X-Git-Url: https://jasonwoof.com/gitweb/?a=blobdiff_plain;f=session.php;h=bd91a5b019e5fcf98fa1c78b919bde3f8939676a;hb=47d8b4705be324d466c0c4d12c5f808f0a02d09b;hp=26523c22d1e47a3b4deb0be522615f87107536a2;hpb=28ea182162da1c22d16f93bc2cb5619c14e222a7;p=wfpl.git

diff --git a/session.php b/session.php
index 26523c2..bd91a5b 100644
--- a/session.php
+++ b/session.php
@@ -36,15 +36,15 @@
 # generate a new random 16-character string
 function session_generate_key() {
 	$character_set = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789";
-    $id = "                ";
+	$id = "                ";
 
 	# PHP 4.2.0 and up seed the random number generator for you.
 	# Lets hope that it seeds with something harder to guess than the clock.
-    for($i = 0; $i < 16; ++$i) {
-        $id{$i} = $character_set{mt_rand(0, 61)};
-    }
+	for($i = 0; $i < 16; ++$i) {
+		$id{$i} = $character_set{mt_rand(0, 61)};
+	}
 
-    return $id;
+	return $id;
 }
 
 # track this user with a session cookie (ie a cookie that goes away when the
@@ -56,7 +56,7 @@ function session_new($length = 86400) {
 	db_insert('wfpl_sessions', 'session_key,length', $session_key, $length);
 	$GLOBALS['session_id'] = db_auto_id();
 	$GLOBALS['session_key'] = $session_key;
-	$_REQUEST['session_key'] = $session_key; #just in case someone calls session_exists() after session_new()
+	$_COOKIE['session_key'] = $session_key; #just in case someone calls session_exists() after session_new()
 	session_touch($length);
 	return $GLOBALS['session_key'];
 }
@@ -69,7 +69,7 @@ function session_touch($length = false) {
 	}
 	$expires = time() + $length;
 
-	header('Set-Cookie: session_key=' . $GLOBALS['session_key']);
+	header('Set-Cookie: session_key=' . $GLOBALS['session_key'] . '; Path=/');
 
 	db_update('wfpl_sessions', 'expires', $expires, 'where id=%i', $GLOBALS['session_id']);
 }
@@ -99,7 +99,7 @@ function session_purge_old() {
 
 # return true if a session exists
 function session_exists() {
-	if(!isset($_REQUEST['session_key'])) {
+	if(!isset($_COOKIE['session_key'])) {
 		return false;
 	}
 
@@ -107,7 +107,7 @@ function session_exists() {
 		return true;
 	}
 
-	$session_key = ereg_replace('[^a-zA-Z0-9]', '', $_REQUEST['session_key']);
+	$session_key = ereg_replace('[^a-zA-Z0-9]', '', $_COOKIE['session_key']);
 
 	if(!strlen($session_key) == 16) {
 		return false;
@@ -157,7 +157,7 @@ function logged_in() {
 
 
 
-# return username if a session exists and is authenticated
+# return true if a session exists and is authenticated
 function logged_in_as_admin() {
 	if(!session_exists()) {
 		return false;
@@ -170,7 +170,7 @@ function logged_in_as_admin() {
 }
 
 
-# find existing session, or make one
+# find existing session, or make one (name "session_init" was taken)
 function init_session() {
 	if(!session_exists()) {
 		session_new();