Skip to content

use cookies instead of session #563

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
simonLeary42 wants to merge 3 commits into from
Closed

use cookies instead of session #563

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
354631d
use cookies instead of session
simonLeary42 Jan 23, 2026
77d7b03
avoid test case pollution
simonLeary42 Jan 23, 2026
8dead44
don't unset logged in cookie
simonLeary42 Jan 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 9 additions & 16 deletions resources/init.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,6 @@
use UnityWebPortal\lib\UnityUser;
use UnityWebPortal\lib\UnityWebhook;
use UnityWebPortal\lib\UnityGithub;
use UnityWebPortal\lib\UnityHTTPD;
use UnityWebPortal\lib\UserFlag;

if (CONFIG["site"]["enable_exception_handler"]) {
Expand Down Expand Up @@ -55,26 +54,20 @@
}

if (isset($_SERVER["REMOTE_USER"])) {
// Check if SSO is enabled on this page
_setcookie("navbar_show_logged_in_user_pages", "true");
$SSO = UnitySSO::getSSO();
$_SESSION["SSO"] = $SSO;

$OPERATOR = new UnityUser($SSO["user"], $LDAP, $SQL, $MAILER, $WEBHOOK);
$_SESSION["is_admin"] = $OPERATOR->getFlag(UserFlag::ADMIN);

$_SESSION["OPERATOR"] = $SSO["user"];
$_SESSION["OPERATOR_IP"] = $_SERVER["REMOTE_ADDR"];

if (isset($_SESSION["viewUser"]) && $_SESSION["is_admin"]) {
if (
isset($_SESSION["viewUser"]) &&
$LDAP->userFlagGroups["admin"]->memberUIDExists($SSO["user"])
) {
$USER = new UnityUser($_SESSION["viewUser"], $LDAP, $SQL, $MAILER, $WEBHOOK);
} else {
$USER = $OPERATOR;
$USER = new UnityUser($SSO["user"], $LDAP, $SQL, $MAILER, $WEBHOOK);
}

$_SESSION["user_exists"] = $USER->exists();
$_SESSION["is_pi"] = $USER->isPI();

$SQL->addLog("user_login", $OPERATOR->uid);

_setcookie("navbar_show_admin_pages", $USER->getFlag(UserFlag::ADMIN) ? "true" : "false");
_setcookie("navbar_show_pi_pages", $USER->isPI() ? "true" : "false");
$SQL->addLog("user_login", $SSO["user"]);
$USER->updateIsQualified(); // in case manual changes have been made to PI groups
}
14 changes: 14 additions & 0 deletions resources/lib/utils.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -283,3 +283,17 @@ function _curl_exec(CurlHandle $handle): string
}
return $output;
}

function _setcookie(
string $name,
string $value,
int $ttl_seconds = 600,
string $path = "/",
string $domain = "",
bool $secure = false,
bool $httponly = false,
): void {
setcookie($name, $value, time() + $ttl_seconds, $path, $domain, $secure, $httponly);
// $_COOKIE won't see this change until the next page load, update it now
$_COOKIE[$name] = $value;
}
33 changes: 7 additions & 26 deletions resources/templates/header.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,10 +5,7 @@
if ($_SERVER["REQUEST_METHOD"] == "POST") {
// another page should have already validated and we can't validate the same token twice
// UnityHTTPD::validatePostCSRFToken();
if (
($_SESSION["is_admin"] ?? false) == true
&& ($_POST["form_type"] ?? null) == "clearView"
) {
if (($_POST["form_type"] ?? null) == "clearView") {
unset($_SESSION["viewUser"]);
UnityHTTPD::redirect(getURL("admin/user-mgmt.php"));
}
Expand All @@ -21,13 +18,8 @@
UnityHTTPD::redirect();
}

if (isset($SSO)) {
if (
!$_SESSION["user_exists"]
&& !str_ends_with($_SERVER['PHP_SELF'], "/panel/new_account.php")
) {
UnityHTTPD::redirect(getURL("panel/new_account.php"));
}
if (isset($USER) && !$USER->exists() && !str_ends_with($_SERVER['PHP_SELF'], "/new_account.php")) {
UnityHTTPD::redirect(getURL("panel/new_account.php"));
}

?>
Expand Down Expand Up @@ -100,30 +92,23 @@
CONFIG["menuitems"]["labels"][$i] . "</a>\n";
}

if (isset($_SESSION["user_exists"]) && $_SESSION["user_exists"]) {
if (($_COOKIE["navbar_show_logged_in_user_pages"] ?? "false") === "true") {
echo "<hr class='navHR'>\n";
// Menu Items for Present Users
echo getHyperlink("Account Settings", "panel/account.php") . "\n";
echo getHyperlink("My PIs", "panel/groups.php") . "\n";

if (isset($_SESSION["is_pi"]) && $_SESSION["is_pi"]) {
// PI only pages
if (($_COOKIE["navbar_show_pi_pages"] ?? "false") === "true") {
echo getHyperlink("My Users", "panel/pi.php") . "\n";
}

