Forums / General Questions / unset $_COOKIE['zenAdminID'] on admin logout

unset $_COOKIE['zenAdminID'] on admin logout

Views: 1,002

Results 1 to 7 of 7
2 May 2011, 9:31 PM
#1
p455w0rd avatar

p455w0rd

New Zenner

Join Date:
May 2011
Posts:
3
Plugin Contributions:
0

unset $_COOKIE['zenAdminID'] on admin logout

i'm designing a simple backend for my clients to be able to easily add news postings and update items not for sale..when i check for $_COOKIE['zenAdminID'], even after logging out of the zc admin interface, this variable keeps somehow being set until 3600...i need it to be unset immediately during logout,
thanks!

3 May 2011, 12:23 AM
#2
drbyte avatar

drbyte

Sensei

Join Date:
Jan 2004
Posts:
63,513
Plugin Contributions:
176

Re: unset $_COOKIE['zenAdminID'] on admin logout

Out-of-the-box Zen Cart sets only Session cookies, which expire when the session expires. Session cookies are different from regular cookies set to store data.
When the admin user logs out, the session data is cleared, and the user will not be able to login again since that session's data is no longer showing as logged-in.

.
Zen Cart - putting the dream of business ownership within reach of anyone!
Donate to: DrByte directly or to the Zen Cart team as a whole

Remember: Any code suggestions you see here are merely suggestions. You assume full responsibility for your use of any such suggestions, including any impact ANY alterations you make to your site may have on your PCI compliance.
Furthermore, any advice you see here about PCI matters is merely an opinion, and should not be relied upon as "official". Official PCI information should be obtained from the PCI Security Council directly or from one of their authorized Assessors.

3 May 2011, 7:44 PM
#3
p455w0rd avatar

p455w0rd

New Zenner

Join Date:
May 2011
Posts:
3
Plugin Contributions:
0

Re: unset $_COOKIE['zenAdminID'] on admin logout

I understand that the admin session is unset when you log out of the admin panel...somehow though, the 'zenAdminID' (a cookie in the "zenid" session) remains in the 'zenid' session cookies...to replicate:

add the following near the top of your template (somewhere in tpl_header.php):

<?php print_r($_COOKIE); ?>

open the page where the info will be displayed..you will notice that there is no mention of 'zenAdminID'...then in another tab, login to admin and log out...it does log out of the admin interface..but when you go back to the other tab and refresh..low and behold the 'zenAdminID' cookie is set..even AFTER logging out of the admin interface...this info has to be somewhere for it to be retrieved..i need it to completely unset when the admin logs out..even from the 'zenid' session..i've looked through every file/db table in zen cart and can't figure this crap out...

Also, if you do this:

<?php print_r($_COOKIE['zenAdminID']); unset($_COOKIE['zenAdminID']); ?>

and refresh..this cookie is still set..so i then did this:

<?php unset($_COOKIE['zenAdminID']); print_r($_COOKIE['zenAdminID']); ?>

and the cookie was finally gone...so this means that it's being loaded and set on every page load...so how do i edit the 'zenid' session so that when you log out of the admin panel, it unsets this annoying cookie?

3 May 2011, 8:26 PM
#4
drbyte avatar

drbyte

Sensei

Join Date:
Jan 2004
Posts:
63,513
Plugin Contributions:
176

Re: unset $_COOKIE['zenAdminID'] on admin logout

As far as "figuring this crap out", you can add whatever crap you wish to the end of the logout script if that's what will accomplish what you desire.

.
Zen Cart - putting the dream of business ownership within reach of anyone!
Donate to: DrByte directly or to the Zen Cart team as a whole

Remember: Any code suggestions you see here are merely suggestions. You assume full responsibility for your use of any such suggestions, including any impact ANY alterations you make to your site may have on your PCI compliance.
Furthermore, any advice you see here about PCI matters is merely an opinion, and should not be relied upon as "official". Official PCI information should be obtained from the PCI Security Council directly or from one of their authorized Assessors.

3 May 2011, 9:04 PM
#5
p455w0rd avatar

p455w0rd

New Zenner

Join Date:
May 2011
Posts:
3
Plugin Contributions:
0

Re: unset $_COOKIE['zenAdminID'] on admin logout

yup..tried that 'crap'...and sir..if you're not competent enough to understand that I'm seeking answer, not flaming, please stop replying..waste your time elsewhere..

3 May 2011, 10:22 PM
#6
drbyte avatar

drbyte

Sensei

Join Date:
Jan 2004
Posts:
63,513
Plugin Contributions:
176

Re: unset $_COOKIE['zenAdminID'] on admin logout

You still haven't explained why the existence of an expired session cookie, or an unexpired cookie pointing to an expired session, is posing a specific problem for you.

.
Zen Cart - putting the dream of business ownership within reach of anyone!
Donate to: DrByte directly or to the Zen Cart team as a whole

Remember: Any code suggestions you see here are merely suggestions. You assume full responsibility for your use of any such suggestions, including any impact ANY alterations you make to your site may have on your PCI compliance.
Furthermore, any advice you see here about PCI matters is merely an opinion, and should not be relied upon as "official". Official PCI information should be obtained from the PCI Security Council directly or from one of their authorized Assessors.

3 May 2011, 10:38 PM
#7
drbyte avatar

drbyte

Sensei

Join Date:
Jan 2004
Posts:
63,513
Plugin Contributions:
176

Re: unset $_COOKIE['zenAdminID'] on admin logout

Further ...

Merely doing "unset" on $_COOKIE is only dealing with memory variables, and not actually changing anything in the actual cookies. If you really want to delete the cookie, set it to an expired datestamp so that browser garbage-collection removes it.

But, that won't solve your problem. As soon as you load a Zen Cart admin page, the session infrastructure is restarted, and thus a zenAdminID session cookie will be created again. And it needs that in order to work.
So, clicking Logoff not only deactivates the current login, making the session useless, but it also redirects to the Login screen, which needs to start the session before it can present the login prompts properly for subsequent login.

So, I submit that whatever you're doing that's requiring that the cookie be removed is probably the wrong approach to whatever "problem" you're trying to solve.

.
Zen Cart - putting the dream of business ownership within reach of anyone!
Donate to: DrByte directly or to the Zen Cart team as a whole

Remember: Any code suggestions you see here are merely suggestions. You assume full responsibility for your use of any such suggestions, including any impact ANY alterations you make to your site may have on your PCI compliance.
Furthermore, any advice you see here about PCI matters is merely an opinion, and should not be relied upon as "official". Official PCI information should be obtained from the PCI Security Council directly or from one of their authorized Assessors.