Home » Authentication » Auth » Bug #1535

[2004-06-01 22:54 UTC] wetstreams at yahoo dot com

Description:
------------
PEAR::Auth v.1.2.3

If you supply only a DSN string as the second argument to Auth::Auth(), the session variable used by auth is set to the first character of the DSN.

In the manual, this statment is wrong:

http://pear.php.net/manual/en/package.authentication.auth.intro.php:
============================
For now one cannot use
<?php
$auth = new Auth(...);
?>

with register_globals=on, because $auth is also the name of the session variable, that is internally used by PEAR::Auth.
============================

In the source code file Auth.php:
=============================
/**
* Auth session-array name
*
* @var string
*/
var $_sessionName = '_authsession';
=============================
an attempt is made to use '_authsession' as the name, but the code below:

Reproduce code:
---------------
function Auth($storageDriver, $options = '', $loginFunction = '', $showLogin = true)
{
if (!empty($options['sessionName'])) {
$this->_sessionName = $options['sessionName'];
print("<p>Session name set:$this-sessionName.</p>");//added for testing
unset($options['sessionName']);
}

Actual result:
--------------
always evaluates true for (!empty($options['sessionName']) and PHP sets $_sessionName to the first letter of the DSN string.