// additional branding items
$num_additional_items = count(CONFIG["menuitems_secure"]["labels"]);
for ($i = 0; $i < $num_additional_items; $i++) {
echo "<a target='_blank' href='" . CONFIG["menuitems_secure"]["links"][$i] . "'>" .
CONFIG["menuitems_secure"]["labels"][$i] . "</a>\n";
}

// admin pages
if (
isset($_SESSION["is_admin"]) && $_SESSION["is_admin"] && !isset($_SESSION["viewUser"])
) {
if (($_COOKIE["navbar_show_admin_pages"] ?? "false") === "true") {
echo "<hr class='navHR'>\n";
// Admin only pages
echo getHyperlink("User Management", "admin/user-mgmt.php") . "\n";
echo getHyperlink("PI Management", "admin/pi-mgmt.php") . "\n";
}
Expand Down Expand Up @@ -177,11 +162,7 @@
);
}
echo "</div>";
if (
isset($_SESSION["is_admin"])
&& $_SESSION["is_admin"]
&& isset($_SESSION["viewUser"])
) {
if (isset($_SESSION["viewUser"])) {
$viewUser = $_SESSION["viewUser"];
$CSRFTokenHiddenFormInput = UnityHTTPD::getCSRFTokenHiddenFormInput();
echo "
Expand Down
2 changes: 1 addition & 1 deletion resources/templates/home.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@
Welcome to the UnityHPC Platform Account Portal.
Here you can manage your SSH keys, join and leave PI groups, manage your own PI group, and more.
<?php
if (!($_SESSION["user_exists"] ?? false)) {
if (($_COOKIE["navbar_show_logged_in_user_pages"] ?? "false") === "false") {
$hyperlink = getHyperlink("Log In", "panel/account.php");
echo "Please $hyperlink for more information.";
}
Expand Down
1 change: 0 additions & 1 deletion test/functional/ViewAsUserTest.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,6 @@ public function _testViewAsUser(string $beforeNickname, string $afterNickname)
http_get(__DIR__ . "/../../resources/init.php");
// now we should be new user
$this->assertEquals($afterUid, $USER->uid);
// $this->assertTrue($_SESSION["user_exists"]);
http_post(__DIR__ . "/../../webroot/panel/account.php", [
"form_type" => "clearView",
]);
Expand Down
4 changes: 4 additions & 0 deletions test/phpunit-bootstrap.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -72,6 +72,7 @@ function http_post(string $phpfile, array $post_data, bool $do_generate_csrf_tok
{
global $LDAP, $SQL, $MAILER, $WEBHOOK, $GITHUB, $SITE, $SSO, $USER, $LOC_HEADER, $LOC_FOOTER;
$_PREVIOUS_SERVER = $_SERVER;
$_PREVIOUS_COOKIE = $_COOKIE;
$_SERVER["REQUEST_METHOD"] = "POST";
$_SERVER["PHP_SELF"] = _preg_replace("/.*webroot\//", "/", $phpfile);
$_SERVER["REQUEST_URI"] = _preg_replace("/.*webroot\//", "/", $phpfile); // Slightly imprecise because it doesn't include get parameters
Expand All @@ -96,13 +97,15 @@ function http_post(string $phpfile, array $post_data, bool $do_generate_csrf_tok
} finally {
unset($_POST);
$_SERVER = $_PREVIOUS_SERVER;
$_COOKIE = $_PREVIOUS_COOKIE;
}
}

function http_get(string $phpfile, array $get_data = [], bool $ignore_die = false): string
{
global $LDAP, $SQL, $MAILER, $WEBHOOK, $GITHUB, $SITE, $SSO, $USER, $LOC_HEADER, $LOC_FOOTER;
$_PREVIOUS_SERVER = $_SERVER;
$_PREVIOUS_COOKIE = $_COOKIE;
$_SERVER["REQUEST_METHOD"] = "GET";
$_SERVER["PHP_SELF"] = _preg_replace("/.*webroot\//", "/", $phpfile);
$_SERVER["REQUEST_URI"] = _preg_replace("/.*webroot\//", "/", $phpfile); // Slightly imprecise because it doesn't include get parameters
Expand All @@ -124,6 +127,7 @@ function http_get(string $phpfile, array $get_data = [], bool $ignore_die = fals
} finally {
unset($_GET);
$_SERVER = $_PREVIOUS_SERVER;
$_COOKIE = $_PREVIOUS_COOKIE;
}
}

Expand Down