Deactivate for session in users?

arkantos · Posted: Tue Feb 13, 2007 3:52 am Post subject: Deactivate for session in users?

How do i deactivate the SEO for registered-session in users?
Must be a faster way than putting the if - else in every file.

This because all sessions are lost when members signed up, the same with this board when it had enabled the SEO.

Also i have the viewtopic.php hack, i would like to know if mod_rewrite with your Advanced SEO mod is possible for viewtopic.php and how to do it.

Greets.

dcz

And welcome Very Happy

arkantos

dcz

arkantos

dcz

arkantos

ok, very gratefull, now i can disable seo without doing the else if for every file.

But i wonder if to include the global $userdata; in phpbb_seo.php could be dangerous in anyway? like XSS in the URL or something?

dcz

No risks at all Wink

Here, we do all the job through the phpbb_seo class, which is already preventing us from weird globalization.

Then, we only globalise $userdata in the profile() method, and then, the var used is supposed to be Boolean, so the worst that could happen would be if someone would make it to inject something else than 0 or 1 in $userdata['session_logged_in'].

Basically, if $userdata['session_logged_in'] is not 0, it will be true, so the greater risk you're taking here is to see an url rewritten for a guest who would have injected something in $userdata['session_logged_in'].

All this being said, it's quite hard to inject code in the $userdata array, at least without register global on and with an up to date phpBB install.

I'm just telling that even in this case, the phpbb_seo class would be secure Wink

And if injecting data in the $userdata array is hard (really I mean), injecting datas into the phpbb_seo class is even closer to impossible. No one can ever talk about 100% in such matters, but, the class is well initialised and fully separated from the other vars in phpBB (no global trick is possible).

++

arkantos

Hiya, i need some help again.

Ive noticed sessions still lost for loged in users, in the part of the "viewtopic?=P" its the post , ive tried to find a way to disable it but i messed code hehehe and it had a failure. Fortunately i had backup for this.
Users lose sessions when they edit/delete/move/quote a post and i saw its because it redirects to the REWRITED URL like eg. post-4343-4343.html

So i want to disable the rewrite for the POST sessions specified as

# POST
RewriteRule ^post([0-9]+)\.html$ /viewtopic.php?p=$1 [QSA,L]

I want to disable that for logged in users but to be available to guests and bots.

Greets

dcz

Well, you can totally get rid of the rewriting for post links if you prefer, these are redirected no matter what with the zero dupe, so we can fully deactivate this part of the rewriting to all users.

To fully deactivate post url rewriting, just delete this part in phpbb_seo_class.php :

arkantos

Yes its because in early versions of PHPBB i had so many SEO improvements like the first able2know, the austin dinamyc, some code of mine.

And time passed with new phpbb updates, and i forgot which code ive modified so there is code from me in sessions.php and whatever that cuts all SID in rewrite and for guests but i do not remember where did i put that.
Could be in sessions.php or common or page_header.

Anyway im convinced this will do the thing

EDIT:

Hehehe this works very good, now sessions are there, just in some forums the PAGINATION still shows the rewrite but this is strange it only does for some forums, but anyway i do not have problems with that i think.

Greets and thanks for the help.

dcz

If you can post a link for me to see the wrong link, we can manage to do something I think Wink

++