Users access sessions of other users

0

Good evening, I tell you my problem. I have an app developed in PHP with Codeigniter running on a web hosting in Wiroos. Everything was working correctly, but as time passed, the application was having more users who access simultaneously (obviously) and the following problem began to occur.

When user A logs in from location A, a session A is generated. If, at the same time, user B from location B accesses the application, the session of user A is automatically loaded in its location B. .. how can this be possible?

I show you the code of my application to see if you can help me

Login Driver

public function index($estadoLogin = 0){

    if($this->session->userdata('estado_sesion'))
    {
        redirect(base_url()."panel");
    }
    $data['estadoLogin'] = $estadoLogin;
    $data['title'] = "Iniciar Sesión - LandingApp";
    $data['bodyClass'] = "external-page sb-l-c sb-r-c";

    $this->load->view('templates/header',$data);        
    $this->load->view('login/loginbox', $data);

}//End method index

Login method

    public function ingresar(){
    $correo = $this->security->xss_clean(strip_tags($this->input->post('correo')));
    $pass = md5($this->security->xss_clean(strip_tags($this->input->post('password'))));

    $Usuarios = new Usuario_Model();
    $result = $Usuarios->login($correo, $pass);
    if(count($result)>0){
        foreach($result as $u){
            $this->session->unset_userdata('id');
            $this->session->unset_userdata('mail');
            $this->session->unset_userdata('nombre');
            $this->session->unset_userdata('activo');
            $this->session->unset_userdata('logo_empresa');
            $this->session->unset_userdata('nombre_empresa');
            $this->session->unset_userdata('id_empresa');
            $this->session->unset_userdata('nivel');
            $this->session->unset_userdata('estado_sesion');

            $this->session->set_userdata('id', $u->id);
            $this->session->set_userdata('mail', $u->mail);
            $this->session->set_userdata('nombre', $u->nombre);
            $this->session->set_userdata('activo', $u->activo);
            $this->session->set_userdata('nivel', $u->nivel);
            $this->session->set_userdata('nombre_empresa', $u->nombre_empresa);
            $this->session->set_userdata('id_empresa', $u->id_empresa);
            $this->session->set_userdata('logo_empresa', $u->logo_empresa);
            $this->session->set_userdata('avatar_user', $u->avatar_user);
            $this->session->set_userdata('estado_sesion', TRUE);

            redirect(base_url()."panel");

        }//End foreach


    }else{
        $this->session->set_flashdata('mensaje', 'El usuario o password es incorrecto');
        redirect(base_url()."login/index/1");
        //$this->index(1);
    }//End if

Panel Controller

public function index(){


    $id = $this->session->userdata('id');
    $id_empresa = $this->session->userdata('id_empresa');

    $data_session['title'] = "Panel General";
    $data_session['opcionMenu'] = "panel";
    $data_session['bodyClass'] = "dashboard-page";

    $data_session = $this->session_data_lib->set_data_session($data_session); //cargo las variables de sesion

    if ($data_session['nivel']==1 || $data_session['nivel']==2){

        $data_counters = $this->counters_lib->get_admin_counters(); //cargo las variables de contadores

    }else{
        $data_counters = $this->counters_lib->get_user_counters(); //cargo las variables de contadores
    }

    $this->load->view('templates/header', $data_session);
    $this->load->view('templates/menu_top', $data_session);
    $this->load->view('templates/menu_left', $data_counters);
    if ($data_session['nivel']==0) {
        $this->load->view('panel/panel_user',$data_counters);
    }else{
        $this->load->view('panel/panel_admin',$data_counters);
    }

    $this->load->view('templates/footer',$data_counters);

}//End method index

Session_Data_lib > set_data_session

public function set_data_session($data_session){
$data_lib_session['title'] = $data_session['title'];
$data_lib_session['opcionMenu'] = $data_session['opcionMenu'];
$data_lib_session['bodyClass'] = $data_session['bodyClass'];
$data_lib_session['nombre'] = $this->CI->session->userdata('nombre');
$data_lib_session['userid'] = $this->CI->session->userdata('id');
$data_lib_session['nivel'] = $this->CI->session->userdata('nivel');
$data_lib_session['avatar_user'] = $this->CI->session->userdata('avatar_user');
$data_lib_session['logo_empresa'] = $this->CI->session->userdata('logo_empresa');
$data_lib_session['nombre_empresa'] = $this->CI->session->userdata('nombre_empresa');
$data_lib_session['id_empresa'] = $this->CI->session->userdata('id_empresa');
$data_lib_session['arr_css'] = array("absolute_admin/assets/fonts/iconsweets/iconsweets.css");
$data_lib_session['lastSegs'] = $this->CI->panel_model->get10LastSeg($this->CI->session->userdata('id_empresa'));

return $data_lib_session;
}//End method set_data_session

I tried to migrate Codeigniter to version 3.0, and even make the following configuration in application / config / config.php

$config['sess_driver'] = 'database';
$config['sess_cookie_name'] = 'ci_sessions';
$config['sess_expiration'] = 7200;
$config['sess_save_path'] = 'ci_sessions';
$config['sess_match_ip'] = TRUE;
$config['sess_time_to_update'] = 300;
$config['sess_regenerate_destroy'] = FALSE;

I do not know what else to try, I have the feeling that it can be a server configuration, but I still had no response from the support other than this:

  

Our servers have a micro-cache layer managed by nginx that may have caused this behavior, now I deactivated it for your domain. Could you please try again?

Obviously the problem persists. I do not understand how it can be that two different users from different locations can access the session of the other at the time that both are consulting the server. I hope you can help me, thanks!

    
asked by leavai 10.11.2017 в 03:21
source

2 answers

0

The problem was in the hosting due to a configuration in the micro-cache layer managed by nginx. They deactivated it in my domain and the problem disappeared.

Topic closed, thanks!

    
answered by 22.11.2017 / 16:15
source
0

Could you post the Usuario_model code to see the user / password comparison? Maybe the user query returns more than one value ...

    
answered by 15.11.2017 в 12:53