Sessions and Javascript

[gotissues68]

Hi All,
I'm trying to get a session to pass to a new window opened via javascript using the following code:

echo <FORM>
<INPUT type="button" value="New Window!" onClick="window.open('restart-named.php','mywindow','width=400,height=200')">
</FORM>

The window successfully opens, with in the page I call it has authentication code that is using session and if the session doesn't exist then it redirects to a login page, the problem I seem to be having is that it never passes the user/pass session information to the newly created window. I've googled and searched the forums here but I haven't found anything that works as of yet. I've tried to manually add the session ID to the query string in order to make the new window/page recognize that there is already a valid session and therefore no need to re-authenticate but I can't seem to get it to work. Any suggestions/links ect would be greatly appreciated.

TIA,
Drew

[Mordecai]

Most likely, your browser is keeping window-specific cookie information, or so it seems. You can, as you tried, pass the session ID through the URL--just make sure you tell the file to read that as your session id:

session_id($_GET['sid']);
session_start();

[gotissues68]

Thanks Mordecai, I knew it was something simple I was missing, all the docs refer to sid as SID (uppercase) so I was trying to pull that from $_GET and it was failing. The problem I have now is I get the following warning from the new window.

Warning: session_start(): The session id contains invalid characters, valid characters are only a-z, A-Z and 0-9 in /home/drew/public_html/projects/dnsadmin/restart-named.php on line 4

Warning: session_start(): Cannot send session cookie - headers already sent by (output started at /home/drew/public_html/projects/dnsadmin/restart-named.php:4) in /home/drew/public_html/projects/dnsadmin/restart-named.php on line 4

Warning: session_start(): Cannot send session cache limiter - headers already sent (output started at /home/drew/public_html/projects/dnsadmin/restart-named.php:4) in /home/drew/public_html/projects/dnsadmin/restart-named.php on line 4

Warning: Cannot modify header information - headers already sent by (output started at /home/drew/public_html/projects/dnsadmin/restart-named.php:4) in /home/drew/public_html/projects/dnsadmin/restart-named.php on line 10

Warning: Unknown(): The session id contains invalid characters, valid characters are only a-z, A-Z and 0-9 in Unknown on line 0

Warning: Unknown(): Failed to write session data (files). Please verify that the current setting of session.save_path is correct (/tmp) in Unknown on line 0

I'm heading off to investigate this one now 🙂

[gotissues68]

Well I removed the '' from $_GET[sid] and the above errors went away but now its re-directing to the login page again unless I use the following code

<?
echo "$_GET[sid]";
session_id("$_GET[sid]");
session_start();

include('vars.php');
if (!$_SESSION['user'] || !$_SESSION['pass']) {

// What to do if the user hasn't logged in
// We'll just redirect them to the login page.
header('Location: login.php');
die();

} else {

// If the session variables exist, check to see
// if the user has access.

$db = mysql_connect('localhost', "$dbuser", "$dbpass") or die("Couldn't connect
to the database.");
mysql_select_db('bindusers') or die("Couldn't select the database");

$result = mysql_query("SELECT count(userId) FROM users WHERE userPass='$_SESSION
[pass]' AND userName='$_SESSION[user]'") or die("Couldn't query the user-databas
e.");
$num = mysql_result($result, 0);

if (!$num) {
// If the credentials didn't match,
// redirect the user to the login screen.
header('Location: login.php');
die();
      }
}


function force_restart() {
if ($_SESSION[user] == drew) {
echo "Checking named.conf versions and copying as necessary<br>";
system("/usr/local/bin/bm-namedconf.sh");
echo "Done<br>";
echo "Restarting Name Server<br>";
system("/usr/local/sbin/rndc restart");
echo "Done<br>";
}
else {
echo "You aren't an admin!";
exit();
}
}
force_restart();

?>

The above code, only difference is that I'm echo'ing the session ID, which does echo returns the following error:

1c0c6eb52c246457dfecdbf222084d21
Warning: session_start(): Cannot send session cookie - headers already sent by (output started at /home/drew/public_html/projects/dnsadmin/restart-named.php:2) in /home/drew/public_html/projects/dnsadmin/restart-named.php on line 4

Warning: session_start(): Cannot send session cache limiter - headers already sent (output started at /home/drew/public_html/projects/dnsadmin/restart-named.php:2) in /home/drew/public_html/projects/dnsadmin/restart-named.php on line 4

Warning: Cannot modify header information - headers already sent by (output started at /home/drew/public_html/projects/dnsadmin/restart-named.php:2) in /home/drew/public_html/projects/dnsadmin/restart-named.php on line 31

[gotissues68]

quick bump 🙂

[gotissues68]

I backtracked and started debugging, had I looked at the code I posted I would have realized there was a line wrap that was causing invalid data to be passed to mysql therefore causing it to return no results and passing the user onto the authentication page. Darn it for code editors that don't line wrap!

[AlexP]

Dont forget to start with session_start() for both reading or writting to a variable ...

ALex