bl-kernel session bug/fix

[arfa]

I read in bl-kernel/helpers/session.class.php [Bludit ver 3.22]

Code: Select all

private static $sessionName = 'BLUDIT-KEY';

Yes.
Then a bit further down...

Code: Select all

public static function start($path, $secure) { ....
// Sets the session name to the one set above.
// [b]Use the __Secure- prefix[/b] when served over HTTPS to prevent cookie hijacking.
$sessionName = $secure ? '__Secure-' . self::$sessionName : self::$sessionName;
session_name($sessionName);

session_name('__Secure-BLUDIT-KEY'); does not exist in ver. 3.15 !!

I imagine you might have noticed my other posts – mostly around the dis-function of my imageManager plugin. So, now I have nailed down the actual culprit; clearly not a bug BUT ........ how to work around this when using ajax?

I tried in *ajax.php using:

Code: Select all

$secure = (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off');
if ($secure) {
    session_name('__Secure-BLUDIT-KEY'); // see: ./bl-kernel/boot/inti.php
} else {
    session_name('BLUDIT-KEY');
} 
session_start();

And it works fine for 3.22 BUT not for 3.15

When was __Secure-BLUDIT-KEY introduced?
Which version?
While it is a fuzzy hack I can test for version number along with !empty($_SERVER['HTTPS']). I haven't tested this yet but am pretty sure it will work.

What is a better, cleaner way to work around this version change? please...

[Edi]

When was __Secure-BLUDIT-KEY introduced?
Which version?

Please see:

https://github.com/bludit/bludit/releas ... ase-3.18.0

Fix issue #1582:

https://github.com/bludit/bludit/issues/1582

[arfa]

Thank you Edi.
I have a version-fix in place and that works but it feels more like a patch than a fix. I will find a better solution (in time).

And good to have the 'releases' link. I looked all over gitHub but couldn't find a link-path to that.

go well – kusalo

[arfa]

Update...
The version fix worked but the following – set at the head of an ajax or similar page – seems a much tidier approach; a fix.

Code: Select all

// where are we coming from???
$secure = (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off');

if ($secure && isset($_COOKIE['__Secure-BLUDIT-KEY'])) {
    session_name('__Secure-BLUDIT-KEY');
} else {
    session_name('BLUDIT-KEY');
}
session_start();

Basically the issue is session naming and the cookie __Secure-BLUDIT-KEY seems a better test that version# being only present in some/later versions than 3.15 (which I was building in).

I have thoughts to write a 'how to use ajax in Bludit' as this has been quite a journey for me but... I will wait until ver.1.3 of my imageManager is released and gets some 👍
Thanks for your patience with all my bumping about :)