Bug #3992

RememberMe feature doesn't work

Details

Submitted	2005-03-29 12:45 UTC
From	eljot22 at NOSPAM_yahoo dot com
Status	No Feedback
Package	LiveUser
PHP Version	4.3.9
OS	WindowsXP
Roadmaps	(Not assigned)

Comments

[2005-03-29 12:45 UTC] eljot22 at NOSPAM_yahoo dot com

Description:
------------
RememberMe cookie feature doesn't work when magic_quotes_gpc is turned on. Try to use it with default installation of PHP (by default magic_quotes_gpc is turned ON).

Reproduce code:
---------------
See LiveUser.php, function readRememberCookie():

$cookieData = @unserialize($_COOKIE[$this->_options['cookie']['name']]);

Expected result:
----------------
User should be logged in.

Actual result:
--------------
Login cookie removed and user not logged in. stripslashes() solved the problem for me.

[2005-03-29 12:47 UTC] smith at backendmedia dot com

Well I am kinda unsure how to deal with this. Magic quotes is evil (tm) and I hate to add code dealing with it to LiveUser. I would prefer leaving this job to the user. Opinions?

[2005-03-30 20:31 UTC] eljot22 at NOSPAM_yahoo dot com

Some hint to the user (error/warning) if $cookieData is empty? Configuration option?

[2005-03-30 20:43 UTC] smith at backendmedia dot com

Actually there should be an error placed on the stack and login() should return false.