bmaurice
Posts: 1
|
| Posted: 08/03/2006, 1:57 AM |
|
I have a rather alarming problem.
SETUP:
Apache on FreeBSD
PHP
MYSQL
CodeCharge 3.0.4.12
THE PROCES:
Created 2 pages,
1 login page and 1 restricted userdata update page
i have setup codecharge security the correct way
i login with my code and come to the next page with a few data fields already filled (because that already in the database), the selection of the data is done by the session variable UserID (wich is saved by codecharge)
now when i fill my other fields and click the update button a nice SQL update string is created with a 'WHERE rspid = 1' clause, it gets that from the session variable UserID.
everything goes ok here, only 1 record is updated.
THE PROBLEM:
when i login and leave the update screen open for more then 3hours (my session time is 180 minutes) and then push the update button i would expect that the update isnt done and get back to the login page. (i have set it up like that on the "access dienied page")
but what realy happens is the following.
an update SQL sting is created but this time without the WHERE clause and the update is executed, resulting in my complete database having the same values in the fields that just got updated. this is wrong and shouldnt be happening.
I modified my "Before update" event to check if the CCGetSession("UserID","") is still existing, if its not existing anymore i do a DIE("Session expired")
but this realy shouldnt be neccesary as i believe codecharge should handle this "problem"
is this a bug or "working as intended" ?
|
 |
 |
|
