m3rajk — Fri, 05 Sep 2003 19:58:29 +0000

found it.
a friend asked me for the bgnpg() function inthe include file. pointed me to an extra character in a needed cookie value. when it was updating there was a slight error... probalby an accident from putting in the debugging stuff or something like that

m3rajk — Fri, 05 Sep 2003 19:38:55 +0000

i realized something... there's no debugging things in bgnpg();

well... i added some debugging stuff and think i know what the problem is... the functions doesn't have one of two include files it needs.... so....while everything else was perfectly fine and executing properly....

Quote: this is the debug stuff from the bgnpg function
$_COOKIE['login']: 1
db: Resource id #1
fyd: 1
cookies (un -> pw): neo -> 9cc9e1f6a22e05307d6831087ef5d1e6
fprefs: Resource id #2
error num: 0
error:
fprefs rows: 1
gmto: -5.00
utds:
duration:
ims accepted: 1
uid: 1
now -> expire: 1062790733 -> expire 1062790733
active -> exp: 2003-09-05 19:38:53 -> 2003-09-05 19:38:53
update 1
affected rows -> error number: 1 -> 0
error:
ending of pgbgndebug crap

but.....that didn't fix it.
first page after login:

Quote: this is the debug stuff from the bgnpg function
$_COOKIE['login']: 1
db: Resource id #1
fyd: 1
cookies (un -> pw): neo -> 9cc9e1f6a22e05307d6831087ef5d1e6
fprefs: Resource id #2
error num: 0
error:
fprefs rows: 1
gmto: -5.00
utds: m/d/Y H:i:s
duration: 60
ims accepted: 1
uid: 1
now -> expire: 1062791587 -> expire 1062795187
active -> exp: 2003-09-05 19:53:07 -> 2003-09-05 20:53:07
update 1
affected rows -> error number: 1 -> 0
error:
ending of pgbgndebug crap

so it should be lasting an hour for me, right? (all times gmt)
yet... next pageload:

Quote: this is the debug stuff from the bgnpg function
$_COOKIE['login']: 0
ending of pgbgndebug crap

now i'm really stumped.

m3rajk — Fri, 05 Sep 2003 16:43:52 +0000

suzanne: noted. i'll try to comment it better.

mark: the only things in all the pages are what's Inside the section denoted as being from the include. the area you're telling has an issue with it being used as post is ONLY on the login page (after the functions from the included file)

since Suzanne has a good point with people trying to hack the site, i'll combine the two. it will make the code more compact, between that and adding comments, maybe with the next update it will be easier to follow what's happening.

Suzanne — Fri, 05 Sep 2003 15:00:39 +0000

Please note how the white space, indents and comments make the script a LOT easier to read and understand? Good practice is something that helps everyone, especially the person needing help!

Mark Hensler — Fri, 05 Sep 2003 04:43:11 +0000

Quote: i hope the change makes things more clear.

Clear as mud. I have no idea what I'm looking at.
I have no idea how you're attempting to tracking users between pages.
I don't know what code is included where, or anything.

I'm assuming that the login.issue code is included on every page?
At any rate. I still think that your not checking your cookie data.

I'll re-write a section for you...

<?php
# variables used
$pass=MD5($_POST['pass']); $login=FALSE; $duration=NULL; $title='Login Page'; $error=FALSE; $gmto=NULL;
$uid=NULL; $linfo='';$expire='';

