Skip to content

Commit b6a712e

Browse files
magicbugmagicbug
committed
Improve session and cookie handling for user login
Adds backup authentication cookie to address session issues and enhances logging for debugging session and cookie states. Updates encryption methods to handle null/empty data, refines session validation logic, and modernizes cookie parameter usage for PHP compatibility. Also improves error reporting and session cleanup during logout.
1 parent 911edd7 commit b6a712e

5 files changed

Lines changed: 114 additions & 21 deletions

File tree

‎application/controllers/User.php‎

Lines changed: 34 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1026,10 +1026,10 @@ function login()
10261026
$data['user'] = $query->row();
10271027

10281028
// Read the cookie remeber_me and log the user in
1029-
if ($this->input->cookie(config_item('cookie_prefix') . 'remember_me')) {
1029+
$remember_me_cookie = $this->input->cookie(config_item('cookie_prefix') . 'remember_me');
1030+
if ($remember_me_cookie && !empty($remember_me_cookie)) {
10301031
try {
1031-
$encrypted_string = $this->input->cookie(config_item('cookie_prefix') . 'remember_me');
1032-
$decrypted_string = $this->encryption->decrypt($encrypted_string);
1032+
$decrypted_string = $this->encryption->decrypt($remember_me_cookie);
10331033
$this->user_model->update_session($decrypted_string);
10341034
$this->user_model->set_last_login($decrypted_string);
10351035

@@ -1038,7 +1038,7 @@ function login()
10381038
redirect('dashboard');
10391039
} catch (Exception $e) {
10401040
// Something went wrong with the cookie
1041-
log_message('error', 'Remember Me Login Failed');
1041+
log_message('error', 'Remember Me Login Failed: ' . $e->getMessage());
10421042
$this->session->set_flashdata('error', 'Remember Me Login Failed');
10431043
redirect('user/login');
10441044
}
@@ -1054,6 +1054,25 @@ function login()
10541054
$this->session->set_flashdata('notice', 'User logged in');
10551055
$this->user_model->update_session($data['user']->user_id);
10561056
$this->user_model->set_last_login($data['user']->user_id);
1057+
1058+
log_message('debug', 'Login successful - Session ID: ' . session_id());
1059+
log_message('debug', 'Login successful - user_id in session: ' . $this->session->userdata('user_id'));
1060+
1061+
// Set a backup auth cookie as workaround for session issues
1062+
$user_id = $this->session->userdata('user_id');
1063+
if ($user_id) {
1064+
$encrypted_user_id = $this->encryption->encrypt($user_id);
1065+
setcookie('cloudlog_auth', $encrypted_user_id, [
1066+
'expires' => time() + 86400, // 24 hours
1067+
'path' => '/',
1068+
'domain' => '',
1069+
'secure' => false,
1070+
'httponly' => true,
1071+
'samesite' => ''
1072+
]);
1073+
log_message('debug', 'Set backup auth cookie for user_id: ' . $user_id);
1074+
}
1075+
10571076
$cookie = array(
10581077

10591078
'name' => 'language',
@@ -1075,6 +1094,14 @@ function login()
10751094
);
10761095
$this->input->set_cookie($cookie);
10771096
}
1097+
1098+
log_message('debug', 'About to redirect - Session ID: ' . session_id());
1099+
log_message('debug', 'Session cookie name: ' . session_name());
1100+
log_message('debug', 'Session data: ' . print_r($_SESSION, true));
1101+
1102+
// Force session to save
1103+
session_commit();
1104+
10781105
redirect('dashboard');
10791106
} else {
10801107
$this->session->set_flashdata('error', 'Incorrect username or password!');
@@ -1091,6 +1118,9 @@ function logout()
10911118

10921119
// Delete remember_me cookie
10931120
setcookie('remember_me', '', time() - 3600, '/');
1121+
1122+
// Delete backup auth cookie
1123+
setcookie('cloudlog_auth', '', time() - 3600, '/');
10941124

10951125
$this->user_model->clear_session();
10961126

‎application/models/User_model.php‎

Lines changed: 26 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -441,9 +441,33 @@ function update_session($id) {
441441
// Validate a user's login session
442442
// If the user's session is corrupted in any way, it will clear the session
443443
function validate_session() {
444-
444+
log_message('debug', 'validate_session called');
445+
log_message('debug', 'Session ID: ' . session_id());
446+
log_message('debug', 'Cookie: ' . print_r($_COOKIE, true));
447+
448+
// Check backup auth cookie first as workaround
449+
if (!$this->session->userdata('user_id') && isset($_COOKIE['cloudlog_auth']) && !empty($_COOKIE['cloudlog_auth'])) {
450+
log_message('debug', 'Session empty but backup cookie found, attempting restore');
451+
$CI =& get_instance();
452+
$CI->load->library('encryption');
453+
try {
454+
$encrypted_value = $_COOKIE['cloudlog_auth'];
455+
if (!empty($encrypted_value)) {
456+
$user_id = $CI->encryption->decrypt($encrypted_value);
457+
if ($user_id) {
458+
log_message('debug', 'Restored user_id from cookie: ' . $user_id);
459+
$this->update_session($user_id);
460+
return 1;
461+
}
462+
}
463+
} catch (Exception $e) {
464+
log_message('error', 'Failed to decrypt backup auth cookie: ' . $e->getMessage());
465+
}
466+
}
467+
445468
if($this->session->userdata('user_id'))
446469
{
470+
log_message('debug', 'validate_session: user_id found = ' . $this->session->userdata('user_id'));
447471
$user_id = $this->session->userdata('user_id');
448472
$user_type = $this->session->userdata('user_type');
449473
$user_hash = $this->session->userdata('user_hash');
@@ -457,6 +481,7 @@ function validate_session() {
457481
return 0;
458482
}
459483
} else {
484+
log_message('debug', 'validate_session: No user_id in session');
460485
return 0;
461486
}
462487
}

