How does SID get set?

[MindVerveMedia]

I've got a modified osCommerce that works at MidPhase and on my home computer. I just ported to Host Gator, and now the sessions aren't working. The links do not get the session ID. I don't see where SID is defined anywhere except includes/classes/sessions.php, but that file isn't getting called in my installation. I have these settings:

 

define('USE_PCONNECT', 'false'); // use persistent connections?

define('STORE_SESSIONS', 'mysql'); // leave empty '' for default handler or set to 'mysql'

[spooks]

r u linking correctly?

 

http://www.oscommerce.com/forums/index.php?sho...c=330479&hl

[MindVerveMedia]

r u linking correctly?

 

http://www.oscommerce.com/forums/index.php?sho...c=330479&hl

 

It's weird what's happening. The first time I go to the site, the links are correct and have the osCid. When I click on the link, the address is correct and has the osCid, but the links on the page are incorrect and do NOT have the osCid.

 

You can see for yourself: http://mindvervemedia.com

[MindVerveMedia]

I should add: I've got a test script up that calls a test version of application_top.php. From the looks of it, SID at the time of the call of tep_start session the first time the site is brought up. There's a link on the test page, and that looks correct on the first call as well. If I follow the link, the osCid appears in the address but is not set at the time of the call to tep_start_session.

[MindVerveMedia]

The test page is http://mindvervemedia.com/test.php

[spooks]

have u read the thread? are u using tep_href_link for all links etc

[MindVerveMedia]

Yes, I am using tep_href_link on the site and in the test script. If you put your cursor over the link, you will see in the status bar that it is correct. You can even follow it and see the osCid in the address bar, but tep_href_link does not put the osCid on the links on that page. SID is not set, somehow, so it does not get used. When I run my test script on my home server, everything is fine.

[MindVerveMedia]

I think I'm onto something here:

 

old code in application_top.php:

   if (isset($HTTP_POST_VARS[tep_session_name()])) {
 tep_session_id($HTTP_POST_VARS[tep_session_name()]);
  } elseif ( ($request_type == 'SSL') && isset($HTTP_GET_VARS[tep_session_name()]) ) {
 tep_session_id($HTTP_GET_VARS[tep_session_name()]);
  }

 

$HTTP_POST_VARS[tep_session_name()], which is checked in application_top.php, is not set,

but $HTTP_GET_VARS[tep_session_name()] is set.

But application_top.php only uses HTTP_GET_VARS if $request_type == 'SSL'. Why would it only want to use it if $request_type is 'SSL'?

 

I think my fix is to use HTTP_GET_VARS regardless of $request_type.

 

new code in application_top.php:

   if (isset($HTTP_POST_VARS[tep_session_name()])) {
 tep_session_id($HTTP_POST_VARS[tep_session_name()]);
  // } elseif ( ($request_type == 'SSL') && isset($HTTP_GET_VARS[tep_session_name()]) ) {
  } elseif ( isset($HTTP_GET_VARS[tep_session_name()]) ) {
 tep_session_id($HTTP_GET_VARS[tep_session_name()]);
  }

 

Is there any reason I should not want to do this?

[MindVerveMedia]

I'm still interested in knowing how SID gets set. My guess is that there's some php.ini variable that needs to be set to make it work properly. I know there are at least 2 variables that I had to modify to get things working when I first set up my systems, but I only remember register_globals.