This is an archived copy of the forum for reference purposes

getUserACLs returning null anywhere but on the index.php page

posted by joseph 8 years ago

Hi Will.

Thank you so much for the great software. I have a problem accessing the user acls from any page other than the one that performed the login operation. I AM testing all of this on a localhost - perhaps paths or sessions are not set up correctly?

Any suggestions?

Thanks!

Joseph

Hi Joseph

Could you post your code?

Best, Michael

posted by mblarsen 8 years ago

Hi Michael,

In config.php:

define('DOC_ROOT', realpath(dirname(__FILE__) . '/../'));
define('URL_ROOT', substr(DOC_ROOT, strlen(realpath($_SERVER['DOCUMENT_ROOT']))));

error_reporting(E_STRICT | E_ALL);
fCore::enableErrorHandling('html');
fCore::enableExceptionHandling('html');

fTimestamp::setDefaultTimezone('Asia/Bangkok');

fAuthorization::setLoginPage(URL_ROOT);

// This prevents cross-site session transfer
fSession::setPath(DOC_ROOT . '/data/session/');

In init.php:

include dirname(__FILE__) . '/config.php';

$db = new fDatabase('mysql', 'lv_repository', 'root', 'root');
fORMDatabase::attach($db);

fSession::open();

In index.php (where the login occurs, and in one directory higher than config.php and init.php):

$valid_pass  = fCryptography::checkPasswordHash(fRequest::get('password'), $user->getPassword());			
		if ($valid_pass) {
			$level = new UserLevel($user->getLevelId());				
			fAuthorization::setUserACLs(
				array(
					'level'  				=> $level->getLevelName(),
					'process_asset'  		=> $user->getAccessProcessAsset(),
					'delete_asset'  		=> $user->getAccessDeleteAsset(),
					'approve_asset'  		=> $user->getAccessApproveAsset(),
					'link_asset'  			=> $user->getAccessLinkAsset(),
					'manage_category' 	 	=> $user->getAccessManageCategory(),
					'translate_category'  	=> $user->getAccessTranslateCategory(),
					'manage_user' 		 	=> $user->getAccessManageUser(),
					'assign_task'  			=> $user->getAccessAssignTask(),
					'report'  				=> $user->getAccessReport()
				)
			);
		} else {
			fMessaging::create('error', fURL::get(), 'The password entered is incorrect');
		}

And finally in my page trying to access the ACLs:

include './inc/init.php';

if (fAuthorization::checkACL('level', 'super_admin')) {

Please let me know if there is anything else you need. Thank you SO SO much for your help!

Joseph

posted by joseph 8 years ago

Did anyone have a chance to look over this? I am very grateful for any insights!

As a side note - it does not seem like the session data is being deleted (unless this happens infrequently)...

Thanks in advance,

Joseph

posted by joseph 8 years ago

All of the user details for fAuthorization are stored in the session. My initial thought it that something about the session cookie is causing issues. Can you check and see what is contained in the session by calling:

fCore::expose($_SESSION);

posted by wbond 8 years ago

Hi Will.

Even though fAuthorization has been called - the only thing that seems to be in the session is:

Array ( fSession::type => normal fSession::expires => 1294018005 )

Thanks so much for your help.

posted by joseph 8 years ago

So there is definitely a problem with session data being persisted. My first hunch would be a session cookie. You can use the session_id() function to get your session id and then print it to the page. Check to make sure it is the same when you reload the page. You can also use your browser to see if localhost is sending you cookies.

posted by wbond 8 years ago

Hi Will.

I put the fExpose call on the index.php page and saw an error this time around:

Warning
-------
{doc_root}\\lastvoices\\index.php(37): fAuthorization::setUserACLs(Array)
{doc_root}\\lastvoices\\inc\\flourish\\fAuthorization.php(439): fSession::regenerateID()
{doc_root}\\lastvoices\\inc\\flourish\\fSession.php(440): session_regenerate_id()
[internal function]
session_regenerate_id(): Cannot regenerate session id - headers already sent

The ACLs seem to still be set for that page, but are not in the session variable. Does anything in the code below look like it would modify the header?

include './inc/init.php';

$action = fRequest::get('action');

// --------------------------------- //
if ('log_out' == $action) {
	fAuthorization::destroyUserInfo();
	fMessaging::create('success', fURL::get(), 'You were successfully logged out');
	fURL::redirect(fURL::get());	
}
// --------------------------------- // 
if ('log_in' == $action && fRequest::isPost()) {	
	if (validateEmail(fRequest::get('email'))) {
		try {
			$user = new User(array('email' => fRequest::get('email')));			
		} catch (fNotFoundException $e) {
			fMessaging::create('error', fURL::get(), $e->printMessage());
		}		
		$valid_pass  = fCryptography::checkPasswordHash(fRequest::get('password'), $user->getPassword());			
		if ($valid_pass) {
			$level = new UserLevel($user->getLevelId());
			$accessArray = array(
				'level'  				=> $level->getLevelName(),
				'process_asset'  		=> $user->getAccessProcessAsset(),
				'delete_asset'  		=> $user->getAccessDeleteAsset(),
				'approve_asset'  		=> $user->getAccessApproveAsset(),
				'link_asset'  			=> $user->getAccessLinkAsset(),
				'manage_category' 	 	=> $user->getAccessManageCategory(),
				'translate_category'  	=> $user->getAccessTranslateCategory(),
				'manage_user' 		 	=> $user->getAccessManageUser(),
				'assign_task'  			=> $user->getAccessAssignTask(),
				'report'  				=> $user->getAccessReport()
			);
			fAuthorization::setUserACLs(
				$accessArray
			);
		} else {
			fMessaging::create('error', fURL::get(), 'The password entered is incorrect');
		}
	} else {
		fMessaging::create('error', fURL::get(), 'The email entered is invalid');
	}
}

posted by joseph 8 years ago

I don't know if you ever solved this, but here are a few thoughts for people having trouble in the future.

The warning about regenerating the session id is just because you exposed content before setting the fAuthorization user values. If you use ob_start(), you can get around this.
You should only be setting user info once per session with fAuthorization. Due to the security architecture of fAuthorization, the session id is regenerated whenever user information changes. Thus if you set the user info on every page, every request will generate a new session id. It is not necessary to set this user info on every request since it is saved in the session.
If you are still having trouble, I would look more into the session cookie being sent to your browser.

posted by wbond 8 years ago