online users counter going mad. (or cookie handling)

[insecure]

After upgrading from 2.5.2 to 2.6.1, the counter for online users seems to go mad. When navigating through my faq-site, the counter for guest users is increased by 1 on every new page load. The problem appeared only when not logged in. After logging in, the counter works as normal.
Clearing PMF related cookies didn't fix this problem.

Searching the forum pointed me to a similar problem some years ago: viewtopic.php?f=2&t=2232&start=0
The problem was related to mod_rewrite. Turning off mod_rewrite fixed the issue.

Disabling mod_rewrite in the pmf config also works for me in 2.6.1. Anyway, I want nice URLs. So I had a look at the pmf source. The problem, as I have pointed out so far, seems to be within inc/Session.php. In 2.5.2 there was

Code: Select all

        setcookie(PMF_COOKIE_NAME_SESSIONID, $sessionId, $_SERVER['REQUEST_TIME'] + PMF_SESSION_EXPIRED_TIME);

in 2.6.1 it is:

Code: Select all

        setcookie(
            PMF_COOKIE_NAME_SESSIONID,
            $sessionId, 
            $_SERVER['REQUEST_TIME'] + PMF_SESSION_EXPIRED_TIME,
            dirname(dirname(__FILE__)),
            $_SERVER['HTTP_HOST'],
            false,
            true);
    }

If I replace dirname(dirname(__FILE__)) with "/" and clear PMF related cookies, the counter works fine again. This is probably not a nice solution, but at least a point to start if anyone else complains.

While having a look at the PMF related cookies in my browser, I also noticed, that the cookies pmf_sid and pmf_auth are quite different. Maybe the code for setting the pmf_auth cookie should also get some review.

[Thorsten]

Hi,

I can confirm this issue.

If I replace dirname(dirname(__FILE__)) with "/" and clear PMF related cookies, the counter works fine again. This is probably not a nice solution, but at least a point to start if anyone else complains.

this does not fix this issue for me.

I'll work on a fix.

bye
Thorsten

[oldperl]

Hi,

while confirming this issue too i also fixed it for me. In 2.6.2 the function for generating the Cookie in Session.php looks like

Code: Select all

/**
     * Store the Session ID into a persistent cookie expiring PMF_SESSION_EXPIRED_TIME seconds after the page request.
     *
     * @param integer $sessionId Session ID
     * 
     * @return void
     */
    public static function setCookie($sessionId)
    {
        setcookie(
            PMF_COOKIE_NAME_SESSIONID,
            $sessionId, 
            $_SERVER['REQUEST_TIME'] + PMF_SESSION_EXPIRED_TIME,
            dirname(dirname(__FILE__)),
            $_SERVER['HTTP_HOST'],
            false);
    }

The reason for that malfunction is the last parameter, which will not work with every useragent (see Parameters http://php.net/manual/en/function.setcookie.php).
So if i don't use this parameter, all works fine, because then a Cookie with the sid is set, which is needed by the userTracking-function.
If there exists a list with know useragents which will work with this parameter, u could use this parameter while comparing useragent with this list.

Regards Ortwin

[Thorsten]

Hi,

I fixed this in 2.6.2 by removing the last two parameters of setcookie().

bye
Thorsten

[RWarnecke]

Hello,

I have the same problem. When I remove the two last parameters, that has no effect. What can I do ?

[Thorsten]

Hi,

upgrade to 2.6.2 and everything will be fine.

bye
Thorsten

[RWarnecke]

I have upgrading from 2.5.4 to 2.6.2. Look at Code-Orakel

[Thorsten]

Hi,

strange... how does your method setCookie() in inc/Session.php look like?

bye
Thorsten

[RWarnecke]

Code: Select all

    public static function setCookie($sessionId)
    {
        setcookie(
            PMF_COOKIE_NAME_SESSIONID,
            $sessionId, 
            $_SERVER['REQUEST_TIME'] + PMF_SESSION_EXPIRED_TIME,
            dirname(dirname(__FILE__)),
            $_SERVER['HTTP_HOST'],
            false);
    }

This is the actually function. When I set a comment to the two last parameters in the function, that has no effect. Ihave tested with PHP 5.2.10. When you need more Infos about the php installation on the server, use this link.

[Thorsten]

Hi,

could you please try to remove the last parameter?

bye
Thorsten

[RWarnecke]

I have remove the last two parameters. It's online.

[Thorsten]

Hi,

very strange... I'll check this issue.

bye
Thorsten

[pommesfritz]

hi, i experienced the same problem under 2.6.3.

the setCookie in inc/Session.php in 2.6.3 looks like this:

Code: Select all

 public static function setCookie($sessionId)
    {
        setcookie(
            PMF_COOKIE_NAME_SESSIONID,
            $sessionId, 
            $_SERVER['REQUEST_TIME'] + PMF_SESSION_EXPIRED_TIME,
            dirname($_SERVER['SCRIPT_NAME']),
            $_SERVER['HTTP_HOST']);
    }

i modified it to this: (equals 2.5.6.)

Code: Select all

  public static function setCookie($sessionId)
    {
        setcookie(
            PMF_COOKIE_NAME_SESSIONID,
            $sessionId, 
            $_SERVER['REQUEST_TIME'] + PMF_SESSION_EXPIRED_TIME);
    }

i have no php knowledge and i dont even know what i did there, but it works fine

[Thorsten]

Hi,

with which browser did you have this issue?

bye
Thorsten

[pommesfritz]

firefox AND internet explorer. both showed the same problem.

but one little thing is left. i use the german version and sometimes the counter shows 'user' instead of 'Besucher' ..