‎system/core/Exceptions.php‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -81,8 +81,9 @@ class CI_Exceptions {
8181
*/
8282
public function __construct()
8383
{
84-
// E_STRICT is deprecated in PHP 8.4, only add if defined
85-
if (defined('E_STRICT'))
84+
// E_STRICT is deprecated in PHP 8.4
85+
// Only add it for PHP < 8.4
86+
if (PHP_VERSION_ID < 80400 && defined('E_STRICT'))
8687
{
8788
$this->levels[E_STRICT] = 'Runtime Notice';
8889
}

‎system/libraries/Encryption.php‎

Lines changed: 13 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -369,8 +369,12 @@ public function create_key($length)
369369
* @param array $params Input parameters
370370
* @return string
371371
*/
372-
public function encrypt($data, array $params = NULL)
372+
public function encrypt($data, ?array $params = null)
373373
{
374+
if ($data === null || $data === '') {
375+
return FALSE;
376+
}
377+
374378
if (($params = $this->_get_params($params)) === FALSE)
375379
{
376380
return FALSE;
@@ -504,8 +508,12 @@ protected function _openssl_encrypt($data, $params)
504508
* @param array $params Input parameters
505509
* @return string
506510
*/
507-
public function decrypt($data, array $params = NULL)
511+
public function decrypt($data, ?array $params = null)
508512
{
513+
if ($data === null || $data === '') {
514+
return FALSE;
515+
}
516+
509517
if (($params = $this->_get_params($params)) === FALSE)
510518
{
511519
return FALSE;
@@ -910,6 +918,9 @@ public function __get($key)
910918
*/
911919
protected static function strlen($str)
912920
{
921+
if ($str === null) {
922+
return 0;
923+
}
913924
return (self::$func_overload)
914925
? mb_strlen($str, '8bit')
915926
: strlen($str);

‎system/libraries/Session/Session.php‎

Lines changed: 38 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -125,6 +125,11 @@ public function __construct(array $params = array())
125125
}
126126

127127
session_start();
128+
129+
log_message('debug', 'Session started - ID: ' . session_id());
130+
log_message('debug', 'Session name: ' . session_name());
131+
log_message('debug', '_COOKIE contents: ' . print_r($_COOKIE, true));
132+
log_message('debug', 'headers_sent: ' . (headers_sent() ? 'YES' : 'NO'));
128133

129134
// Is session ID auto-regeneration configured? (ignoring ajax requests)
130135
if ((empty($_SERVER['HTTP_X_REQUESTED_WITH']) OR strtolower($_SERVER['HTTP_X_REQUESTED_WITH']) !== 'xmlhttprequest')
@@ -147,11 +152,31 @@ public function __construct(array $params = array())
147152
setcookie(
148153
$this->_config['cookie_name'],
149154
session_id(),
150-
(empty($this->_config['cookie_lifetime']) ? 0 : time() + $this->_config['cookie_lifetime']),
151-
$this->_config['cookie_path'],
152-
$this->_config['cookie_domain'],
153-
$this->_config['cookie_secure'],
154-
TRUE
155+
[
156+
'expires' => (empty($this->_config['cookie_lifetime']) ? 0 : time() + $this->_config['cookie_lifetime']),
157+
'path' => $this->_config['cookie_path'],
158+
'domain' => $this->_config['cookie_domain'],
159+
'secure' => $this->_config['cookie_secure'],
160+
'httponly' => TRUE,
161+
'samesite' => ''
162+
]
163+
);
164+
}
165+
// Force set cookie for new sessions
166+
else
167+
{
168+
log_message('debug', 'Setting new session cookie: ' . $this->_config['cookie_name'] . ' = ' . session_id());
169+
setcookie(
170+
$this->_config['cookie_name'],
171+
session_id(),
172+
[
173+
'expires' => (empty($this->_config['cookie_lifetime']) ? 0 : time() + $this->_config['cookie_lifetime']),
174+
'path' => $this->_config['cookie_path'],
175+
'domain' => $this->_config['cookie_domain'],
176+
'secure' => $this->_config['cookie_secure'],
177+
'httponly' => TRUE,
178+
'samesite' => ''
179+
]
155180
);
156181
}
157182

@@ -267,13 +292,14 @@ protected function _configure(&$params)
267292
isset($params['cookie_domain']) OR $params['cookie_domain'] = config_item('cookie_domain');
268293
isset($params['cookie_secure']) OR $params['cookie_secure'] = (bool) config_item('cookie_secure');
269294

270-
session_set_cookie_params(
271-
$params['cookie_lifetime'],
272-
$params['cookie_path'],
273-
$params['cookie_domain'],
274-
$params['cookie_secure'],
275-
TRUE // HttpOnly; Yes, this is intentional and not configurable for security reasons
276-
);
295+
session_set_cookie_params([
296+
'lifetime' => $params['cookie_lifetime'],
297+
'path' => $params['cookie_path'],
298+
'domain' => $params['cookie_domain'],
299+
'secure' => $params['cookie_secure'],
300+
'httponly' => TRUE,
301+
'samesite' => ''
302+
]);
277303

278304
if (empty($expiration))
279305
{

0 commit comments

Comments
 (0)