if(isset($_POST['un'])){ # check the db if this isn't the first loading of the page
  $un=$_POST['un']; # what was the passed username?
  $db=mysql_connect($host, $login2, $pass2) or die(\"cannot access mysql\"); # connect
  $fyd=mysql_select_db('findyourdesire', $db) or die(\"cannot connect to db\"); # select the db
  $lookup=mysql_query(\"SELECT * FROM users WHERE username='$un'\", $db);
  if(mysql_num_rows($lookup)){ // we have a user (username is unique, it can only be 1 or 0 returned)
    $info=mysql_fetch_array($lookup); # get all the info associated with the user
    if($pass==$info['password']){ # the passwords match
      $sa=$info['site_access'];
      if((contains($sa, $regulars))||(contains($sa, $desireds))){ # you're not suspended
    $login=TRUE; $duration=$info['login_duration']; $uid=$info['uid']; # set login, cookie duration, uid
    $gmto=$info['gmt_offset']; $rtds=$info['tds']; $utds=$tds[$rtds]; # set the gmt offset & time display
    $now=gmdate(\"Y-m-d H:i:s\", time()); $currip=$_SERVER['REMOTE_ADDR']; # get the new ip
    $update=mysql_query(\"UPDATE users SET last_login_ip='$currip', last_login_date='$now' WHERE uid='$uid'\", $db); # update login date and ip
    $aff=mysql_affected_rows($db);$errno=mysql_errno($db);$error=mysql_error($db);
    $ll=$durr[$duration];  $uts=time(); $exp=gmdate(\"Y-m-d H:i:s\", (time()+(60*$durr[$duration]))); // debugging stuff
    $expire=time()+(60*$durr[$duration]); # set expiration by formula time()+seconds*minutes*hrs*days*yrs
    setcookie('un', $un, $expire); # set username
    setcookie('pw', $pass, $expire); # set password
    setcookie('login', 1, $expire); # set login
    setcookie('gmto', $gmto, $expire); # set the gmt offset
    setcookie('utds', $utds, $expire); # set the time display style
    $linfo=\"<p>debug:<br />un:$un<br />gmto: $gmto<br />tds: $rtds--$utds<br />login length: $ll, exprire: $expire / $exp, now: $uts / $now</p><p>update: UPDATE users SET last_login_ip='$currip', last_login_date='$now' WHERE uid='$uid'<br />$aff<br />$errno<br />$error\"; // debugging stuff
    bgnpg($title); nav2(); success($un, $linfo); clspg(); # show the successful login page
      }else{ bgnpg($title); nav(); login($un, TRUE, 3); clspg(); } # the user is suspended
    }else{ bgnpg($title); nav(); login($un, TRUE, 2); clspg(); } # the submitted password is wrong
  }else{ bgnpg($title); nav(); login($un, TRUE, 1); clspg(); } # there was no user by that name
}else{ bgnpg($title); nav(); login('', FALSE, 0); clspg(); } # no failed login attempt
?>

becomes:

<?php
//  variables used
$duration   = NULL;
$title      = 'Login Page';
$error      = FALSE;
$uid        = NULL;
$linfo      = '';
$expire     = '';

if(isset($_POST['un'])) {
    // check data from login form
    $un     = $_POST['un'];
    $pass   = md5($_POST['pass']);
    $login  = FALSE;
    $gmto   = NULL;
}
else {
    // check data from cookie
    $un     = $_COOKIE['un'];
    $pass   = md5($_COOKIE['pw']);
    $login  = md5($_COOKIE['login']);
    $gmto   = md5($_COOKIE['gmto']);
    $utds   = md5($_COOKIE['utds']);
}

$db = mysql_connect($host, $login2, $pass2) or die(\"cannot access mysql\");
$fyd = mysql_select_db('findyourdesire', $db) or die(\"cannot connect to db\");
$lookup = mysql_query(\"SELECT * FROM users WHERE username='$un'\", $db);

if (mysql_num_rows($lookup)==0) {
    // there was no user by that name
    bgnpg($title); nav(); login($un, TRUE, 1); clspg();
    exit;
}

// get all the info associated with the user
$info = mysql_fetch_array($lookup);
if ($pass!=$info['password']) {
    // the submitted password is wrong
    bgnpg($title); nav(); login($un, TRUE, 2); clspg();
    exit;
}

$sa = $info['site_access'];
if (!contains($sa, $regulars) && !contains($sa, $desireds)) {
    // the user is suspended
    bgnpg($title); nav(); login($un, TRUE, 3); clspg();
    exit;
}

// user login via form?  or via cookie?
if (isset(_$POST['un'])) {
    // set login, cookie duration, uid
    $login      = TRUE;
    $duration   = $info['login_duration'];
    $uid        = $info['uid']; 

    // set the gmt offset & time display
    $gmto   = $info['gmt_offset'];
    $rtds   = $info['tds'];
    $utds   = $tds[$rtds];

    // get the new ip
    $now    = gmdate(\"Y-m-d H:i:s\", time());
    $currip = $_SERVER['REMOTE_ADDR'];

    // update login date and ip
    $update = mysql_query(\"UPDATE users SET last_login_ip='$currip', last_login_date='$now' WHERE uid='$uid'\", $db);
    $aff    = mysql_affected_rows($db);
    $errno  = mysql_errno($db);
    $error  = mysql_error($db);

    // debugging stuff
    $ll     = $durr[$duration];
    $uts    = time();
    $exp    = gmdate(\"Y-m-d H:i:s\", (time()+(60*$durr[$duration])));

    // set expiration by formula time()+seconds*minutes*hrs*days*yrs
    $expire = time()+(60*$durr[$duration]);
    setcookie('un', $un, $expire);      // set username
    setcookie('pw', $pass, $expire);    // set password
    setcookie('login', 1, $expire);     // set login
    setcookie('gmto', $gmto, $expire);  // set the gmt offset
    setcookie('utds', $utds, $expire);  // set the time display style

