aidenir / lychee Goto Github PK

At this point in PHP's lifecycle, it is probably important to maintain compatibility with 5.3. The reason is that various enterprise distributions tend to be quite conservative with package version updates. Example; EL6 is at PHP 5.3, EL7 (newest) is at PHP 5.4. In addition, upstream indicates a minimum requirement of PHP 5.3, so work should probably be consistent with this.

There are two problems stemming from php/modules/Users.php
https://github.com/Aidenir/Lychee/blob/multiuser/php/modules/Users.php#L36
https://github.com/Aidenir/Lychee/blob/multiuser/php/modules/Users.php#L165
The above two lines use short syntax array declarations, which weren't introduced until PHP 5.4. The lines are functionally equivalent to;
$data = array();
This part of the problem is solved in lbdroid@a3d3f79

The second problem;
https://github.com/Aidenir/Lychee/blob/multiuser/php/modules/Users.php#L56
https://github.com/Aidenir/Lychee/blob/multiuser/php/modules/Users.php#L108
https://github.com/Aidenir/Lychee/blob/multiuser/php/modules/Users.php#L133
https://github.com/Aidenir/Lychee/blob/multiuser/php/modules/Users.php#L135
The functions password_hash(...) and password_verify(...) were added in PHP 5.5.

I've worked around the second problem by adding in this library: https://github.com/Antnee/phpPasswordHashingLib .. however, I'm not certain what upstream's position would be on this.

It would probably be best to use the same mechanism for dealing with passwords as is already in use in the project, for instance;

https://github.com/Aidenir/Lychee/blob/multiuser/php/modules/Album.php#L637
https://github.com/Aidenir/Lychee/blob/multiuser/php/modules/Album.php#L676

This situation occurs after the client has been logged in for some time, without any activity. A client refresh will yield a GRAY screen, with a black line separating the header section from the body, but no data or buttons present.

In this situation, the $_SESSION array has two keys set; login = 1, identifier = ....
In addition, the role mode selection in php/api.php falls into GUEST mode, which is inconsistent with login = 1.

At this point, forcing it back into the same "role" that it was previously logged in as will return the functionality to normal. I do this by replacing the entire "if (admin) else if (user) else" block with the following;

$_SESSION['role'] = "admin";
define('LYCHEE_ACCESS_ADMIN', true);
$admin = new Admin($database, $plugins, $settings);
$admin->check($fn);

So what is happening, is it is losing the "role" variable of the session.

I will look into this more tomorrow.