PHP - Share Session With 2 Different Websites Residing On Same Server

I'm looking for a secure way to share session data across two different domains (not subdomains) on the same server.

I've looked at passing the session id through a GET var to the other domain. It works but it looks to open the possibility of session hijacking and I don't really like having the session id in the URL string. Any way to make this secure?

The other option I'm looking at is using cURL to load a script on the other domain that sets a cookie with the session id. When the person loads the other domain, check for the cookie, get the session id, connect to session then delete the cookie. Can anyone see anything wrong with this?


Thanks.

hi there - good day dear fellows, 

the topic of today: session.save_path (/tmp) is not writable for web server :: security-risk!?

I am trying to install a script on my OpenSuse Webserver, and I managed to resolve most of the errors except of one:

The value for session.save_path (/tmp) is not writable for the web server.
Make sure that PHP can actually save session variables.

 

 That seems to be the problem.
 

 

session.save_path: writeable 
You need set permission for your var directory.

 

well - i guess that the default ownership may be incorrect on the session folder: 

Example; php on some Linux-Server defaults to apache user. 

If using nginx or other need to switch the folder ownership.  Also as a note you have to change the user/group setting in www.conf.

 

chown -R root:nginx /var/lib/php/7.0/
sed -i 's/apache/nginx/g' /etc/php-fpm-7.0.d/www.conf
service php-fpm-7.0 restart

 

But wait:  what about the security - is it save to make the session.save_path writeable!?

my server-admin says that this is a big big hole and makes the server unsecure. 

love to hear from you 

yours dil_bert

by the way: years ago i have had this issue on the server. 

but the question is - is this a securitiy risk!?  I need to know this. Look forward to hear from you 

Edited March 21, 2020 by dil_bert

Can somebody please explain how to properly add a Facebook Share button to my site?   It's not simply a matter of generating the button and pasting the code into my pages; in order to ensure that the right information is shared, I also have to add Open Graph metatags.   But the thing that's confusing me is that one of the required Open Graph metatags is this:

<meta property="fb:app_id" content="APP_ID_NUMBER" />

Questions   1) Does this mean that I have to register as an app builder before I can add the Share button? If so, why doesn't Facebook say so on the Share button page?   2) When generating the Share button, I am asked for the "URL to share". Does this mean that I have to generate a different Share button for each page? Surely not.   3) I use ShareThis at the moment. Does ShareThis work with Facebook Insights?

This topic has been moved to Miscellaneous.

http://www.phpfreaks.com/forums/index.php?topic=349561.0

I have placed the Facebook LIKE/SHARE buttons on a website using the following:

<div class="fb-like" data-href="http://mysite.com" data-layout="standard" data-action="like" data-show-faces="false" data-share="true" data-width="280px"></div>

the LIKE button works fine.  the SHARE button works but i cannot seem to customize and of the values such as which image to include.  i have the following in my HEAD section but it does nothing.  do i need to create an APP and reference the ID?  any help is much appreciated

<meta property="og:type" content="website" />
    <meta property="og:title" content="Can tea make for a happy marriage" />
    <meta property="og:url" content="http://mysite.com/index.php" />
    <meta property="og:image" content="http://mysite.com/pics/gallery/2.jpg" />

Edited by BuildMyWeb, 28 September 2014 - 05:18 PM.

I am trying to implement the method described in this post: http://www.addthis.com/forum/viewtopic.php?f=4&t=24637 to get my Addthis button to act the way I need it to. I have posted on the site, but have gotten no response.

I cannot get it to work. Can anybody have a look at the code below and see if they can help? Thanks

The PHP I need to modify is:


<?php     
defined('C5_EXECUTE') or die(_("Access Denied."));
    $html = Loader::helper('html');
    $uh = Loader::helper('concrete/urls');
    $bt = BlockType::getByHandle('news_list');
    global $c;



   $rss_address = $controller->getRssUrl().'?ctID='.$ctID.'&bID='.$bID ;

    if (isset($_GET['pageno'])) {
    $pageno = $_GET['pageno'];
} else {
    $pageno = 1;
} // if
?>

