Changeset 2329

Timestamp:

03/23/10 16:37:27 (14 years ago)

Author:

niltonneto

Message:

Ticket #926 - Corrigido validação de sessão em requisições AJAX.

File:

• trunk/header.session.inc.php (modified) (1 diff)

trunk/header.session.inc.php

@@ -1 +1 @@
 <?php
-        if ( isset( $_COOKIE[ 'sessionid' ] ) )
-                session_id( $_COOKIE[ 'sessionid' ] );
+        session_start( );
+        $sess = $_SESSION[ 'phpgw_session' ];
+    $connection_id = "{$sess['session_id']}{$sess['session_ip']}".substr($_SERVER[ 'HTTP_USER_AGENT' ],0,199);
+ 
+        if ( empty($_SESSION['phpgw_session']['session_id']) ||
+                ($_SESSION['connection_db_info']['user_auth'] && implode('',$_SESSION['connection_db_info']['user_auth']) !== $connection_id)
+        )
+        {
+                if($_SESSION['connection_db_info']['user_auth'] && !strstr($_SERVER['SCRIPT_URL'],"/controller.php"))
+                        error_log( '[ INVALID SESSION ] >>>>' . implode('',$_SESSION['connection_db_info']['user_auth']) . '<<<< - >>>>' . $connection_id . '<<<<', 0 );
 
-        session_start( );
-
-        $sess = $_SESSION[ 'phpgw_session' ];
-        $connection_id = "{$sess['session_id']}{$sess['session_ip']}".substr($_SERVER[ 'HTTP_USER_AGENT' ],0,199);
-
-
-        if ($_SESSION['connection_db_info']['user_auth'] && implode('',$_SESSION['connection_db_info']['user_auth']) !== $connection_id)
-        {
-                error_log( '[ NOT VALIDATED SESSION ] >>>>' . implode('',$_SESSION['connection_db_info']['user_auth']) . '<<<< - >>>>' . $connection_id . '<<<<', 0 );
                 setcookie("PHPSESSID","",0);
                 setcookie ("sessionid","",0);   
-                require_once dirname( __FILE__ ) . '/logout.php';
-                exit;
+                unset($_SESSION);
+                // Retorna "nosession" quando for requisições do ExpressoAjax
+                if(strstr($_SERVER['SCRIPT_URL'],"/controller.php")){
+                        echo serialize(array("nosession" => true));
+                        exit;
+                }
+        }
+        else{
+                // Keep Alive session user.
+                if ( isset( $_COOKIE[ 'sessionid' ] ) )
+                        session_id( $_COOKIE[ 'sessionid' ] );
+                $_SESSION['phpgw_session']['session_dla'] = time();
         }
 ?>