Question

I keep having complaints that users are logged in as each other. They can even edit their profiles and post as them…this is obviously a huge issue. People who arent even registered are visiting the site and seeing they are logged in as other people.

This happens in Safari and Firefox

My sessions are set when people log in using the $_SESSION['variable'] = name; system, so pretty standard. The sessions are cross subdomain using:

ob_start();
session_set_cookie_params(0, '/', '.subverb.net');
session_start();

in the header of all my pages.

I have an iframe that holds the chat portion of the site which also contains the same header

I don’t know what other info I can give, so please ask. I really need this to get sorted but not sure what the problem is!

Thanks

---

In response to below:

The standard login script is lifted straight from a Larry Ullman textbook:

if ($un && $p) { // If everything's OK.

    // Query the database.
    $query = "SELECT member_id, member_firstname, member_type, username FROM member WHERE (username='$un' AND password=SHA('$p')) AND active IS NULL";  

    $result = mysqli_query ($dbc, $query) or trigger_error ("query: $query\n<br />MySQL Error: " . mysqli_error($query));

    if (@mysqli_num_rows($result) == 1) { // A match was made.

        // Register the values & redirect.
        $row = mysqli_fetch_array($result, MYSQLI_ASSOC);
        mysqli_free_result($result);

        $_SESSION['member_id'] = $row['member_id'];
        $_SESSION['first_name'] = $row['member_firstname'];
        $_SESSION['member_type'] = $row['member_type'];
        $_SESSION['username'] = $row['username'];

The facebook login script does the following:

$query = "SELECT * FROM member WHERE oauth_prov = 1 AND fb_userid = ".$user['id'];
    $result = mysqli_query ($dbc, $query) or trigger_error ("query: $query\n<br />MySQL Error: " . mysqli_error($dbc));


    if(mysqli_num_rows($result) == 1 ) {



    while ($row = mysqli_fetch_array($result, MYSQLI_ASSOC)) {;


    $_SESSION['first_name'] = $row['member_firstname'];
    $_SESSION['member_id'] = $row['user_id'];
    $_SESSION['oauth_uid'] = $row['fb_userid'];
    $_SESSION['username'] = $row['username'];

All of the inputs are sanitized and there are not other ways for the user to add the details. Username and password added as normal, facebook id got from Facebook by clicking a link that executes the script.

These errors are happening well past login tho, or when login hasnt even happened. There is no other place where session values are set on the site.

Answer 1

I would check the database routine that logs the users in for holes. Are you certain that it’s selecting the appropriate user and only the appropriate user? Have you tested whether your select statement is immune to different user input scenarios? Given that it persists across pageloads, it’s almost certainly a $_SESSION problem. Assuming you load info about the user at login, it follows that the problem comes with the initial population of the $_SESSION variable during login. As such, you should definitely check the login script to make sure it’s solid.

You may want to post other parts of your login script, so we can check it out for holes/problems.