<div class="newsflash1">
  <div class="headtitle1">
<?php echo $rssTitle ?>
  </div>
  <?php    



if (!function_exists('newslistParse')) {

function newslistParse($url,$thumbnail,$thumbwidth,$time,$content,$title,$date){

//###################################################################################//
//here we lay out they way the page looks, html with all our vars fed to it  //
//this is the content that displays.  it is recommended not to edit anything beyond //
//the content parse.  Feel free to structure and re-arrange any element and adjust //
//CSS as desired. //
// available vars:  $url,$thumbnail,$thumbwidth,$time,$content,$title,$date       //
//###################################################################################//

?>
  <div class="newsflashcontain1">
    <div class="title1"><h3><?php echo $title; ?></h3>
    </div>
    <div class="time1"> <?php echo $date; ?></div>
    <div class="description1"><?php echo $content;?></div>
<div class="addthis_toolbox addthis_default_style">
<a class="addthis_button" addthis:title="Title goes here" addthis:description="Check their site!" addthis:url="http://www.davidcunniffe.com/test3/index.php?cID=69" href="http://www.addthis.com/bookmark.php?v=250&amp;username=dcunniffe"/>
    <a class="addthis_button_facebook"></a>
    <a class="addthis_button_twitter"></a>    
    <a class="addthis_button_favorites"></a>
    <a class="addthis_button_email"></a>
    <a class="addthis_button_print"></a>
    <a class="addthis_button_facebook_like"></a>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#username=dcunniffe"></script>
</div>
</div>
  <?php

//#####################################################################################//
//this is the end of the recommended content area.  please do not edit below this line //
//#####################################################################################//

}
}


$db = Loader::db();

//go grab the posts, check if they are current, return only current posts
Loader::model('newzy','simplenews');
$news = NewsCheck::getCurrentBlocks($ctID,$ordering);

//count the number of current posts returned
$pcount = count($news);

//if no events are returned, then we display a user defined message
if($pcount==0){
echo $nonelistmsg;
}

//now calc the last page
$lastpage = ceil($pcount/$num);


//set the current page min max keys -1 as array key's start @ 0
$sKey = $num * ($pageno-1) ;
$eKey = ($num * ($pageno-1)) + ($num-1) ;


//take each current post and treat it like a query, for each one do X
foreach($news as $key => $row){

//check for external URL, if none, rout to parent page
if(!empty($row['urlLink'])){
$url = $row['urlLink'];
}else{
$url = $controller->grabURL($row['cParentID']); 
}
//check if thumbnail is there, if so get it, if not, null
if($row['graphic']>0){
$thumbnail = $controller->getThumbnail($row['graphic']);
}else{
$thumbnail = NULL;
}
//set vars
$time = $controller->replaceTimeString($row['nbID']);
$date = date('l, jS F, Y');
$title = $row['title'];
$content = $controller->translateFrom($row['content']);
//$content = $controller->translateFrom($row['content']);
//if truncation is enabled
if($truncateSummaries == 1){
if (strlen($content) >= $truncateChars){
//truncate to suplied truncation value
 //$content = substr($content,0,$truncateChars).'.....';
 $content = wordwrap($content, $truncateChars);
     $content = substr($content, 0, strpos($content, "\n")).'.....';
}
}


//check if paging is enabled
if($isPaged){

//check to make sure the array key is within the range
if($key >= $sKey && $key <= $eKey){
  newslistParse($url,$thumbnail,$thumbwidth,$time,$content,$title,$date);
}

//if paging is not selected, use number of items designated in the list block
}else{

$i += 1;

newslistParse($url,$thumbnail,$thumbwidth,$time,$content,$title,$date);

//once we reach the set number stop the script
if($i >= $num){ break; }

}
}

?>
</div>
<?php    

//is iCal feed option is sellected, show it
if($showfeed==1){
?>
<div class="rssfeed1"> <img src="<?php echo $uh->getBlockTypeAssetsURL($bt, 'rss.png');?>" width="14" height="14" alt="rss feed" />&nbsp;&nbsp; <a href="<?php echo $rss_address ; ?>" id="getFeed">Get Feed</a>
  <link href="<?php echo $controller->getRssUrl();?>" rel="alternate" type="application/rss+xml" title="<?php echo t('RSS');?>" />
</div>
<?php    
}

//$c = Page::getCurrentPage();
$link = Loader::helper('navigation')->getLinkToCollection($c);
$link = $controller->URLfix($link);

