Question

我正在与https://www.thereverendmichael.com/3.0/合作使用演示/演示（用户名/密码）的演示登录名。要发布所有代码只是太多代码，但是我将发布遇到问题的主要部分。我遇到的问题是，由于某种原因，当我尝试对https页面进行Ajax查询并尝试将成功的$_GET变量设置为$_SESSION变量时，它们不会转移并且返回未经授权的访问

[form.php]

<? 
session_start();
header('Access-Control-Allow-Origin: *');
if (!isset($_SESSION['id'])) {
?>
<html>
    <head>
        <script type="text/javascript">
            alert("Unauthorized access. Redirecting to login page...");
            window.location="https://www.thereverendmichael.com/3.0/index.php";
        </script>
    </head>
</html> 
<? } ?>

[index.php]

	$("#login-submit").click(function(){
			$("#login-form").trigger("submit");
	});
	$("#login-form").submit(function(e) {
		e.preventDefault();
		$.ajax({
			type: "GET",
			url: "https://www.thereverendmichael.com/3.0/login.php",
			data: $("#login-form").serialize(),
			cache: true,
			AllowGet: true,
			success: function(data) 
			{
				switch(data)
					{
						case "1":
							alert("Admin login successful. Redirecting...");
							window.location = "https://www.thereverendmichael.com/console/admin.php";
							break;
						case "2":
							alert("Login successful. Redirecting...");
							window.location = "https://www.thereverendmichael.com/3.0/form.php";
							break;
						case "3":
							alert("Username does not match account records. Please try again.");
							break;
						case "4":
							alert("Password does not match account records. Please try again.");
							break;
					}
			}
		});
	});

[login.php]

<?php
    header('Access-Control-Allow-Origin: *'); 
    $conn = mysql_connect("107.180.20.91", "redphyre", "Qazplm10!") or die(mysql_error());
    $conn = mysql_select_db("mikenbrenda", $conn);

    $user = $_GET['username'];
    $pass = md5($_GET['password']);

    $sql = "SELECT username,password,admin FROM users WHERE username = '$user'";

    $res = mysql_query($sql) or die(mysql_error());
    $row = mysql_fetch_array($res);

    class SessionManager
    {
       static function sessionStart($name, $limit = 0, $path = '/', $domain = null, $secure = null)
       {
          // Set the cookie name before we start.
          session_name($name . '_Session');

          // Set the domain to default to the current domain.
          $domain = isset($domain) ? $domain : isset($_SERVER['SERVER_NAME']);

          // Set the default secure value to whether the site is being accessed with SSL
          $https = isset($secure) ? $secure : isset($_SERVER['HTTPS']);

          // Set the cookie settings and start the session
          session_set_cookie_params($limit, $path, $domain, $secure, true);
          session_start();
       }
    }

    if ($row[0] == $user && $pass == $row[1]) {
        SessionManager::sessionStart('login', 0, '/', 'www.thereverendmichael.com', true);
        $_SESSION['id'] = $user;
        if ($row[2] == "1") {
            $_SESSION['admin'] = $row[2];
            setcookie("admin", $row[2]);
            echo "1";
        }
        else {
            echo "2";
        }
    }
    else {
        if ($row[0] != $user) {
            echo "3";
        }
        if ($row[1] != $pass) {
            echo "4";
        }
    }
?>

在HTTPS环境的同一域中，PHP会话数据未在页面之间进行传输

0 个答案: