It appears the cookie-related code for web login is setting the username to the value of the cookieKey for some unknown reason (sigh). And after some further investigation, it appears that the rememberme code and cookie that one would think could keep an existing server-side session alive, is actually doing nothing but setting an extra cookie. The quick fix is available by editing the following files to remove the cookie code...
Add the comments to assets/snippets/weblogin/weblogin.inc.php, lines 17 through 26, with the exception of line 25, as shown here:
// if(isset($_COOKIE[$cookieKey])) {
// $cookieSet = 1;
// $sitename = $_COOKIE[$cookieKey];
// $thepasswd = substr($site_id,-5)."crypto"; // create a password based on site id
// $rc4 = new rc4crypt;
// $thestring = $rc4->endecrypt($thepasswd,$sitename,'de');
// $uid = $thestring;
// }else{
$uid = isset($_POST['username'])? $_POST['username']:'';
// }
Also, add comments to lines 354 through 362 of assets/snippets/weblogin/weblogin.processor.inc.php:
// if($_POST['rememberme']==1) {
// $username = $_POST['username'];
// $thepasswd = substr($site_id,-5)."crypto"; // create a password based on site id
// $rc4 = new rc4crypt;
// $thestring = $rc4->endecrypt($thepasswd,$username);
// setcookie($cookieKey, $thestring,time()+604800, "/", "", 0);
// } else {
// setcookie($cookieKey, "",time()-604800, "/", "", 0);
// }
Note however that this completely invalidates the usefulness of the rememberme checkbox, but, alas, it was doing nothing anyway. I’m going to try and address this with a proper cookie-based session solution as soon as possible, before delivering 0.9.5 final.
MODX Staff
MODX Staff