//if pagination is set, if it is needed, show it
if($isPaged==1){

if ($pcount > $num) {
echo '<div id="pagination">';

if ($pageno == 1) {
    echo " FIRST PREV ";
} else {
    echo '<a href="'.$link.'pageno=1">FIRST </a>';
    $prevpage = $pageno-1;
    echo '<a href="'.$link.'pageno='.$prevpage.'"> PREV</a>';
} // if

echo ' ( Page '.$pageno.' of '.$lastpage.' ) ';

if ($pageno == $lastpage) {
    echo " NEXT LAST ";
} else {
    $nextpage = $pageno+1;
    echo '<a href="'.$link.'pageno='.$nextpage.'">NEXT </a>';
    echo '<a href="'.$link.' pageno='.$lastpage.'"> LAST</a>';
} // if
echo '</div>';
}
}
if (isset($bID)) { echo '<input type="hidden" name="bID" value="'.$bID.'" />';}
?>

I'm wondering if anyone can help me find/create a script which allows a preview of a link to be generated?

Basically I need a user to be able to simply enter a url and click submit and then a preview of that link will be shown in the form of some text and an image. Very similar to what Facebook does when a user shares a link. I think they use the description tag of the site in general.

Can anyone point me in the right direction in doing this? I need to be able to do it in php/javascript alone without the use of jquery or plugins.

This topic has been moved to Other Libraries and Frameworks.

http://www.phpfreaks.com/forums/index.php?topic=347238.0

Hi,   I've added social sharing icons to every article on the homepage. Now they just share the page itself - the idea is to share that (wordpress) post/article. I've succeeded to do so with facebook likes on the English version with adding 

<div class="fb-like" data-href="<?php the_permalink(); ?>"

Now I want to do the same with these 3 share icons:

<div class="social-content"><?php if (ICL_LANGUAGE_CODE=='zh-hans'): ?><div class="bshare-custom"><div class="bsPromo bsPromo2"></div><a title="分享到微信" class="bshare-weixin" href="javascript:void(0);"></a><a title="分享到新浪微博" class="bshare-sinaminiblog" href="javascript:void(0);"></a><a title="分享到QQ空间" class="bshare-qzone"></a><a title="更多平台" class="bshare-more bshare-more-icon more-style-addthis"></a><span class="BSHARE_COUNT bshare-share-count" style="float: none;">19.5K</span></div><?php endif; ?></div>

Can this be done by adding PHP? I'm not sure where I would have to add this...   Thanks Attached Files  csr1.jpg   38.34KB   0 downloads

after spending many hours thinking this through and not really getting anywhere, trying to figure out how this site works, so that i can replicate it and make a single image from multiple images that are positioned overlaying with css positioning   the site in question is: http://www.dahippo.c...6360ZZ0ZZ0ZZ0ZZ it is a type of calculator for an online game, the part that interests me is the image of the ship that is built up from many images   is also uses a php script to place all these images into on image file outputted to html, this is what interests me and i am trying to recreate, like he  http://www.dahippo.c...6360ZZ0ZZ0ZZ0ZZ   here is the outputted html:

<html>
<head>
<meta name="viewport" content="width=device-width, minimum-scale=0.1">
<title>get.php (635x317)</title>
</head>
<body style="margin: 0px;">
<img style="-webkit-user-select: none; cursor: -webkit-zoom-in;" src="http://www.dahippo.com/bp/ship/get.php?image=4J01Q180O0K0E013C3A3C3A3636360ZZ0ZZ0ZZ0ZZ" width="408" height="204">
</body>
</html>

what php code used in the get.php script make all these images with css positioning into 1 image?   i have asked the site owner, and got no reply :/

Hi all,

I'm not great with PHP and I have this one problem that I hope you can help with.

I have a script that generates an URL. The output string is $shorturl and displays properly when I echo it using Code: [Select]
<?php echo '$shorturl' ?>.

However, when I try the following script for a Facebook share button Code: [Select]
<fb:share-button>
<a name="fb_share" type="button" share_url="<?php echo '$shorturl' ?>" href="http://www.facebook.com/sharer.php" layout="button_count">Share</a><script src="http://static.ak.fbcdn.net/connect.php/js/FB.Share" type="text/javascript"></script>
</fb:share-button>
The resulting URL it produces is: http://</?php+echo+%27http%3A%2F%2Fshelb...

Any idea's?

Thank you!

I have a PHP web system that store in a windows server. In the system, there is a function for user to upload files to another server (Shared server in Unix).

