Dreamweaver CS6登录服务器行为在生产服务器上不起作用

Question

非常感谢您的阅读。
我使用了DW CS 6.0-登录用户ServerBehaviour-生成的以下代码来开发具有两个用户组（即user和admin）的受密码保护的站点。 该站点仅用于演示目的（由于DW生成PHP-过时的MYSQL代码-没有PDO或MySQLi）

DB连接的代码：

$hostname_imerida = "xxxxx";
$database_imerida = "xxxxx";
$username_imerida = "xxxxx";
$password_imerida = "xxxxx";
$imerida = mysql_pconnect($hostname_imerida, $username_imerida, $password_imerida) or trigger_error(mysql_error(),E_USER_ERROR); 
mysql_set_charset('utf8',$imerida);
date_default_timezone_set('Europe/Athens');`  

如果凭据正确，DW生成的用于登录到站点的代码：

<?php
if (!function_exists("GetSQLValueString")) {
function GetSQLValueString($theValue, $theType, $theDefinedValue = "", $theNotDefinedValue = "") 
{
  if (PHP_VERSION < 6) {
    $theValue = get_magic_quotes_gpc() ? stripslashes($theValue) : $theValue;
  }

  $theValue = function_exists("mysql_real_escape_string") ? mysql_real_escape_string($theValue) : mysql_escape_string($theValue);

  switch ($theType) {
    case "text":
      $theValue = ($theValue != "") ? "'" . $theValue . "'" : "NULL";
      break;    
    case "long":
    case "int":
      $theValue = ($theValue != "") ? intval($theValue) : "NULL";
      break;
    case "double":
      $theValue = ($theValue != "") ? doubleval($theValue) : "NULL";
      break;
    case "date":
      $theValue = ($theValue != "") ? "'" . $theValue . "'" : "NULL";
      break;
    case "defined":
      $theValue = ($theValue != "") ? $theDefinedValue : $theNotDefinedValue;
      break;
  }
  return $theValue;
}
}
?>
<?php
// *** Validate request to login to this site.
if (!isset($_SESSION)) {
  session_start();

}

$loginFormAction = $_SERVER['PHP_SELF'];
if (isset($_GET['accesscheck'])) {
  $_SESSION['PrevUrl'] = $_GET['accesscheck'];
}

if (isset($_POST['username'])) {
  $loginUsername=$_POST['username'];
  $password=$_POST['password'];
  $MM_fldUserAuthorization = "role";
  $MM_redirectLoginSuccess = "managepub.php";
  $MM_redirectLoginFailed = "index.php";
  $MM_redirecttoReferrer = true;
  mysql_select_db($database_imerida, $imerida);

  $LoginRS__query=sprintf("SELECT username, password, role FROM users WHERE username=%s AND password=%s",
  GetSQLValueString($loginUsername, "text"), GetSQLValueString($password, "text")); 

  $LoginRS = mysql_query($LoginRS__query, $imerida) or die(mysql_error());
  $loginFoundUser = mysql_num_rows($LoginRS);


  if ($loginFoundUser) {

    $loginStrGroup  = mysql_result($LoginRS,0,'role');

    if (PHP_VERSION >= 5.1) {session_regenerate_id(true);} else {session_regenerate_id();}
    //declare two session variables and assign them
   $_SESSION['MM_Username'] = $loginUsername;
   $_SESSION['MM_UserGroup'] = $loginStrGroup;  

    if (isset($_SESSION['PrevUrl']) && true) {
      $MM_redirectLoginSuccess = $_SESSION['PrevUrl'];  
    }
    header("Location: " . $MM_redirectLoginSuccess );
  }
  else {
    header("Location: ". $MM_redirectLoginFailed );
  }
}
?>

检查（在这种情况下）是否已登录admin（如果未登录）的代码段，它将强制从您尝试访问的页面注销：

<?php
if (!isset($_SESSION)) {
  session_start();
}
$MM_authorizedUsers = "admin";
$MM_donotCheckaccess = "false";

// *** Restrict Access To Page: Grant or deny access to this page
function isAuthorized($strUsers, $strGroups, $UserName, $UserGroup) { 
  // For security, start by assuming the visitor is NOT authorized. 
  $isValid = False; 

  // When a visitor has logged into this site, the Session variable MM_Username set equal to their username. 
  // Therefore, we know that a user is NOT logged in if that Session variable is blank. 
  if (!empty($UserName)) { 
    // Besides being logged in, you may restrict access to only certain users based on an ID established when they login. 
    // Parse the strings into arrays. 
    $arrUsers = Explode(",", $strUsers); 
    $arrGroups = Explode(",", $strGroups); 
    if (in_array($UserName, $arrUsers)) { 
      $isValid = true; 
    } 
    // Or, you may restrict access to only certain users based on their username. 
    if (in_array($UserGroup, $arrGroups)) { 
      $isValid = true; 
    } 
    if (($strUsers == "") && false) { 
      $isValid = true; 
    } 
  } 

  return $isValid; 
}

$MM_restrictGoTo = "index.php";
if (!((isset($_SESSION['MM_Username'])) && (isAuthorized("",$MM_authorizedUsers, $_SESSION['MM_Username'], $_SESSION['MM_UserGroup'])))) {   
  $MM_qsChar = "?";
  $MM_referrer = $_SERVER['PHP_SELF'];
  if (strpos($MM_restrictGoTo, "?")) $MM_qsChar = "&";
  if (isset($_SERVER['QUERY_STRING']) && strlen($_SERVER['QUERY_STRING']) > 0) 
  $MM_referrer .= "?" . $_SERVER['QUERY_STRING'];
  $MM_restrictGoTo = $MM_restrictGoTo. $MM_qsChar . "accesscheck=" . urlencode($MM_referrer);

  header("Location: ". $MM_restrictGoTo); 
  exit;
}
?> 

该站点在localhost（XAMPP 1.7.7 [PHP：5.3.8]）上运行良好。 在生产环境（带有PHP版本5.3.3的Linux）中，需要两次或三次或四次尝试使用正确的密码登录，或者在登录并尝试访问页面后（假设您以admin身份登录），它将重定向您再次回到初始页面以再次输入凭据（请在下面用作参考）

$MM_restrictGoTo = $MM_restrictGoTo. $MM_qsChar . "accesscheck=" . urlencode($MM_referrer);

  header("Location: ". $MM_restrictGoTo); 

实验表明，如果我注释掉
if (PHP_VERSION >= 5.1) {session_regenerate_id(true);} else {session_regenerate_id();}生产服务器中的问题已得到缓解，并且出现的频率很少。 这向我指出了服务器中的会话处理有问题的方向，但是我无法提出下一步应该做什么或为什么会发生这种情况。

请分享您可能有的任何想法。

非常感谢。

Answer 1

我建议调试网络标题（Chrome中为F12），然后查看问题所在。

似乎在生产服务器上偶尔会有来自服务器的奇怪的重定向响应。

我建议看一下Apache配置文件。 对于OP，托管服务提供商负责Apache配置。 OP联系了托管服务提供商并解决了他的问题。 托管服务提供商方面的会话管理存在问题。