CODEWITHSUNDEEP
php
Timo002
Timo002

Reputation: 3208

PHP opening link from Excel runs page three times

I'm having a strange issue, which I find difficult to summarize in a title.

First:

The problem: When people are logged in, and they click on the link in the Excel document. The webpage tells them that they are not logged in.

What I found so far:

I did some tests.

Every URL goes through index.php

index.php

<?php
session_start();
file_put_contents('log.txt', microtime().': SERVER '.print_r($_SERVER, true).PHP_EOL, FILE_APPEND);
exit;

Now when I click the link from Office on Mac (NO ISSUES!!!), I get a dump of the variable $_SERVER. Two important variables:

[HTTP_USER_AGENT] => Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36
[HTTP_COOKIE] => PHPSESSID=77lpqmdmvskv33d2ddsdlfs5q7; rememberme=1%3Ae79e92271e7e05a5ee5679b659b3cb5cbb61e60d96c158f4648960136b175164%3Accdee80c3e42705fcd7e8c234525beda86d27394653dfdfb42bdd3ec98592ca1

You can see the browser (Chrome) and the cookie, which contains a rememberme cookie for login.

Now, when I do the same by clicking on a link in Excel on Windows, I get the $_SERVER variable printed three times in the log file!

First:

[HTTP_USER_AGENT] => Microsoft Office Excel 2014
[HTTP_COOKIE] => PHPSESSID=0ivlfjf49j4b82858tstc2lmm3; PHPSESSID=tv6gs33j721d0tmm3rrjdoho45

Notice the user agent and no rememberme cookie.

Second:

[HTTP_USER_AGENT] => Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; ms-office)
[HTTP_COOKIE] => PHPSESSID=0ivlfjf49j4b82858tstc2lmm3

Notice, still no chrome browser and rememberme cookie.

Third:

[HTTP_USER_AGENT] => Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36
[HTTP_COOKIE] => PHPSESSID=3s0hvtssghk7uomvkpb5k70tc2; rememberme=1%3Aa9bd74ad58a0d7075c27108be1adbd26ba6d18f6e8b39073152d6780131ffe70%3A643852f8636c76c0bfc4017ec7fe3eab98dd57f5bcfdf86f0e37b5ec28a0c0ef

Finally user agent is Chrome and rememberme cookie is set.

So, it's getting a long story. But clicking on the link in Excel from Windows, it does strange things. Anyone an idea what is happening?

Upvotes: 1

Views: 269

Answers (1)

Timo002
Timo002

Reputation: 3208

Oke, I found the problem. Below an answer from superuser.com

The URL you're using needs some more information from a cookie to display the search results rather than the search page. Paste the URL into a different browser (or remove your cookies) and you'll get the same results.

Clicking a URL in Excel seems to open it in your default browser. But that's not really true. Before opening it in your browser, Excel first runs Microsoft Office Protocol Discovery. This uses a Windows/Internet Explorer component to determine if the URL works. (It does not identify itself as Internet Explorer, but as "User Agent: Microsoft Office Existence Discovery".) And if the results are (somehow) okay then it will open the result of that check in your default browser.

Lacking the cookies (more precisely: lacking a session), GoDaddy gives that Internet Explorer component some redirect. And the result of that is opened in your default browser. That's the URL you're seeing.

Most likely your default browser is not Internet Explorer? Then pasting the URL into IE directly and clicking it, to get the cookies, might then also make the link work from Excel. (Just for testing; it's not a permanent solution.)

You will have more luck using a URL that does not rely on some hidden information from a cookie, like http://www.godaddy.com/domains/search.aspx?domainToCheck=superuser.com

Source: https://superuser.com/a/445431

So to solve this issue:
When Excel checked the link, it gets redirected to '/login' because it wasn't logged in. And finally that URL is the URL Excel opens in the real browser.

So I changed the login script and a user will not be redirected to '/login', but stay on the same URL and it will be shown the login form if not logged in. Excel now opens the original URL an if the user is logged in, it will see the page. If it is not logged in, the login form will be shown.

Upvotes: 1

Related Questions