    // debugging stuff
    $linfo = \"<p>debug:<br />un:$un<br />gmto: $gmto<br />tds: $rtds--$utds<br />login length: $ll, exprire: $expire / $exp, now: $uts / $now</p><p>update: UPDATE users SET last_login_ip='$currip', last_login_date='$now' WHERE uid='$uid'<br />$aff<br />$errno<br />$error\";
}

// user is legit, welcome!
bgnpg($title); nav2(); success($un, $linfo); clspg();
?>

Also, I would advise against alerting the user as to why an attempted login failed.
By telling the user that the username doesn't exist, or the password wasn't correct, you're simplifying it for a hacker.

m3rajk — Thu, 04 Sep 2003 20:17:10 +0000

i realized that's causing some comfusion so i chaged the login script so that it doesn't use that, and added a function specifically for the login when it's successful to do the navigation bar (it would be a pain in the *** to add something to nav() and go back through about 30 pages and add it to them all.

i hope the change makes things more clear. it's been reflected in the login.issues page

Mark Hensler — Thu, 04 Sep 2003 19:07:28 +0000

I still think that this is the problem:

<?php
if(isset($_POST['un'])){
  if($login){
    bgnpg($title); nav(); success($un, $linfo); clspg();
  }else{
    bgnpg($title); nav(); login($un, TRUE, $error); clspg();
  }
}else{
  bgnpg($title); nav(); login('', FALSE, FALSE); clspg();
}
?>

You're not checking cookies anywhere. Again, I haven't fully examined your code, but perhaps somethign along the lines of:

<?php
if(isset($_POST['un'])){
  if($login){
    bgnpg($title); nav(); success($un, $linfo); clspg();
  }else{
    bgnpg($title); nav(); login($un, TRUE, $error); clspg();
  }
}else{
  if ($_COOKIE['un']!='') {
    bgnpg($title); nav(); success($un, $linfo); clspg();
  }else{
    bgnpg($title); nav(); login('', FALSE, FALSE); clspg();
  }
}
?>

m3rajk — Thu, 04 Sep 2003 18:40:35 +0000

Quote: Originally posted by Suzanne
Back down m3rajk, if you want help, give people all the pieces.

Does your $durr array give the minutes, hours, days, then?

Regardless, the user/pass should be set in the cookie or a session. It should not be in the _POST only or it will be lost, resulting in what you're seeing -- they keep getting "logged out". In reality, unless you're hiding more, they were only briefly allowed to see the logged in condition, they were not actually logged in.

sorry. i just know it's not how i'm setting them initially because the join page has one set on the frist step, that was working. i didn't do anything again until the 4th step. but ast night there was an issue with that eone, even through several people including myself got through it in the past, even after i found this one.. the most recent being the day before.

the dur array is in minutes.

<?php
# login durations
$durr=array(2, 5, 15, 30, 60, (60*2), (60*24), (60*24*365*5));
?>

the last option being for people that don't want to have to log back in via the page. options are 2 min, 5 min, 15 min, 30 min, 1 hr, 2 hrs, 1 day, and 5 yrs.

the login script checks to see if $_POST['un'] is set because if it isn't, you're at the page the first time, if it is, you're trying to login, so it goes through that and figures out what, if any, error you should have....username not found, password doesn't match, or you've logged in. (i realized you can't use cookies the time you log them in, so i'm going to modify the nav bar and where the pagess are called so it can set the login to truefor the user, but i wanna get the issue with the coookies only lasting one pageload worked out first)

i have one cookie that's working, which is why these cookies not working is extremely frustrating. especially when someone said i'm setting it for half a day when i'm pretty sure i said i have an array of choices in minutes that i multiply by 60 seconds when i add it tot time, which is exactly what i was then told to do. that made his post really frustrating because it didn't address anything that i didn'tknow. maybe if i mentioned that i have the other cookie that works correctly the post would have been better..

i've been trying to fix this since last friday.

i i ONLY use cookies for things to carry between pages. i understand what stateless means and that get and post only work for the next page loaded.

Mark Hensler — Wed, 03 Sep 2003 04:49:21 +0000

$_POST cannot be carried between pages. Only $_SESSION and $_COOKIE can store data between page hits. $_SESSION will only retain the value as long as the browser (or a child of the session-initiating browser) stays open, $_COOKIE will only retain the value until the expiration time is reached.

Suzanne — Tue, 02 Sep 2003 21:13:03 +0000

Back down m3rajk, if you want help, give people all the pieces.

Does your $durr array give the minutes, hours, days, then?

Regardless, the user/pass should be set in the cookie or a session. It should not be in the _POST only or it will be lost, resulting in what you're seeing -- they keep getting "logged out". In reality, unless you're hiding more, they were only briefly allowed to see the logged in condition, they were not actually logged in.