Home » Authentication » LiveUser » Bug #2089

[2004-08-09 02:23 UTC] worker at mompopmedia dot com

Description:
------------
session_set_cookie_params() is never called with LiveUser config vars before session_start() which means that the LiveUser cookie config vars are not used -- session cookies are set using PHP session defaults.

around line 720, something like this sould be added:

session_set_cookie_params($this->_options['cookie']['lifetime'], $this->_options['cookie']['path'], $this->_options['cookie']['domain']);

as always, thanks!

Michael

[2004-08-09 03:11 UTC] worker at mompopmedia dot com

sorry that code should have read:

$cookieTimeout = time() + (86400 * $this->_options['cookie']['lifetime']);

session_set_cookie_params($cookieTimeout, $this->_options['cookie']['path'], $this->_options['cookie']['domain']);

[2004-08-28 15:33 UTC] smith at backendmedia dot com

hmm I didnt design this part of LiveUser, but it seems to me like those settings were meant to be used for the remember me cookie only. now maybe we should also use those settings for the session cookie.

[2004-10-11 11:33 UTC] smith at backendmedia dot com

turning this into a feature request.

[2004-12-08 19:15 UTC] smith at backendmedia dot com

Hmm I was just starting to add this code when I noticed that we probably need different directives for the remember me cookie and the session settings as you probably want a different lifetime for your remember me cookie than for your session for example.

[2004-12-08 19:58 UTC] smith at backendmedia dot com

This bug has been fixed in CVS.

In case this was a documentation problem, the fix will show up at the
end of next Sunday (CET) on pear.php.net.

In case this was a pear.php.net website problem, the change will show
up on the website in short time.

Thank you for the report, and for helping us make PEAR better.

Use the new 'session_cookie_params' option.