CODEWITHSUNDEEP
phpsession
KellyM
KellyM

Reputation: 2522

Sessions Struggles - PHP

For my application, there are three levels of users:

The interface built allows users to create messages that will be distributed to a mobile app.

I had it working fine, but was then later tasked to add the mid-level. Now, even though the messages appear to update properly, I am encountering an issue that, instead of displaying "Message Updated" and the form after a message is submitted, I am receiving the "You do not have permission to access this page" message.

This does NOT occur with the mid/district level, only the lower and upper levels. Some reason, for these two, it is not properly reading $_SESSION['store'] after the form is submitted (though it works as expected when the page is loaded normally, not via POST).

I would greatly appreciate any guidance:

 <?php
session_start();

function format($input) {
$input = trim($input);
$input = stripcslashes($input);
$input = htmlspecialchars($input);
return $input;
}
 $con = new PDO("sqlite:managers.db");
$store = $_SESSION['store'];
$stores;
$file;
$district;


$file = "messages/" . $store . ".txt";

if(!file_exists($file)) {
$temp = fopen($file, "w"); // create file
fclose($temp);
}


if(strpos("d", $store) == 0) { 
$district = true;
$sql = "SELECT district FROM managers WHERE store = '$store'";
$statement = $con->query($sql);
$row = $statement->fetch();
$storesArray = explode(",", $row[0]);
}



if($_SERVER['REQUEST_METHOD'] == 'POST') {

$newMessage = format($_POST['message']);


$writer = fopen($file, "w");
fwrite($writer, $newMessage);
fclose($writer);


if($district) {
foreach($storesArray as $store) {
$fileName = "messages/d" . $store . ".txt";

if(!file_exists($fileName)) {
$temp = fopen($fileName, "w"); // create file
fclose($temp);
}

$writer = fopen($fileName, "w");
fwrite($writer, $newMessage);
fclose($writer);

}
}
}


$handler = fopen($file, "r");

$currentMessage = fread($handler, filesize($file));
fclose($handler);



?>


// some code omitted //



<?php 
if($store == "" || $store == null) {
echo "<p>You do not have permission to view this page</p>";
} else {


echo "<h2>Manage Messages";  if($store == "00") {
echo "<a href='admin.php'><input type='button' id='adminBack' value='Back' /></a></h2>";
} else {
echo "<a href='adminUI.php'><input type='button' id='adminBack' value='Back' /></a></h2>";
}

if($_SERVER['REQUEST_METHOD'] == 'POST') {
echo "<h2>Message Updated!</h2>";
}
echo "<form class='admin' class='col-md-6' method='post' action='manageMessages.php'>
<div class='form-group'>
<label for='message'> Message: </label> 
<textarea class='form-control' id='message' name='message' >$currentMessage</textarea>
<input type='submit' value='Post Message' />
</div>
</form>";

}
?>
 </div>
<!-- end page specific content -->

The login page that sets the session:

<?php
session_start();


function format($input) {
$input = trim($input);
$input = stripslashes($input);
$input = htmlspecialchars($input);
return $input;
};

$store; $pass; $valid;

echo "<script>function redirect() {
location.assign('manageMessages.php');
}

function adminRedirect() {
location.assign('admin.php');
}</script>";

if($_GET['logout']) {
session_unset();
session_destroy();

}
if($_SERVER['REQUEST_METHOD'] == "POST") {

if(!empty($_POST['store']) && !empty($_POST['pass'])) {
$store = format($_POST['store']);
$pass = format($_POST['pass']);

 $con = new PDO("sqlite:managers.db");

$sql = "SELECT *FROM managers WHERE store = '$store' AND password = '$pass'";

$statement = $con->query($sql); 
$rows = $statement->fetchAll();
$count = count($rows);
if($count != 1) {

$valid = false;

} else { 

$valid = true;
} 
}
 else {
 $valid = false;
 }


}
?>

// excess code //

<?php 
           $location;
          if($valid) {

     $_SESSION['store'] = $store;
          if($store == "00") {

         echo "<script>setTimeout(adminRedirect(), 1);</script>";
          } else {

          echo "<script>setTimeout(redirect(), 1);</script>";
          } } elseif ($valid === false) {
          echo "<h3>Please enter a valid store/password combination!</h3>";
          } 
          ?>
          <h2>Admin Login</h2>
          <form class="admin" method="post" action="adminUI.php"> 
          <div class="form-group">
          <label for="store">Store Number: </label> 
          <input type="text" class="form-control" name="store" id="store" />
          <label for="pass">Password:</label>
          <input type="text" class="form-control" name="pass" id="pass" />
          <input type="submit"  value="Login" />
          </div>
          </form>

Upvotes: 1

Views: 61

Answers (1)

Luthando Ntsekwa
Luthando Ntsekwa

Reputation: 4218

Your $store variable is being overwritten by your foreach: 

foreach($storesArray as $store)

You must use a different name for that foreach, something like: 

foreach($storesArray as $store2)

Upvotes: 2

Related Questions