[Phpgroupware-developers] xml-rpc and sessions

[Dirk Schaller]

Hi,

I had some trouble with xml-rpc and session handling.
After a successful xml-rpc login I got a 'session expired' message.
The problem appears only when I set the session setting to 'php4'.

I did some debugging and found the reason and solution for the problem:
When the xml-rpc client is logged in, he gets a sessionid for http
authentication. The next request sends the sessionid correctly from my
xml-rpc client to the xml-rpc phpGW server, but the 'old' session data
couldnt be loaded. Therefore a 'new' session starts, the
$_SESSION['phpgw_session'] is empty and I get the session expired nessage.
After the xml-rpc system.login and one other request I found two session
files on harddisk, one with session data from the login (old session) amd
one empty (new session started) from the requst.

So the main problem is to load the old session data. The solution is in my
view simple.
Before a session starts we have to set the old sessionid by running
sessionid().

The file class.sessions_php4.inc.php contains a method for loading the
session data, but without noticing the 'old' sessionid:

function read_session($sessionid)
{
        session_start();
        return $GLOBALS['phpgw_session'] = $_SESSION['phpgw_session'];
}

Before the session starts I run session_id() to set the correct 'old'
sessionid:

function read_session($sessionid)
{
        session_id($sessionid);
        session_start();
        return $GLOBALS['phpgw_session'] = $_SESSION['phpgw_session'];
}


Another method in this class also contains a start_session():

function register_session($login,$user_ip,$now,$session_flags)
{
        session_start();
        ...
}

Here we can use the class variable 'sessionid':

function register_session($login,$user_ip,$now,$session_flags)
{
        session_id($this->sessionid);
        session_start();
        ...
}


I hope someone can test it amd commit it to the .16 branch.


Now I have another aspect for discussion:
The xmlrpc.php is GPL and none GPL software couldnt use this interface.
In my view a LGPL licence is more flexible as the GPL licence for such a
interface file.
With LGPL we have the opportunaty the use more existing xml-rpc applications
with the groupware.


Thanks,
Happy new year!
Dirk


--
*****    Open Source und Linux im professionellen Einsatz    *****
**  komplexe Mailserver, Groupware, Office: sprechen Sie uns an **
Dipl.-Inform. (FH) Dirk Schaller
pro|business AG, EXPO Plaza 1 (Deutscher Pavillon), 30539 Hannover
E-Mail: address@hidden,  Tel.: 0511/60066-334, Fax: -355  
WWW: http://www.probusiness.de/