PHP - Wierd Session Issue

I'm using the PHPmotion script, with a use-a-credit to view-a-video mod. When the user logs out, the viewed video should not be available again to view, until he logs back in and chooses it chooses it, via a credit, but it is still available when he logs back in. Any ideas on what file may be responsible for what I guess you could call 'clearing the session'?

I'm having an issue with sessions and session_set_save_handler.
Note: new at OO PHP

I'm using an MVC written mostly from a tutorial and it all seems to be working, except for sessions.
I've got session_set_save_handler as a class SessionHandler. If I include it into the main index page and create an instance, I get an error 'Undefined variable: _SESSION' for my index view file.
If I instead include a global.php file into the main index page and include the session class into the global.php page, and create an instance, the error goes away and session_set_save_handler saves the session variables into my database.

(1)On my index page for debugging I've got a var_dump of $_SESSION to see which session variables are set.

On my login page I've got a form token that is saved to a session variable. When I go to the login page that session token variable is set and doing a var_dump on the page shows it is indeed being set, however, when I click back to the main index page, the index var_dump(1) shows the session variable is no longer set.
But then if I login it correctly redirects me to a user logged in page and echos the username of the user logged in correctly, but still does not show the form token session variable in the var_dump for index(1). But then if I navigate to the login form page where the form token should be initially set, it now sets it correctly and going to the index page indeed shows the token set.

form token being set on login view page:

Code: [Select]
$login_token = $_SESSION['login_token'] = md5(uniqid(mt_rand(),true));
var_dump on index page before login (even if I navigate to login page then back to index it remains blank when it should instead show the form token session variable)
Code: [Select]
array
  empty
var_dump on index page after login.
Code: [Select]
array
  'lu_user' => string 'admin' (length=5)
  'lu_user_id' => string '6' (length=1)
  'user_sess_time' => int 1326544148

var_dump on index page after login, navigating to login form page (where login_token is set), then navigating back to index:

Code: [Select]
array
  'lu_user' => string 'admin' (length=5)
  'lu_user_id' => string '6' (length=1)
  'user_sess_time' => int 1326544148
  'login_token' => string 'c260e76dd65f0d9b6e881cfc9a4b33e1' (length=32)
Magically the login_token now shows, but only after logging in and setting the other variables. It seems it's not saving the login_token when it's initially set, but only after logging in which it shouldn't be doing.

The same issue arises with any other session variables that I set elsewhere (only displayed after user login).

If I remove session_set_handler the sessions set correctly but naturally the data is no longer added to the database.

If I do var_dump(get_included_files()); it shows the session class is correctly being included.
I was thinking it's an issue with session_start() but if I add that in or try to create another instance of the session class on the other pages, I get an error stating they've already been called and cannot be called again. So then they must be getting called, right?

So now I'm thoroughly confused. More code below, sorry for the long post. Hopefully I've provided all necessary information.

Index includes global.php, which contains:

Code: [Select]
require 'framework/SessionHandler.php';

$sess = new SessionHandler();

And the session handler class is (Database class is included into index which is why you cannot see it instantiated here):

Code: [Select]
<?php

class SessionHandler
{
function __construct()
{
session_set_save_handler
(
array(&$this, 'open'),
array(&$this, 'close'),
array(&$this, 'read'),
array(&$this, 'write'),
array(&$this, 'destroy'),
array(&$this, 'gc')
);

session_start();

ini_set('session.gc-maxlifetime', 1800);

if (isset($_SESSION['lu_user']))
{
if (!isset($_SESSION['user_sess_time']))
{
$_SESSION['user_sess_time'] = time();
}
elseif (time() - $_SESSION['user_sess_time'] > 1800) // 30 mins
{
    session_regenerate_id(TRUE);
    $_SESSION['user_sess_time'] = time();
}
}
}

function open()
{
$this->db = new Database();
}

function close()
{
return $this->db = null;
}

function read($id)
{
$stmt = $this->db->prepare('SELECT * FROM sessions WHERE id = :id');
$stmt->execute(array(':id' => $id));

if ($row = $stmt->fetch(PDO::FETCH_ASSOC))
{
return $data = $row['data'];
}
else
{
return '';
}
}

function write($id, $data)
{
$access = time();

if (isset($_SESSION['lu_user']))
{
$session_id = session_id();
$username = $_SESSION['lu_user'];

