Hi Dreamscape,
That does make sense. I've looked at the init_sid_redirect but I can't seem to find what you are referring to:
<?php
/**
* ZC Initial Redirect - Remove Session ID from query string if cookies are enabled
*
* @package ZC Initial Redirect
* @author Eivind E. Valderhaug, {@link http://www.dataweb.no/net/contact/ contact the author}
* @copyright Copyright (C) 2006 Eivind E. Valderhaug
* @license {@link http://www.gnu.org/copyleft/gpl.html Gnu General Public License version 2 (dated June 1991)}
* @version SVN: $Id: init_sid_redirect.php 18 2006-09-28 14:35:37Z evalder $
*/
# this line is copied from init_sanitize.php (breakpont 100), in order to use breakpoint 75 instead (run as little code as possible)
if (!isset($_GET['main_page']) || !zen_not_null($_GET['main_page'])) $_GET['main_page'] = 'index';
# keep any post data after redirection
if (isset($_SESSION['_post']) && is_array($_SESSION['_post']))
{
if (count($_POST) === 0)
{
$_POST = $_SESSION['_post'];
}
unset($_SESSION['_post']);
}
# $_SERVER['QUERY_STRING'] is supposedly not automatically created on certain systems
# simulate the creation of $_SERVER['QUERY_STRING']
function dm_get_query_string($ampersand_encode = true)
{
$result = array();
foreach($_GET AS $key => $value)
{
$result[] = $key . ( $value != '' ? '=' . $value : '' );
}
if ($ampersand_encode === true)
{
return implode('&', $result);
}
return implode('&', $result);
} # end function dm_get_query_string
$_SERVER['QUERY_STRING'] = dm_get_query_string(false);
$session_id = session_id();
$session_name = session_name();
switch (true)
{
case ($session_id == ''):
# a session has not been started, so don't do anything
break;
case (!isset($_SESSION['prev_request_type']) || $_SESSION['prev_request_type'] != $request_type):
# this is either the initial hit or we're switching between SSL and NON-SSL
# make sure the sid is in the query string
$_GET[$session_name] = $session_id;
$_SERVER['QUERY_STRING'] = dm_get_query_string(false);
# remember this request type - if we change from/to SSL we need to recheck that a cookie has been set
$_SESSION['prev_request_type'] = $request_type;
# remember any posted data
$_SESSION['_post'] = $_POST;
session_write_close();
# redirect to self with the SID in the query string
zen_redirect(zen_href_link($_GET['main_page'], zen_get_all_get_params(), ($request_type == 'SSL' ? 'SSL' : 'NONSSL'), true));
case (isset($_COOKIE[$session_name])):
# cookies are enabled
if (isset($_GET[$session_name]) && $_GET[$session_name] != '')
# a SID is in the query string
{
# remove the SID from the query string
unset($_GET[$session_name]);
$_SERVER['QUERY_STRING'] = dm_get_query_string(false);
# remember any posted data
$_SESSION['_post'] = $_POST;
# end session
session_write_close();
# redirect with clean query string
zen_redirect(zen_href_link($_GET['main_page'], zen_get_all_get_params(), ($request_type == 'SSL' ? 'SSL' : 'NONSSL')));
}
default:
# remember this request type - if we change from/to SSL we need to recheck that a cookie has been set
$_SESSION['prev_request_type'] = $request_type;
break;
}
?>