When i try to upload a file, it gives warning:

Warning: move_uploaded_file(\\unixserver/sharedfolder/upload/test.txt) [function.move-uploaded-file]: failed to open stream: Permission denied in C:\wamp\www\upload\index.php on line 40

For your information, my username has been assigned in xxx's group that has access to read and write on that folder. Besides, i'm able to open,create and delete files on that folder's server manually (samba).

The safe mode setting is off.

Does anybody has any idea why this thing happen?

Hi,  I am not a PHP programmer.

I took on a new client with a simple PHP site, without any databases.
The site is up and running on the web.
I would like to get it running on my local machine for further development.
I have latest version of WAMP installed, running Apache version 2.2.11 and PHP version 5.3.0
I created a directory in the WAMP "www" project directory and it shows up there like it's supposed to when I browse to "localhost"

Problem:

The home page of website displays text but no, images, styles, footer, header, nav links, etc.


Here is the code for the home page:

<?
  define("NAV","home");
require_once('local/local.php');
?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
  <head>
    <title>TITLE</title>
    <meta name="keywords" content="">
    <meta name="Description" content="">

<? include("common/dochead.php"); ?>

    </head>

<body onLoad="<? include('common/preloads.php'); ?>">

<!-- ============================ main ============================= -->
<div id="main-frame"><div id="main" class="noCollapse">

<? include("common/sign.php"); ?>

<div id="right-frame">

<? include("common/navigation.php"); ?>

<div id="content-frame">
<div id="content">


<h1>Welcome</h1>
<p>This is the content area. This is the content area. This is the content area. </p>


</div><!-- end content -->
</div><!-- end content-frame -->

</div><!-- end right-frame -->

<div class="clearFloats"></div>

</div><!-- end main --></div><!-- end main-frame -->

<? include("common/footer.php"); ?>

   </body>
</html>



Any help would be greatly appreciated. I have spent many hours on this.

Regards

I'm trying to make a simple website where people register to my website.

When the user doesn't fill anything inside the boxes they get a message "Please fill all required fields" on the register.php page

On my local host require_once works good. It shows up.

 

But when i upload the files to my sever the require_once does not show up on the register.php

It just refreshes and i dont get the message "Please fill all required fields"

 

This is the code that works in local host but not in a live server

<?php require_once 'messages.php'; ?>

 

 

Here is my full code

 

Register page:

<html>


<?php require_once 'messages.php'; ?>

<br><br>


<form action="register-clicked.php" method="POST">

Username:<br>
<input type="text" name="usernamebox" placeholder="Enter Username Here">
<br><br>
Email:<br>
<input type="text" name="emailbox" placeholder="Enter email here">
<br><br>
Password:<br>
<input type="password" name="passwordbox" placeholder="Enter password here">
<br><br>
Confirm Password:<br>
<input type="password" name="passwordconfirmbox" placeholder="Re-enter password here">
<br><br>

<input type="submit" name="submitbox" value="Press to submit">
<br><br>

</form>

</html>

 

 

Register clicked

<?php


session_start();



$data = $_POST;

if( empty($data['usernamebox']) ||
    empty($data['emailbox']) ||
    empty($data['passwordbox']) ||
    empty($data['passwordconfirmbox'])) {
    $_SESSION['messages'][] = 'Please fill all required fields';
    header('Location: register.php');
    exit;

}




if ($data['passwordbox'] !== $data['passwordconfirmbox']) {
    $_SESSION['messages'][] = 'Passwords do not match';
    header('Location: register.php');
    exit;
}


$dsn = 'mysql:dbname=mydatabase;host=localhost';
$dbUser='myuser';
$dbPassword= 'password';

try{
$connection = new PDO($dsn, $dbUser, $dbPassword);
} catch (PDOException $exception){
    $_SESSION['messages'][] = 'Connection failed: ' . $exception->getMessage();
    header('Location: register.php');
    exit;
}

 

 

messages.php

<?php
session_start();

if (empty($_SESSION['messages'])){
    return;
}

$messages = $_SESSION['messages'];
unset($_SESSION['messages']);
?>



<ul>
    <?php foreach ($messages as $message): ?>
        <li><?php echo $message; ?></li>
    <?php endforeach; ?>
</ul>

 

Edited Wednesday at 12:49 AM by bee65