$stmt = $this->db->prepare('REPLACE INTO sessions (id, access, data) VALUES (:id, :access, :data)');
$stmt->execute(array(':id' => $id, ':access' => $access, ':data' => $data));
}
}

function destroy($id)
{
if (ini_get("session.use_cookies"))
{
     $params = session_get_cookie_params();
     setcookie(session_name(), '', time() - 42000,
         $params["path"], $params["domain"],
         $params["secure"], $params["httponly"]);
}

$stmt = $this->db->prepare('DELETE FROM sessions WHERE id = :id');
$stmt->execute(array(':id' => $id));
}

function gc($max)
{
$old = time() - $max;

$stmt = $this->db->prepare('DELETE FROM sessions WHERE access < :old');
$stmt->execute(array(':old' => $old));
}

function __destruct()
{
session_write_close();
}
}

I was told that using a Session will allow me to capture an Object and pass it between pages.

I tried following what I read online and what someone sugegsted but it is not working.

This is the error I get when running my test application...

Quote

Catchable fatal error: Argument 1 passed to Microwave::receiveItem() must be an instance of Bowl, instance of __PHP_Incomplete_Class given, called in /Users/user1/Documents/DEV/++htdocs/Soup/cook.php on line 13 and defined in /Users/user1/Documents/DEV/++htdocs/Soup/classes/Soup.class.php on line 31
Call Stack
#   Time   Memory   Function   Location
1   0.0095   56412   {main}( )   ../cook.php:0
2   0.0101   68272   Microwave->receiveItem( )   ../cook.php:13


I would really appreciate it if someone could look at my code and see where the problem is at.

My guess is that it is in cook.php, but who knows?!

Attached is a ZIP of my entire directory structure.

Thanks,


TomTees

Hi guys i've spent 3 whole days trying to get this to work but it dosent. My issue is very similar almost the same as: http://www.phpfreaks.com/forums/index.php?topic=296100.15 but with the code i have.

Basically i have custom member pages. member1.php member2.php the design and content will be custom to each member, they also have their own login page.

Each member should be able to access their page and simply view their secure area. They should not be able to log into another users area if they dont have the username or password for it.

Now the problem is, i have this entire script setup and it works, however i fear there is something wrong with the sessions which allows other members to access other members pages with their own passwords and usernames because they share the same database. So the script executes thinking its a valid user and lets them in.

Here is my login checker once the user is validated they are sent to their own folder header("Location: ../{$loginusername}/index.php"); and are able to view the page.


Code: [Select]
<?php
require_once('../config.php');

// Connect to the server and select the database.
mysql_connect("$host", "$username", "$password")or die("cannot connect");
mysql_select_db("$db")or die("Unable to select database");

// The username and password sent from login.php
$loginusername=$_POST['username'];
$loginpassword=$_POST['password'];

//The following bit of coding protects from MySQL injection attacks
$loginusername = stripslashes($loginusername);
$loginpassword = stripslashes($loginpassword);
$loginusername = mysql_real_escape_string($loginusername);
$loginpassword = mysql_real_escape_string($loginpassword);

$sql="SELECT * FROM $tbl WHERE username='$loginusername' and password='$loginpassword'";
$result=mysql_query($sql);

// Count how many results were pulled from the table
$count=mysql_num_rows($result);

// If the result equals 1, continue
if($count==1){

session_start();
$_SESSION["loginusername"] = $loginusername;
$_SESSION['user1'] = $username; // store session data
//echo "User: = ". $_SESSION['loginusername']; //retrieve data
header("Location: ../{$loginusername}/index.php");

}
// If not successful, inform the user of error
else {
echo "Wrong Username or Password";
}
?>


Now here is the secure page sample:

Code: [Select]
<?php
session_start(); 
if (!$_SESSION['user1']){ 
header("Location: login.php"); 
}else{
print "its working!";
}

?>

<html>
<body>
Login Successful for

</body>
</html>

For each login page i have given each user it's own session.. this works, however if user1 logs in and simply changes the url to user2 and enters his user2 password he is granted access giving him new sessions which means he has access to everything.

Im pretty sure im missing something really small any help would be appreciated.