Re: [fw-auth] session storage problem

I know this is an old topic, but people might need a solution for this huge
issue, so here it is (or might be).

I've been debugging for hours. Zend_Session, Zend_Auth, var_dumps, etc; I
couldn't find anything. So then I started debugging from scratch again and
found a very very strange issue. If I var_dump'ed $_SESSION['somekey'], it
return a stdClass. It did not matter which key I used in $_SESSION, it
always returned the same stdClass. And that stdClass was an exact copy of an
object in my registry.

So then I tried to unset or destroy or change the session like this:
unset($_SESSION);
unset($_SESSION['key']);
$_SESSION = array();

When I then var_dump'ed session on the next line, I got an expected
array(0). However, when I var_dump'ed $_SESSION['key'] _on the next
line(!!)_, then I got the same stdClass again. This is theoretically
impossible, because I just unset it on the previous line.

So then I thought let's check out the registry. It doesn't do anything
special. The only thing that raises suspicion is the fact that's it extends
ArrayObject. The problem must be inside ArrayObject.

So I started Googling and found a known PHP issue (which will be fixed in
PHP 5.3); there are issues serializing ArrayObjects which contain other
ArrayObjects. So my guess is it also has problems when containg stdClasses.

I wasn't aware of the fact that I was using stdClasses. However, somewhere
in my code I defined:
$registry = Zend_Registry::getInstance();
$registry->foo->bar = 'Some value';

In this case, $registry->foo is an stdClass, because I use object notation
to add bar.

So now we have an extend ArrayObject containing an stdClass. And somehow
that stdClass is assigned to every $_SESSION-key and cannot be unset. An
internal PHP bug probably.

My fix is to avoid stdClasses in (extended) ArrayObjects. So avoid:
$registry->foo->bar

Just use something like:
$registry->foobar

Also, you probably want to avoid using ArrayObjects in your registry, but I
haven't tested that.

So, it's a very strange situation, but this fixed the entire problem for me.
See http://bogambilya.asti.dost.gov.ph/manual/bg/class.arrayobject.php and
Google for the known PHP bug.

sayusi wrote:
>
> Hi!
>
> I have a problem and i need some help. :)
>
> I use Zend_Auth i my application. The basic of using Zend_Auth Acrabat
> Zend_Auth tutorial.
>
> In my IndexController class is the next code:
>
> public function preDispatch() {
> $auth = Zend_Auth::getInstance();
> if(!$auth->hasIdentity()) {
> $this->_redirect('auth/login');
> }
> }
>
> Because everybody have to login.
> I use session storage with 'auth' namespace.
>
> But the code stop the next error message:
> Fatal error: Cannot use object of type stdClass as array in
> /var/www/saycms/zend_framework/Zend/Session/Abstract.php on line 92
>
> This code is part of Zend Framework.
> I search what is the problem several hours, but i don't know what is
> the problem. I understand what means the message, but i don't know
> why.
>
> I did this:
> 1, i changed the session namespace to nothing (default is "storage")
> 2, i drop the code (preDispatch() method) -> the code is working fine,
> but i can't protect my application. :(
> 3, I followed the error (var_dump() and die() -> it was funny... and
> long time...) and the result:
> the problem is in the Zend_Auth::hasIdentity() method
> public function hasIdentity()
> {
> return !$this->getStorage()->isEmpty();
> }
>
> Here is the problem is in the isEmpty() method. The method part of
> Zend_Auth_Storage_Session (Zend_Auth_Storage_Session is implement
> Zend_Auth_Storage_Interface) class:
>
> public function isEmpty()
> {
> return !isset($this->_session->{$this->_member});
> }
>
> if i run the code this:
>
> public function isEmpty()
> {
> var_dump($this->_session);
> echo "<br>";
> var_dump($this->_member);
> die();
> return !isset($this->_session->{$this->_member});
> }
> the result is like this:
>
> object(Zend_Session_Namespace)#36 (1) { ["_namespace:protected"]=>
> string(9) "Zend_Auth" }
> string(7) "storage"
>
> I searched the google lot of without results. Anybody hasn't this
> problem and i can't resolv this problem.
>
> Thank's the help.
>
> András
>
> ps.: sorry my english
>
> --
> - -
> -- Csanyi Andras -- http://sayusi.hu -- Sayusi Ando
> -- "Bízzál Istenben és tartsd szárazon a puskaport!".-- Cromwell
>
>

--
View this message in context: http://www.nabble.com/session-storage-problem-tp14601396p20914614.html
Sent from the Zend Auth mailing list archive at Nabble.com.