Topic: Redirect difficulties at login/logout with integrated site

I'm having problems when trying to integrate my site with PunBB following the instructions here.  My login form has a hidden field

    '<input type="hidden" name="redirect_url" value="'.$_SERVER['SCRIPT_NAME'].'" />'

and I've altered the logout section of login.php to

    redirect($_SERVER['HTTP_REFERER'], $lang_login['Logout redirect']);

so that logging in and out will return to the previous page, but when I do so from a page outside the forums directory the beginning part of the URL keeps getting doubled up like
http://localhost/mydir/forums/http://localhost/mydir/mypage.php

Should I just remove these two lines from the redirect function at line 864~ of functions.php?  Are they there for a reason?

    if (strpos($destination_url, $pun_config['o_base_url']) !== 0)
        $destination_url = $pun_config['o_base_url'].'/'.$destination_url;

Re: Redirect difficulties at login/logout with integrated site

Hi there, I'm having the same difficulties with the same script.  I've tried a few variations of defining my path at the start but on login, I get an extra slash created for a relative link (in a similar manner as your post above)...like, my login is redirected to:

http://www.mypage.com/forums//files.php? instead of http://www.mypage.com/files.php?

Any suggestions?

Re: Redirect difficulties at login/logout with integrated site

AracornRed: Removing those lines will expose you to a security risk.
lostcoin: We would need to see your code to figure out what's happening wink

Re: Redirect difficulties at login/logout with integrated site

My "files.php" page (which is one level above my forums directory) looks like:

<?php
define('PUN_ROOT', './forums/');
include 'forums/include/common.php';
include './login_function.inc.php';

login_menu();
?>

My login function "login_function.inc.php" (which is also one level above my forums directory) looks like:

<?php

function login_menu() {
global $pun_user;

if ($pun_user['is_guest']) {
  echo "<form id=\"login\" method=\"post\" action=\"/forums/login.php?action=in\" onsubmit=\"return process_form(this)\">
<input type=\"hidden\" name=\"form_sent\" value=\"1\" />
<input type=\"hidden\" name=\"redirect_url\" value=\"".$_SERVER['PHP_SELF']."?".$_SERVER['QUERY_STRING']."\" />
<input type=\"text\" name=\"req_username\" size=\"25\" maxlength=\"25\" />
<input type=\"password\" name=\"req_password\" size=\"16\" maxlength=\"16\" />
<input type=\"submit\" name=\"login\" value=\"Login\" />
</form>";
    }
else {
echo "Logged in as: ".pun_htmlspecialchars($pun_user['username'])."<br> Last visit: ". format_time($pun_user['last_visit'])."
<br>Click <a href=\"/boards/login.php?action=out&id=".$pun_user['id']."\">Log out</a>here</a> to log out.</a>";
}
}
?>

Re: Redirect difficulties at login/logout with integrated site

Aha. Yes, the redirect function will only redirect to paths within the forum base URL.

Re: Redirect difficulties at login/logout with integrated site

If I use the following (ie. without the slash on my define('PUN_ROOT'....) instead for my files.php page:

Code:
<?php
define('PUN_ROOT', './forums');
include 'forums/include/common.php';
include './login_function.inc.php';

login_menu();
?>

I get other errors like:

Warning: main(./forumsinclude/functions.php): failed to open stream: No such file or directory in /home/content/b/r/a/brainlung/html/forums/include/common.php on line 37

Warning: main(./forumsinclude/functions.php): failed to open stream: No such file or directory in /home/content/b/r/a/brainlung/html/forums/include/common.php on line 37

Fatal error: main(): Failed opening required './forumsinclude/functions.php' (include_path='.:/usr/local/lib/php') in /home/content/b/r/a/brainlung/html/forums/include/common.php on line 37

Re: Redirect difficulties at login/logout with integrated site

ah, okay...so basically any files I use with the login script need to be within the forums directory.

Thanks Smartys,

Re: Redirect difficulties at login/logout with integrated site

lostcoin wrote:

ah, okay...so basically any files I use with the login script need to be within the forums directory.

Thanks Smartys,

Is this true?  Is there any way I can pass an additional variable to it and override that so I can return the user to the page they came from?

Re: Redirect difficulties at login/logout with integrated site

There's code lying around somewhere that changes the check so it only looks for http: as opposed to the base URL, which works in most cases (obviously not for redirecting to https sites). I don't know it offhand.

10

Re: Redirect difficulties at login/logout with integrated site

This seemed to work for me in 1.2.16.  I tested the forum login, logout and logins / logouts from my own pages and everything seemed to work fine.

change this on line 852 of includes/functions.php:

    // Prefix with o_base_url (unless it's there already)
    if (strpos($destination_url, $pun_config['o_base_url']) !== 0)
        $destination_url = $pun_config['o_base_url'].'/'.$destination_url;

to

    /* Prefix with o_base_url (unless it's there already)
    if (strpos($destination_url, $pun_config['o_base_url']) !== 0)
        $destination_url = $pun_config['o_base_url'].'/'.$destination_url;*/

Re: Redirect difficulties at login/logout with integrated site

I will say this again: making those changes exposes your site to security risks. Do not do that.

12

Re: Redirect difficulties at login/logout with integrated site

Smartys wrote:

I will say this again: making those changes exposes your site to security risks. Do not do that.

+1 Smartys... (even +10,000 smile)
But you have to admit that this needed change in 1.2.16 has raised a lots of pbms for users like dolbex, who don't understand the "security" point, but are focused on the "visibility" point.. ("it worked, it doesn't work anymore").
This change of redirect() should have been more documented, providing examples of pbms it can occurs, and the way to resolve them.
When the user is lost, he generally chooses the 'easy/bad way', like dolbex did... sad

Re: Redirect difficulties at login/logout with integrated site

Mpok: A number of problems come from the fact that the check greatly reduces the number of valid redirects. A redirect with an absolute URL (eg: http://example.com/path/to/punbb/file.php) or with a relative URL (eg: file.php) work. Anything else no longer does. We're actively looking at ways to increase the flexibility of the URLs accepted while keeping forums secure.
Documenting the change wouldn't really have done much good, since some of the URLs previously redirected to are now impossible to redirect to. There are also too many permutations of code to generate a redirect URL for us to predict which a user is using and how to correct it. You're right that we should have drawn more attention to the change though.
And in any case, there is no excuse for making a change that was explicitly warned against earlier in this topic. wink

14

Re: Redirect difficulties at login/logout with integrated site

Mpok wrote:

When the user is lost, he generally chooses the 'easy/bad way', like dolbex did... sad

That is their choice and risk. This question has occured multiple times and almost always people have ignored the advice given. Documenting it until it comes out of ones ears won't stop people going for the easy option.

Re: Redirect difficulties at login/logout with integrated site

In any case, we've replaced the check in SVN with one that should restore all previous functionality.