phpBB 2.0.18 New session handling phpBB 2.0.18 New session handling
 

News:

cpg1.5.48 Security release - upgrade mandatory!
The Coppermine development team is releasing a security update for Coppermine in order to counter a recently discovered vulnerability. It is important that all users who run version cpg1.5.46 or older update to this latest version as soon as possible.
[more]

Main Menu

phpBB 2.0.18 New session handling

Started by Joe Belmaati, October 31, 2005, 06:50:11 AM

Previous topic - Next topic

0 Members and 1 Guest are viewing this topic.

Joe Belmaati

Hello,
is there ahack that will adapt the bridge-file/integration with phpBB to accommodate the newly imposed changes to phpBBs session handling? Right now I can't log in as an administrator, nor can anyone else log in - even though they are logged in to phpBB.
Sincerely,
Joe Belmaati

Joe Belmaati

A temporary fix is to de-select auto login for phpBB. However, a permanent fix would be desirable. I will try to mess with this myself.
Sincerely,
Joe

Joe Belmaati

Hello again,
here's a temporary hack that will work regardless of user settings. The idea is to use the sessiosn table regardless of user cookie settings.

OPEN

bridge/phpbb.inc.php

FIND

    if ($cookie_uid && !$cookie_pass && isset($HTTP_COOKIE_VARS[PHPBB_COOKIE_PREFIX . '_sid'])) {

REPLACE WITH

//     if ($cookie_uid && !$cookie_pass && isset($HTTP_COOKIE_VARS[PHPBB_COOKIE_PREFIX . '_sid'])) {

FIND

        $sql = "SELECT user_id, username as user_name, user_level " . "FROM " . $UDB_DB_NAME_PREFIX . PHPBB_TABLE_PREFIX . PHPBB_SESSION_TABLE . " " . "INNER JOIN " . $UDB_DB_NAME_PREFIX . PHPBB_TABLE_PREFIX . PHPBB_USER_TABLE . " ON session_user_id = user_id " . "WHERE session_id='$session_id' AND session_user_id ='$cookie_uid' AND user_active='1'";
    }


REPLACE WITH

        $sql = "SELECT user_id, username as user_name, user_level " . "FROM " . $UDB_DB_NAME_PREFIX . PHPBB_TABLE_PREFIX . PHPBB_SESSION_TABLE . " " . "INNER JOIN " . $UDB_DB_NAME_PREFIX . PHPBB_TABLE_PREFIX . PHPBB_USER_TABLE . " ON session_user_id = user_id " . "WHERE session_id='$session_id' AND session_user_id ='$cookie_uid' AND user_active='1'";
//     }


FIND

else {
        $sql = "SELECT user_id, username as user_name, user_level " . "FROM " . $UDB_DB_NAME_PREFIX . PHPBB_TABLE_PREFIX . PHPBB_USER_TABLE . " " . "WHERE user_id='$cookie_uid' AND user_password='$cookie_pass' AND user_active='1'";
    }


REPLACE WITH

/* else {
        $sql = "SELECT user_id, username as user_name, user_level " . "FROM " . $UDB_DB_NAME_PREFIX . PHPBB_TABLE_PREFIX . PHPBB_USER_TABLE . " " . "WHERE user_id='$cookie_uid' AND user_password='$cookie_pass' AND user_active='1'";
    }*/

laubert

Thank you dor theses ideas.

Quote from: Joe Belmaati on October 31, 2005, 09:39:20 AM
A temporary fix is to de-select auto login for phpBB.
It doesn't work for me  :(  : "invalid session" when I disconnect.


What do CPG bridges coders think about the new phpbb.inc.php, posted by Joe ?

Joe Belmaati

Thanks for the reply, laubert
as stated in my post the fix is temporary and works on my site. I don't get the session error when logging out. My problem was that logging into phpbb did not log me into coppermine. With the hack I posted it now works. Not really sure why you would get the session error, as using the session table as per my hack would equate to handling a user that doesn't allow cookies.

littleking

WORKS GREAT!  but... if it hit logon in cpg i get:

Notice: Undefined index: huntforums_sid in /home/httpd/vhosts/huntohio.net/httpdocs/gallery/bridge/phpbb.inc.php on line 103


line 103 =         $session_id = addslashes($HTTP_COOKIE_VARS[PHPBB_COOKIE_PREFIX . '_sid']);

jaybrain

I just updated to 2.0.18 today, and I'm using the most recent version on cpg.  Cleared cookies, and still doesn't show me as logged in with cpg when using firefox, but logs me in with IE.  I get invalid session when I log out with IE.