[RESOLVED] cross-session problem.

noimad1

Ok, so i need some help with a logic problem that I'm having with some coding a did. Here is the scenario:

I built an online course for a customer comprised of 50 pages. Each page is timed, and the student must stay on the page for that amount of time, and click the "next page" button to get credit for the page (current page is stored into the database). I also have a course-outline that the students can click on at any time to see how far they have gotten in the course.

Now, here is where my problem occurs. Let's say we have user "A" that logs into the course and gets all the way to page 49. If they click on the course-outline it shows they have completed the course all the way to page 49.

If they open a new window and log in as user "B", the session then gets opened under user "B". However, if you go back to the previous window and click on page 49 on the course-outline, then click the "next" page button, the user "B" gets bumped all the way up to page 50 without having to do any of the other pages.

Anyone have any ideas on how I could prevent this?

NogDog

Maybe part of logging in (or whatever you do to start a new user session) needs to clear $SESSION (e.g. $SESSION = array();)?

noimad1

Yea, that was the first thing I tried, but it really isn't that the session itself is getting upset, it's just that by leaving the browser open on the table of contents page they were able to utilize those "links" on the page to basically skip the pages.

I sat down and figured out a work-around. What i do now is I post along the users ID number in the table of contents links and then make sure it matches the session id...if not, I log the user out with a session expired error. Was actually an easy fix, just had to figure it out logically.

dockeryz

you need to salt your session name with a hash of the users username .... or password (if you dare)..to alleviate this problem.

Take a look at the manual for session_id

Zane Dockery
http://forums.flingbits.com

noimad1

dockeryz;10967461 wrote:
you need to salt your session name with a hash of the users username .... or password (if you dare)..to alleviate this problem.

Take a look at the manual for session_id

Zane Dockery
http://forums.flingbits.com

Thanks for the information. but like I mentioned previously the actual session variable itself was not being tampered with. It was just the fact that if the table of contents was left open (with active links on them), then you log in as the new user (the session gets passed off to the new user) then you go back and click on one of those active links on the table of contents it marked you as complete for that page.

Thanks for all the replies...we have it fixed now.