Skip to content

Commit

Permalink
fix unable to login if bad btUsername cookie
Browse files Browse the repository at this point in the history
Ran across this bug when I disabled one account from another account. Was completely unable to login with any account because $_COOKIE['btUsername'] was not getting changed during the login process.

Testing revealed this to happen anytime $_COOKIE['btUsername'] was an invalid username or a disabled user.

Nasty bug. Took me like an hour to debug.

May only be partially fixed. I was stuck and ready to give up on this until I cleared all my cookies. Then I reproduced it by putting the invalid btUsername cookie back. Then my patch started working. Suggests that maybe the sessionID cookie was causing the username cookie to get reset or something.
  • Loading branch information
RedDragonWebDesign committed Jan 25, 2024
1 parent 3efaa9a commit 0c5d173
Showing 1 changed file with 25 additions and 0 deletions.
25 changes: 25 additions & 0 deletions src/login.php
Original file line number Diff line number Diff line change
Expand Up @@ -67,6 +67,31 @@
$fail = false;
echo "
<script type='text/javascript'>
// Fakhruddin Ujjainwala, CC BY-SA 4.0, https://stackoverflow.com/a/24103596/3480193
function setCookie(name,value,days) {
var expires = \"\";
if (days) {
var date = new Date();
date.setTime(date.getTime() + (days*24*60*60*1000));
expires = \"; expires=\" + date.toUTCString();
}
document.cookie = name + \"=\" + (value || \"\") + expires + \"; path=/\";
}
// When logging in, we need to overwrite any existing cookies, to prevent a bug where you can't log in if you got disabled while logged in.
// You can't set cookies in PHP after you've written any output.
// Therefore, we'll do it in JavaScript.
setCookie(
'btUsername',
'" . $_SESSION['btUsername'] . "',
'" . $COOKIE_EXP_TIME . "'
);
setCookie(
'btPassword',
'" . $_SESSION['btPassword'] . "',
'" . $COOKIE_EXP_TIME . "'
);
window.location = 'members/';
</script>
";
Expand Down

0 comments on commit 0c5d173

Please sign in to comment.