Home » Authentication » LiveUser » Bug #1925

[2004-07-20 14:14 UTC] worker at mompopmedia dot com

Description:
------------
Hi,

Perhaps I am going about this wrong, but when calling init() 2 times, the second time around init returns a PEAR_Error. What I am trying to do is first re-initialize a session, but if there is no session to restore, I want to login an anonymous user.

The gotcha is the second time init is called with 'anonymous' as the username, it returns a PEAR_Error LIVEUSER_ERROR_NOT_SUPPORTED saying that it cannot locate the auth container 'M.php' (which should be MDB2.php). I don't understand why on the second call (the first call does not raise an error), init() garbles the config array I defined when instantiating LiveUser as a singleton.

Reproduce code:
---------------
I got something like this going on:

$fw_user =& LiveUser::factory($fw_user_config);
if (PEAR::isError($fw_user)) {
trigger_error($fw_user->getMessage(), E_USER_ERROR);
}

$user = $fw_user->init();
if (PEAR::isError($user)) {
trigger_error($user->getMessage() . ' ' .$user->getUserInfo(), E_USER_WARNING);
}

if ($user === false) {
// authenticate as anonymous
$user = $fw_user->init('anonymous');
if (PEAR::isError($user)) {
Var_Dump::display($user); die();
trigger_error($user->getMessage() . ' ' .$user->getUserInfo(), E_USER_WARNING);
}
}

Expected result:
----------------
logged in user

[2004-07-20 18:15 UTC] smith at backendmedia dot com

I dont have a fix for this, but handling anonymous auth should be possible in a cleaner way.

[2004-07-20 18:21 UTC] worker at mompopmedia dot com

well, I think I have located the problem (s) -- while debugging it I came across several issues:

1) LiveUser_Auth_Container_MDB2::_readUserData is broken. CVS to, although CVS is not as broken. All quote()'s are broken:

235: $this->dbc->quote($handle, $this->authTableCols['handle']['type'])

240: $this->dbc->quote($this->encryptPW($passwd), $this->authTableCols['passwd']['type']);

should be:

235: $this->dbc->quote($handle, $this->authTableCols['required']['handle']['type'])

240: $this->dbc->quote($this->encryptPW($passwd), $this->authTableCols['required']['passwd']['type']);

Another gotcha: if $this->authTableCols['required']['passwd']['type'] is an empty string (which it is set as in the examples bundled with LiveUser), MDB2::quote() will return a PEAR::Error (type not defined). This is not checked in the LiveUser_Auth_Container_MDB2::_readUserData() method, resulting in broken SQL built.

When trying to init('anonymous'), it returns true although I noted one problem:

- Come lines 743 and 754 of LiveUser.php, $lulogin is marked true, and $this->_auth == null resulting in two "Trying to get property of non-object" notices. There shoud be a check first to see if $this_auth != null. something like this:

if ($lulogin && is_object($this->_auth) && ...

Thanks,

Michael

[2004-07-21 10:25 UTC] smith at backendmedia dot com

Ok I have commited your proposed changes. Will test them once I get through the other bug reports. Sanity checking for the options array should probably also be added eventually. I will add it to the todo list on the wiki.