or form you use

but you have use_trans_sid configured as Off and so this doesn't happen

adavis

This is still in re-design/testing for the upgrade problems, so it hasn't gotten to the teacher yet, and no, I doubt that many if any of the teachers would even know how to turn cookies on or off. 😉

mrhappiness

if you can configure php.ini switch use_trans_sid to On and everything will be fine i guess

lives4him06

how do you do this?

mrhappiness

you locate php.ini
open it with your editor of choice (notepad will do fine e. g.)
search for "use_trans_sid"
see the Off (or 0) right to "use_trans_sid"
change it to On

adavis

Sorry for the delay. I spent the whole day yesterday cleaning and working at my dad's house.

My server is outside my control. Is this something I will have to ask my sysadmin to do? I will need to tell him why I want it done. I have to be able to support my request from a security standpoint and if my reasoning is good enough, he might do it when he gets around to it, if he remembers. I always say go get what you pay for and since this server space is donated. They're mad at me anyway right now for asking for the upgrade in the first place, so....

adavis

I've past run out of time trying to figure out why it isn't working.

At this point I have decided to pass the userid in a hidden field, check to see if the session is open and if it isn't, re-read the data and re-start the session. Pain in the ...