UBB.Developers Forums UBB.threads 7 Development How Do I? Working with threads cookies?

I am writing a couple database applications for my site, and I want to be able to check if a user is logged in and if so, what his username is. If not logged in, I want to deny access to my applications. Can anybody point me to a thread or document that explains how I can interact with UBB Threads cookies to do this sort of thing?

Thanks,
Trav

This is quite easy - you'll be interested in two cookies: w3t_myid and w3t_key.

myid contains the user number. key contains an md5 hash of the user number + the password as stored in the database (i.e. md5("$user_number$password"))

Some Perl, as my PHP is a little rusty...



If all your code is in PHP, you might want to look at including the Threads libraries directly, then using the internal calls to authenticate the user... though this may be difficult if your application is on the complex side. Things might conflict a bit.

Anyway. Once you've authenticated the user, then you can just pull the rest of the user info out of the database based on his number.

Thanks for the help, Charles!

One problem I have is that I notice that the w3t_key cookie only exists if the user chooses the 'remember me on each visit' option. Is the key stored in the session if the user does not choose to be remembered? And if so, is there a way for me to access it? I guess I don't understand how a user could be logged in with the wrong password, so maybe this really doesn't matter. I just need to be sure they are logged in.

Thanks,
Trav

Have a look at the authenticate function in ubbt.inc.php
You should be able to use most of it's code in your external application.

yup thats what I usualy use

[]Is the key stored in the session if the user does not choose to be remembered?[/]Mmm. Good question. It LOOKS like the session associated with the ID in w3t_mysess needs to match up with the user number in w3t_myid. (My code above is from an internal admin util I made for my moderators, and all of them log in w/ Remember Me... never really had think about that. Hmm.)

[]I guess I don't understand how a user could be logged in with the wrong password[/]Hackers - fear'em.

the w3t_sessionid puts a value in the w3t_users table U_Session field and that is compared to the w3t_myid by doing a database query based on U_Number.