Topic: PHPSESSID Corrupting HTML links

[russ skinner]

Hi all,

I have added a custom block to my home page which contains three html links to specific posts in my forum - a mini navigation menu if you like. The block is visible to all forum users, including guests.

Whilst the links work fine for forum members logged in, for guests arriving at the home page for the first time the links are corrupted with PHPSESSID code:

Link property (as it appears for guest)

http://www.srcmc.co.uk/forum/index.php?PHPSESSID=b3e917637cf803faf93f7f794a9b9361&/topic,1710.0.html

Should be (as it appears for signed in members of forum)

http://www.srcmc.co.uk/forum/index.php/topic,1710.0.html

A page refresh seems to clear the problem with the links reverting to the correct state.

I've had tried coding the blocks using BB code, HTML and PHP and nothing seems to clear the problem. I notice the built in 'Recent Post' block does not experience the same problem; the links work fine for guests.

Can anyone suggest a fix?

Thanks,

Russ

[russ skinner]

Have just noticed that any links (html, BBcode) to forum posts which are visible on the portal homepage - for example in news blocks, articles etc if viewed by guests on their first visit to the site are corrupted by PHPSESSID coding, hence are affectively null. Note, this does not apply to recent posts, topics blocks etc.

Shame there is now way round this problem - many guests have arrived at my site and once they find a null link they lose interest. For example check out the following link 'Follow His Build Thread' on the central news block here - www.srcmc.co.uk

[[SiNaN]]

I have a feeling that this might be caused by this fix:

http://dev.simplemachines.org/mantis/view.php?id=3418

Revert the suggested fix and try again.

[russ skinner]

SiNaN,

Can you please just clarify.

Here is the bug patch (suggested in the thread you mentioned) -

Code: [Select]

--- QueryString.php (revision 8709)
+++ QueryString.php (working copy)
@@ -189,10 +189,13 @@
 
  // !!! smflib.
  // Replace 'index.php/a,b,c/d/e,f' with 'a=b,c&d=&e=f' and parse it into $_GET.
- parse_str(substr(preg_replace('/&(\w+)(?=&|$)/', '&$1=', strtr(preg_replace('~/([^,/]+),~', '/$1=', substr($request, strpos($request, basename($scripturl)) + strlen(basename($scripturl)))), '/', '&')), 1), $temp);
- if (function_exists('get_magic_quotes_gpc') && @get_magic_quotes_gpc() != 0 && empty($modSettings['integrate_magic_quotes']))
- $temp = $removeMagicQuoteFunction($temp);
- $_GET += $temp;
+ if (strpos($request, basename($scripturl) . '/') !== 0)
+ {
+ parse_str(substr(preg_replace('/&(\w+)(?=&|$)/', '&$1=', strtr(preg_replace('~/([^,/]+),~', '/$1=', substr($request, strpos($request, basename($scripturl)) + strlen(basename($scripturl)))), '/', '&')), 1), $temp);
+ if (function_exists('get_magic_quotes_gpc') && @get_magic_quotes_gpc() != 0 && empty($modSettings['integrate_magic_quotes']))
+ $temp = $removeMagicQuoteFunction($temp);
+ $_GET += $temp;
+ }
  }
 
  // If magic quotes is on we have some work...

and here is the existing code in sources/Querystring.php -

Code: [Select]

// !!! smflib.
// Replace 'index.php/a,b,c/d/e,f' with 'a=b,c&d=&e=f' and parse it into $_GET.
if (strpos($request, basename($scripturl) . '/') !== false)
{
parse_str(substr(preg_replace('/&(\w+)(?=&|$)/', '&$1=', strtr(preg_replace('~/([^,/]+),~', '/$1=', substr($request, strpos($request, basename($scripturl)) + strlen(basename($scripturl)))), '/', '&')), 1), $temp);
if (function_exists('get_magic_quotes_gpc') && @get_magic_quotes_gpc() != 0 && empty($modSettings['integrate_magic_quotes']))
$temp = $removeMagicQuoteFunction($temp);
$_GET += $temp;
}
}

// If magic quotes is on we have some work...
I have tried the code in the patch (don't think this is what you meant) and I ended up with a 500 server error.

[[SiNaN]]

Nevermind, it doesn't seem related. But it's not something specific to portal and happens on the message display as well. I'm pretty sure it's a bug with ob_sessrewrite() function in QueryString.php file but I'll have to check the code when I get some time.

[russ skinner]

No worries, it's only a minor issue anyway.

[[SiNaN]]

I have checked the function and still not sure what could be the cause. The best I can suggest is seeking help over simplemachines.org support forums, since the issue isn't related to SimplePortal, but a bug in SMF itself.

[russ skinner]

Ok, many thanks, will do.

[[SiNaN]]

No problems. I couldn't be much of help though. Would you mind if I mark this as solved then, so that it won't appear in our open support topics list?

[russ skinner]

No problem with marking as solved.

[locutusweb]

I know this is an old topic but I got the same problem as russ did and I hope someone is helped with my solution in the future.

The problem is that SMF "injects" the PHPSESSID query so your pretty url simpleportal won't work for that link. It shows a page with only a theme. The only safe fix is to turn search engine friendly URL's off in the SMF forum settings.

You ccould remove the PHPSESSID string, but it is there for security reasons and it is recommended not to do so.